Clarify public-cloud PII processing roles, instructions and subprocessors, and define data return, deletion and retention at service exit.
Scope and use
ISO/IEC 27018 provides privacy protection guidance for public-cloud providers acting as PII processors. It complements contractual and legal obligations and does not replace a privacy law or a complete PIMS.
Key requirements
- Record customer instructions, processing purposes, data categories and the provider’s role; identify subprocessors and approval or notice arrangements.
- Set safeguards for access, disclosure, security incidents, data subject requests, retention and permitted use of customer data.
Implementation outline
- Record customer instructions, processing purposes, data categories and the provider’s role; identify subprocessors and approval or notice arrangements.
- Set safeguards for access, disclosure, security incidents, data subject requests, retention and permitted use of customer data.
- Define return and deletion steps, backup timelines, legal retention exceptions and evidence of completion when a service ends.
- Review contracts and processing records; verify subprocessor transparency; test incident notifications and data-subject request support; retain exit evidence.