ISO/IEC 27018, personal data in the cloud
Where personal data is, who processes it on your behalf and who can see it: the standard that brings privacy and cloud together, with evidence that comes from your own environments.
Privacy and the public cloud
ISO/IEC 27018 is the code of practice for the protection of personal data in the public cloud. It is aimed at cloud providers that process personal data on behalf of their customers, in other words that act as processors, and at those who choose these providers and need to know which assurances to ask for.
For a company subject to European data protection law, the link with the GDPR is direct: email, documents and contact records almost always sit in a public cloud, and the controller remains responsible for how they are kept.
It sits alongside ISO/IEC 27017, which covers the security of cloud services in general, and builds on the ISO/IEC 27001 management system.
The ISO 27018 requirements on personal data
- Processing of personal data only on the customer's instructions
- No use of the data for the provider's own purposes, such as marketing
- Transparency about where and how the data is processed
- Transparency about the sub-processors involved in the processing
- Support for the customer in handling data subjects' rights
- Notification to the customer of personal data breaches
- Return and deletion of data at the end of the service
- Staff confidentiality and control of access to the data
From the data map to the cloud checks
The ISO 27018 self-assessment measures the gap. Then the platform documents where personal data is and who can access it.
| ISO 27018 requirement | How Dottor Box covers it |
|---|---|
| Measuring the gap | Gap analysis on the controls for personal data in the cloud |
| Where the personal data is | Records of processing with processing activities suggested from the Google Drive metadata and findings on data to review |
| Access to the data | Microsoft Entra ID and Google Workspace: privileges, guest accounts, third-party apps with access to email and files |
| External sharing | Checks on file sharing settings and open groups |
| Suppliers and sub-processors | Supply Chain and appointments of external processors with the GDPR forms |
| Personal data breaches | Incident Response and Data Breach: a breach register with the phases tracked |
| Controls and procedures | Compliance and GRC: ISO 27018 is one of the module's standards, with procedures and a Statement of Applicability |
You know where the data is and who sees it
A map of your data
The records of processing start from an analysis of your Drive, which reads only the metadata and never the content.
Data in the wrong place
CVs that are too old, identity documents and payslips in personal storage: findings with a reason and a remedy.
Access checked
Who has privileges and which third-party apps read email and files, checked regularly.
Qualified suppliers
Questionnaires for cloud suppliers and appointments of external processors, all in one place.
"It's in the cloud" is not an answer for the auditor. A map of processing activities and a check of the configurations are.
ISO 27018: frequently asked questions
What is the difference between ISO 27017 and ISO 27018?
ISO/IEC 27017 concerns the security of cloud services in general and divides responsibilities between provider and customer. ISO/IEC 27018 focuses on personal data processed in the public cloud. They are often adopted together.
Does ISO 27018 replace the GDPR?
No. It is a voluntary standard that helps demonstrate good practice in processing personal data in the cloud; the legal obligations remain those of the GDPR.
Does the Google Drive scan read my documents?
No. It reads only the metadata, such as folder and file names, never the content. From there it suggests processing activities as a draft and flags data to review, with a reason and a remedy.
The modules that work for ISO 27018
Records of processing
The GDPR Article 30 register, with processing activities suggested by an analysis of your Drive.
Learn more SeeMicrosoft Entra ID
The security posture of your Microsoft 365 tenant across 72 indicators, read-only.
Learn more SeeGoogle Workspace
35 checks from the CIS benchmark on your Google Workspace configuration, email included.
Learn more GovernGDPR forms
Appointments, privacy notices and authorisation letters for all your staff, generated in one step.
Learn more ComplianceISO/IEC 27017
Security controls specific to cloud services.
Learn more ComplianceGDPR
Records of processing, appointments, Article 32 measures and data breaches.
Learn moreDo you know what someone looking for a target can see of your company?
In a demo on your real systems we show you what is exposed, how much it matters and where to start. Then, if you need it, a tailored proposal.