ISO 27018: How to Protect Personal Data in the Cloud

ISO 27018 is the code of practice for protecting personal data in public clouds. It tells a cloud provider that processes personal data on behalf of customers what to control, document and promise, so that those customers can check the provider against their own data protection duties.

The standard is aimed at the provider, not at the company that simply uses cloud tools. If you run software, hosting or an online service on which other businesses store personal data, it describes the practices a purchasing department or a data protection officer will expect from you.

What ISO 27018 is

The full title of ISO 27018:2019 is a code of practice for the protection of personally identifiable information (PII) in public clouds acting as PII processors. Three terms in that title matter.

• Public cloud: a service delivered over shared infrastructure, such as a SaaS application or a hosted platform.
• PII: any information that relates to an identifiable person, for example names, email addresses, order histories or IP addresses.
• Processor: the party that handles the data on the instructions of someone else, the customer, who decides why and how the data is used.

The standard builds on the information security controls of ISO 27002 and adds controls written specifically for personal data in the cloud. Security alone is not the goal. The standard is just as concerned with what the provider does with the data, who else sees it and what happens when the contract ends.

Who needs it

The typical reader is a SaaS vendor, a hosting company, a start-up with a B2B web application or an agency that runs a client's CRM, newsletter tool or web shop on its own infrastructure. In each case the client's customers, employees or leads sit in your systems, and the client remains responsible for them towards the people concerned.

If you only use cloud services for your own staff and customer data, you are on the other side of the relationship. ISO 27018 does not apply to you as a provider, but you can use it as a yardstick when you choose suppliers: a provider that works to this standard has answered most of the questions you would otherwise put in a supplier questionnaire.

What the standard asks for in practice

The controls follow familiar privacy principles. Here is what they mean in daily operation.

Act only on the customer's instructions

The provider processes personal data to deliver the contracted service and for nothing else. Using customer data for the provider's own advertising or marketing is not allowed without the customer's express consent, and that consent must not be a condition of getting the service. The contract should say this in plain terms.

Limit use, retention and disclosure

The provider needs a defined way to return or delete customer data when the contract ends, and a rule for how long backups live. Temporary files created during processing should be erased within a set period. If an authority demands access to customer data, the provider records the request and informs the customer, unless the law forbids it.

Be open about subcontractors and locations

Customers must be able to find out which subcontractors touch their data and in which countries it may be stored or processed. A current list of subprocessors, kept with the contract documents, answers this. An outdated list is worse than none, because the customer relies on it.

Support the rights of the people concerned

People whose data you hold can ask the customer for access, correction or deletion. The customer can only answer if you give them the tools or the help to find and change the data in your systems. Define who handles such a request on your side and how fast.

Secure the data and report incidents

This part resembles ISO 27001 practice: access control, encryption, logging, and confidentiality commitments for staff who can reach personal data. In addition, the provider tells the customer without undue delay when personal data has been accessed or lost in an unauthorised way, so that the customer can meet its own reporting duties.

Keep records

Accountability means that you can show what you do. Policies, the subprocessor list, deletion logs, incident records and training attendance are the evidence a customer audit or a tender questionnaire will ask for.

How it relates to ISO 27001, GDPR and Swiss data protection law

ISO 27018 is not a management system on its own. It extends the control set of ISO 27002, which supports ISO 27001. A company with an ISO 27001 system, built around clauses 4 to 10 from context of the organization to improvement, adds the 27018 controls on top. A company without ISO 27001 can still work through the 27018 controls, but will find that many of them assume basic security processes already exist.

The standard does not replace legal compliance. The GDPR requires a written contract between controller and processor, and the Swiss Federal Act on Data Protection contains its own rules for processors. ISO 27018 gives you a structured way to meet the practical side of those contracts and to demonstrate it. Whether a given contract and a given data flow are lawful remains a question for your own legal advice.

Smaller providers sometimes assume that this level of documentation is reserved for large cloud vendors. Our guide to ISO certification for small and medium businesses explains why a ten-person company can meet the same requirements with proportionate effort.

Checklist: are you ready to show ISO 27018 practices?

• You have a list of all services in which you process personal data for customers.
• Your contracts state that you process data only on the customer's instructions.
• Customer data is not used for your own marketing, analytics or product training without express consent.
• You keep a current list of subprocessors and the countries where data is stored.
• Customers are told before you add or replace a subprocessor.
• You can return or delete customer data at contract end, including backups after a defined period.
• Temporary files and exports containing personal data are erased on a schedule.
• A named person handles requests from authorities and informs the customer where the law allows.
• You have a process to support access, correction and deletion requests from your customers.
• Access to personal data is limited by role, and staff with access have signed a confidentiality commitment.
• Personal data is encrypted in transit and at rest.
• Your incident procedure includes notifying affected customers without undue delay.
• Policies, logs and training records are stored where you can produce them on request.

Common gaps

The same weak points appear again and again in small providers. Backups are the first: the production database is deleted on request, but copies remain for years. Log files are the second. They often contain email addresses or IP addresses and are kept indefinitely because nobody classed them as personal data. A third is the subprocessor list. The hosting provider, the email delivery service and the support tool are all subprocessors, yet many lists name only one of them.

A fourth gap is internal use. A sales team that exports customer lists from the platform to test a campaign breaks the principle of acting only on instructions, even with good intentions. A short rule and a technical restriction on exports solve this.

Choosing the route to a certificate

There are two ways to obtain a certificate. The classic route involves an on-site audit by a certification body, with the scheduling and cost that come with it. The other is an assessment completed online. Which one suits you depends on what your customers ask for. Our overview of ISO certification without an audit sets out what the online route involves and where it fits.

How Zertify fits in

Zertify issues certificates for ISO 27018:2019 on the basis of an online self-assessment. There is no on-site audit. You answer questions about the practices described above and upload evidence where it is requested. A member of the SICE Certification Board reviews every assessment. The certificate is issued by G6 Agency AG under licence from SICE, and the certificate is issued within 4 hours after a passed assessment and payment.

The PDF carries a QR code that leads to a public verification page, so a customer, a purchasing department or a tender evaluator can confirm that the certificate is genuine without contacting you. The certificate is valid for three years. Each year you confirm it with a short online re-audit, which is part of a yearly subscription. The pricing page shows the current terms.

If you have worked through the checklist above, you can start the assessment and see which questions remain open.

What to do before you start

Gather the documents first: a standard customer contract or data processing agreement, the subprocessor list, your deletion and retention rules, your incident procedure and a short description of how access to customer data is controlled. Having them to hand shortens the assessment and shows quickly where a gap still needs closing.