ISO/IEC 27018

ISO/IEC 27018:2019 Information technology. Security methods. Code of Good Practice for the Protection of Personal Data in Public Clouds Acting as Data Controllers

ISO/IEC 27018

ISO/IEC 27018 is an international standard specifically designed for cloud services, in view of the increasing number of public and private sector organizations moving to cloud information services in order to achieve efficiency and reduce costs.
Because ISO/IEC 27018 is designed for the cloud, it can provide a critical level of transparency for cloud customers who want to better understand and compare the practices of different cloud service providers and how they provide security and protection for personal data.

ISO/IEC 27018 is applicable to all types and sizes of organizations, including public and private companies, government organizations and non-profit organizations, which provide services as data controllers through cloud services under contract with other organizations.
The guidance in the standard can also be useful for organisations acting as supervisory authorities of processors. It should be borne in mind that the standard does not cover the additional obligations of the control bodies arising from legislation, regulations and normative acts.

The purpose of this standard is to create a common set of security categories and controls that can be implemented by a cloud service provider acting as a personal data controller. ISO/IEC 27018 has the following objectives:

• the cloud service provider to be facilitated in complying with the applicable requirements for processors, regardless of whether these obligations are direct or through a contract for the processing of personal data;
• make the services of the data processor transparent and accessible, so that customers can choose well-managed cloud data processing services;
• assist the cloud service customer and the cloud data controller in concluding a contract or agreement;
• provide cloud service customers with a mechanism to exercise control over their personal data hosted in the cloud.

Structure:
ISO/IEC 27018 follows the framework adopted in the other ISO information security management standards of the 27000 series. The standard is closely integrated with ISO/IEC 27002 "Information technology. Security methods. Code of Good Practice for Information Security Management", and the requirements for information security management have been expanded in the direction of processing personal data in the cloud.

With the implementation of ISO/IEC 27018, cloud service providers assure users that:

• process personal information only in accordance with the user's instructions;
• agree not to process personal information for advertising or marketing purposes without the explicit consent of the client;
• adopt appropriate organisational and security measures;
• refuse to disclose information except to law enforcement authorities when required by law;
• ensure transparency about their data processing practices.