ISO/IEC 27018 — PII in Public Cloud
The PII-in-cloud certification customers ask for first.
ISO/IEC 27018 is the international standard for privacy protection when processing PII in public clouds. Provides 25+ controls and an audit trail customers can see — covering consent, data location, deletion and customer notification.
- ISO/IEC 27018:2019
- ISO/IEC 27001:2022 (parent)
- ISO/IEC 27701 (PIMS — synergistic)
- GDPR Article 28 + Article 32
- DPDP Section 8 — Reasonable Security
Compliance is leverage, not paperwork.
When customers entrust personal data to your cloud, ISO 27018 is the certification they look for in your security questionnaire. Combined with DPDP / GDPR readiness, it shortens enterprise sales cycles by 30%+. Macksofy implements ISO 27018 as an extension to ISO 27001 (or alongside ISO 27701 for full PIMS).
- Public cloud processors handling customer PII
- Multi-tenant SaaS in EU / India / US enterprise sales
- DPDP Significant Data Fiduciaries
- GDPR processors (Article 28)
- Healthtech storing patient data in cloud
Aligned to the regulations that matter.
How we run a ISO 27018 engagement.
Interactive walkthrough — every phase clickable, every activity documented, every artefact regulator-ready.
- Phase 01
1 · PII inventory + processor classification
- Customer-PII vs. organisation-PII separation
- Cross-border + sub-processor mapping
- Customer consent / contract review
01Station 0101Phase 011 · PII inventory + processor classification
- Customer-PII vs. organisation-PII separation
- Cross-border + sub-processor mapping
- Customer consent / contract review
- Phase 02
2 · 27018-specific controls
- Customer consent for data use beyond service
- Disclosure to law enforcement controls
- Data return / erasure on contract end
- Sub-processor disclosure
02Station 0202Phase 022 · 27018-specific controls
- Customer consent for data use beyond service
- Disclosure to law enforcement controls
- Data return / erasure on contract end
- Sub-processor disclosure
- Phase 03
3 · Customer-visible controls
- Public privacy notice review
- Customer audit-rights workflow
- Notification to customers of breach (Article 33-style)
03Station 0303Phase 033 · Customer-visible controls
- Public privacy notice review
- Customer audit-rights workflow
- Notification to customers of breach (Article 33-style)
- Phase 04
4 · Audit
- Combined ISO 27001 + 27018 internal audit
- Stage 1 + Stage 2 with certification body
04Station 0404Phase 044 · Audit
- Combined ISO 27001 + 27018 internal audit
- Stage 1 + Stage 2 with certification body
Everything you need to satisfy auditors.
- PII processing register (customer + organisation split)
- Sub-processor disclosure list (publishable)
- Customer audit + breach-notification playbooks
- ISO 27001 + 27018 combined SoA
- Stage 1 / 2 certification support
ISO 27001 + 27018 combined
Outcome: Customer security questionnaires shortened 60%; closed two ₹5cr+ enterprise deals on the certification alone
The shape of a ISO 27018 engagement.
Every number below is grounded in how Macksofy actually runs the engagement — not aspirational marketing copy.
What we actually examine.
Each pillar is a distinct workstream inside the engagement — scoped, evidenced, and signed off independently before the audit pack is assembled.
- PII classification in cloud3 pts
- Consent & purpose limitation3 pts
- Customer-controlled keys & encryption3 pts
- Sub-processor & cross-border3 pts
- Data-subject rights workflow3 pts
- Privacy incident handling3 pts
Knowing what's PII and where it lives is half the audit.
- PII inventory in cloud workloads
- Sensitivity & jurisdiction tagging
- Pseudonymisation + minimisation posture
The 27018-specific controls on use of PII.
- Customer-consent recording
- Purpose-binding evidence
- Marketing / secondary-use restriction
Who holds the keys is what 27018 hinges on.
- BYOK / HYOK key-management evidence
- Encryption-at-rest + in-transit
- Key-rotation + access audit
Transparency and notice requirements that GDPR and DPDP also lean on.
- Sub-processor register + notice flow
- Cross-border transfer mechanisms
- Onward-transfer due-diligence
How requests flow from customer → provider → resolution.
- Access / correction / erasure intake
- Customer-controller hand-off SLA
- Audit-trail of subject-rights actions
The notification timelines and forensic readiness specific to PII.
- 72-hour customer notification flow
- Forensic preservation of PII-related logs
- Post-incident privacy review
From kick-off to regulator-ready report.
The horizontal flow below shows the typical week-by-week shape of a ISO 27018 engagement. Click any station for detail in the methodology section above.
Rated 4.9 ★ from 612 client reviews.
“We've worked with three Big 4 firms before Macksofy. None found what their team did in our payments stack. The most actionable report we've received in a decade.”
“The CHFI training Macksofy delivered for our cyber cell raised investigation quality measurably. Practical, India-context-aware, and respectful of our operational realities.”
“Came in with zero security background. 5 weeks later I was running Burp Suite and Metasploit confidently. Cleared CEH on the first attempt.”
Things compliance leads ask before signing.
Get a fixed-price proposal in 48 hours.
Tell us about your security need — pentest, audit, training or a wider engagement. A senior consultant will reply within a few business hours.
- CERT-In Empanelled
- EC-Council ATC · CompTIA Authorized
- 20,000+ professionals trained
- India + UAE engagements