What is ISO 27018?

ISO 27018, also known as ISO/IEC 27018:2019, is an international standard that provides guidelines and best practices for protecting personally identifiable information (PII) in public cloud computing environments. Specifically, ISO 27018 focuses on cloud service providers (CSPs) and their responsibilities when handling PII and other personal data of individuals.

Here are key points to understand about ISO 27018:

1. Privacy Controls: ISO 27018 sets forth a set of privacy controls and guidelines designed to help cloud service providers establish and maintain robust data protection practices. These controls address various aspects of data privacy, including consent, data minimization, transparency, and data subject rights.
2. Pseudonymization: The standard encourages the use of pseudonymization techniques to protect PII. Pseudonymization involves replacing personally identifiable information with artificial identifiers, making it more challenging for unauthorized parties to identify individuals.
3. Third-Party Auditing: ISO 27018 promotes third-party auditing and certification to verify compliance with its privacy controls. This can provide customers with assurance that a cloud service provider is following the recommended practices.
4. Data Portability and Deletion: The standard outlines requirements for data portability, giving data subjects the ability to access their data and transfer it to other service providers. It also includes provisions for data deletion when it’s no longer needed for its intended purpose.
5. Transparency and Notice: CSPs are encouraged to be transparent about their data processing activities and to provide clear notices to data subjects about how their data is used.
6. Subcontractor Management: ISO 27018 addresses the responsibilities of cloud service providers when engaging subcontractors. CSPs are expected to ensure that subcontractors adhere to the same privacy standards.
7. Cross-Border Data Transfers: The standard considers international data transfers and provides guidelines for ensuring that data is protected when it crosses national borders.
8. Compliance with Legal Requirements: ISO 27018 aligns with various data protection laws and regulations, such as the European Union’s General Data Protection Regulation (GDPR). Complying with ISO 27018 can assist organizations in meeting legal requirements related to data protection.

ISO 27018 is a valuable framework for cloud service providers that handle personal data in cloud environments, helping them establish a strong foundation for data privacy and security. Organizations that utilize cloud services should consider ISO 27018 compliance when assessing the privacy and security practices of potential cloud service providers to ensure the protection of their data and the privacy of their customers.