Platform
Modules
By sector
By sector
By standard
Blog
News
Events
ISO/IEC 27018
Organisations processing personal data in the cloud, and the suppliers who serve them.
ISO 27018 extends ISO 27001 to the protection of personal data in public clouds. ComplyTrain gives you the framework to manage and evidence those controls.
ISO 27018 is a code of practice for protecting personally identifiable information (PII) in public cloud computing. It takes the general controls of ISO 27001 and ISO 27002 and adds a set specific to a cloud provider that processes personal data on behalf of its customers - covering consent, transparency, data handling, and the rights of the people whose data is held.
It is not a stand-alone management system. ISO 27018 is applied within an ISO 27001 ISMS: the management system provides the structure and the risk discipline, and ISO 27018 supplies the cloud-and-privacy-specific controls that sit inside it.
When an organisation moves personal data into a public cloud, it hands day-to-day control of that data to a provider - but not the accountability for it. ISO 27018 exists to give both sides a common, auditable baseline for how that data is handled: what the provider may and may not do with it, how it is returned or deleted, and how the provider demonstrates it. For a European organisation it maps closely onto GDPR expectations for processors, which is why it so often travels alongside a data-protection programme.
Two audiences: cloud providers that process personal data and want to prove they handle it responsibly, and the organisations that buy from them and must satisfy their own regulators that their processor is trustworthy. If you process personal data in the cloud - as a provider or as a customer relying on one - ISO 27018 is the control set that makes “we protect it” demonstrable.
ISO 27001 is the frame; ISO 27018 is a set of additional, privacy-focused controls hung on it. You run the ISMS - scope, risk assessment, Annex A controls, Statement of Applicability - and extend it with the ISO 27018 controls wherever you process cloud PII. In practice, organisations certify to ISO 27001 with ISO 27018 controls incorporated, rather than certifying to ISO 27018 on its own.
ISO 27018 is not the GDPR and does not make you compliant with it on its own - the regulation carries legal obligations a code of practice cannot discharge. But the two are closely aligned: transparency to data subjects, restrictions on secondary use, support for data-subject rights and control over sub-processors are common to both. Implementing ISO 27018 within your ISMS is a practical way to evidence the security-and-handling side of your GDPR processor obligations.
ComplyTrain gives you one place to manage and evidence the additional controls ISO 27018 asks for, within the same ISMS you run for ISO 27001:
ComplyTrain is not itself ISO 27018 certified, and does not need to be: it is the system you build and run your own ISO 27018 program in. The certificate is yours to earn - ComplyTrain is where the evidence for it lives.
Tell us how you need to work with ISO/IEC 27018 and what you need from it. We will come back to you about what ComplyTrain can do.
Thank you. Your list is on its way to your inbox, and we will come back to you on what working with these standards in ComplyTrain involves, usually within one business day.
In practice, yes. ISO 27018 is a set of cloud-and-PII-specific controls applied within an ISO 27001 information security management system. ComplyTrain lets you manage both in one place, tracing the additional ISO 27018 controls alongside your Annex A controls.
ISO 27018 is normally certified as part of an ISO 27001 certification rather than on its own - the ISO 27018 controls are incorporated into the ISMS and its Statement of Applicability, and the certification body audits them alongside the Annex A controls. Providers often state that their ISO 27001 certificate includes the ISO 27018 code of practice.
No. The GDPR is law and carries obligations - lawful basis, data-subject rights, breach notification - that a code of practice cannot satisfy by itself. ISO 27018 addresses the security and handling of personal data in the cloud, which is a large part of a processor’s GDPR duties, so the two are complementary: ISO 27018 helps you evidence the security side, not replace the legal programme.
Implementation
ISO 27018 is adopted inside an ISO 27001 system, not alongside it. The additional work is focused.
Identify where personal data is processed in the cloud, for whom, and under what agreements - the scope the ISO 27018 controls apply to.
Add the ISO 27018 controls to your ISO 27001 Statement of Applicability - consent, transparency, data return and deletion, sub-processor control - and assign owners.
Operate the controls, keep the records that prove them, and include ISO 27018 in your internal audit and the certification body’s audit of the ISMS.
A standard usually arrives as a contract condition rather than a project anyone planned for, and often at a company with no quality manager. Software is half the answer. Skylen's consultants are the other half, and because they build on ComplyTrain from day one you keep a live system your team owns rather than a binder and a departed consultant.
A clause-by-clause read of where you stand against the standard your contract cites, turned into a prioritised plan you could act on with us or alone.
What an assessment coversOur consultants build the system with your team - procedures, document control, the records you need to keep and the review cadence - and prepare you for the certification audit.
How an engagement worksWe run and maintain the quality system for you, so a small team can reach and hold a standard without hiring a quality manager.
What full-service meansOne system for the whole compliance programme. Start with the module you need most.
Collect information the same way every time, and decide in advance what happens next.
Know whether your controls are operating, not just whether a policy says they exist.
Turn the compliance work you already know about into a plan with owners, dependencies and dates.
Know what you can offer, and hold the evidence behind every configuration you offer it in.
Eight built-in reports across every module, scheduled, delivered, and filed where the evidence lives.
The sector news that matters to your organisation - read and rated by AI, and delivered as a scheduled digest in your own language.
AI reads the tender pack and pulls out the requirements, deadlines and rules - then helps you draft the response from your own approved content, with you reviewing every step.
One current register of the suppliers and partners you depend on - each risk-assessed, re-assessing itself on schedule, and wired straight into your risk register.
See every requirement you face - across every standard, plus your own contracts and policies - traced to the documents, evidence and processes that satisfy it.
Identify, score, treat and review your risks in one place - with AI to help anyone run a proper assessment, and a defensible trail behind every decision.
Assign training, prove it was understood, and hold the competence records an auditor asks for.
Draft compliance documents with AI, keep every version under control, and export them beautifully branded - all in one place.
Audits, corrective actions, processes and approvals in one quality system, organised around ISO 9001.
A 90-day plan for the smallest defence suppliers: let the tender set your scope, document what you already do, fix the security basics primes check, and keep the system small enough for two people to maintain.
Learn how to qualify, approve and monitor sub-suppliers, flow down requirements through purchase orders, and keep the records an auditor will ask to see under ISO 9001 clause 8.4 and AQAP.
Learn how to run an ISO 9001 Clause 9.3 management review that turns evidence into decisions, with the right inputs, actionable outputs, and a cadence that fits your risks.