ISO/IEC 27018 — PII in Public Cloud
The PII-in-cloud certification customers ask for first.
ISO/IEC 27018 is the international standard for privacy protection when processing PII in public clouds. Provides 25+ controls and an audit trail customers can see — covering consent, data location, deletion and customer notification.
- ISO/IEC 27018:2019
- ISO/IEC 27001:2022 (parent)
- ISO/IEC 27701 (PIMS — synergistic)
- GDPR Article 28 + Article 32
- DPDP Section 8 — Reasonable Security
What is ISO 27018?
ISO/IEC 27018 is the code of practice for protecting personally identifiable information (PII) in public clouds. Macksofy helps SaaS and data-processing businesses implement 27018 to demonstrate privacy assurance to customers and align with DPDP and GDPR obligations.
ISO 27018 is leverage, not paperwork.
When customers entrust personal data to your cloud, ISO 27018 is the certification they look for in your security questionnaire. Combined with DPDP / GDPR readiness, it shortens enterprise sales cycles by 30%+. Macksofy implements ISO 27018 as an extension to ISO 27001 (or alongside ISO 27701 for full PIMS).
- Public cloud processors handling customer PII
- Multi-tenant SaaS in EU / India / US enterprise sales
- DPDP Significant Data Fiduciaries
- GDPR processors (Article 28)
- Healthtech storing patient data in cloud
Aligned to the regulations that matter.
How we run a ISO 27018 engagement.
Interactive walkthrough — every phase clickable, every activity documented, every artefact regulator-ready.
- Phase 01
1 · PII inventory + processor classification
- Customer-PII vs. organisation-PII separation
- Cross-border + sub-processor mapping
- Customer consent / contract review
01Station 0101Phase 011 · PII inventory + processor classification
- Customer-PII vs. organisation-PII separation
- Cross-border + sub-processor mapping
- Customer consent / contract review
- Phase 02
2 · 27018-specific controls
- Customer consent for data use beyond service
- Disclosure to law enforcement controls
- Data return / erasure on contract end
- Sub-processor disclosure
02Station 0202Phase 022 · 27018-specific controls
- Customer consent for data use beyond service
- Disclosure to law enforcement controls
- Data return / erasure on contract end
- Sub-processor disclosure
- Phase 03
3 · Customer-visible controls
- Public privacy notice review
- Customer audit-rights workflow
- Notification to customers of breach (Article 33-style)
03Station 0303Phase 033 · Customer-visible controls
- Public privacy notice review
- Customer audit-rights workflow
- Notification to customers of breach (Article 33-style)
- Phase 04
4 · Audit
- Combined ISO 27001 + 27018 internal audit
- Stage 1 + Stage 2 with certification body
04Station 0404Phase 044 · Audit
- Combined ISO 27001 + 27018 internal audit
- Stage 1 + Stage 2 with certification body
What your ISO 27018 engagement puts on the table.
- PII processing register (customer + organisation split)
- Sub-processor disclosure list (publishable)
- Customer audit + breach-notification playbooks
- ISO 27001 + 27018 combined SoA
- Stage 1 / 2 certification support
ISO 27001 + 27018 combined
Outcome: Customer security questionnaires shortened 60%; closed two ₹5cr+ enterprise deals on the certification alone
The shape of a ISO 27018 engagement.
Every number below is grounded in how Macksofy actually runs the engagement — not aspirational marketing copy.
What we actually examine.
Each pillar is a distinct workstream inside the engagement — scoped, evidenced, and signed off independently before the audit pack is assembled.
- PII classification in cloud3 pts
- Consent & purpose limitation3 pts
- Customer-controlled keys & encryption3 pts
- Sub-processor & cross-border3 pts
- Data-subject rights workflow3 pts
- Privacy incident handling3 pts
Knowing what's PII and where it lives is half the audit.
- PII inventory in cloud workloads
- Sensitivity & jurisdiction tagging
- Pseudonymisation + minimisation posture
The 27018-specific controls on use of PII.
- Customer-consent recording
- Purpose-binding evidence
- Marketing / secondary-use restriction
Who holds the keys is what 27018 hinges on.
- BYOK / HYOK key-management evidence
- Encryption-at-rest + in-transit
- Key-rotation + access audit
Transparency and notice requirements that GDPR and DPDP also lean on.
- Sub-processor register + notice flow
- Cross-border transfer mechanisms
- Onward-transfer due-diligence
How requests flow from customer → provider → resolution.
- Access / correction / erasure intake
- Customer-controller hand-off SLA
- Audit-trail of subject-rights actions
The notification timelines and forensic readiness specific to PII.
- 72-hour customer notification flow
- Forensic preservation of PII-related logs
- Post-incident privacy review
From kick-off to regulator-ready report.
The horizontal flow below shows the typical week-by-week shape of a ISO 27018 engagement. Click any station for detail in the methodology section above.
Rated 4.9 ★ from 612 client reviews.
“We've worked with three Big 4 firms before Macksofy. None found what their team did in our payments stack. The most actionable report we've received in a decade.”
“The CHFI training Macksofy delivered for our cyber cell raised investigation quality measurably. Practical, India-context-aware, and respectful of our operational realities.”
“Came in with zero security background. 5 weeks later I was running Burp Suite and Metasploit confidently. Cleared CEH on the first attempt.”
ISO 27018 — what compliance leads ask before signing.
ISO/IEC 27701 — Privacy Information Management
GDPR + DPDP, certified as a system — not a checklist.
Learn moreISO 27001 Consulting & Implementation
ISO 27001 done in 16 weeks — by people who've shipped 30+ certifications.
Learn moreISO/IEC 27017 — Cloud Security Certification
Cloud security controls procurement teams actually look for.
Learn moreISO 27018 evidence starts with hands-on testing.
A clean ISO 27018 report rests on real technical assurance. These Macksofy assessments generate the vulnerability, penetration and control-effectiveness evidence your auditor expects to see.
Penetration Testing
Find what attackers will. Before they do.
Explore serviceVulnerability Assessment & Penetration Testing (VAPT)
VAPT done properly — not a scan with a cover page.
Explore serviceWeb Application Security Testing
Test web apps the way attackers (and bug bounty hunters) do.
Explore serviceMacksofy delivers this work to the following standards and regulator requirements. Definitions and controls are sourced from the issuing bodies below.
Get a fixed-price proposal in 48 hours.
Tell us about your security need — pentest, audit, training or a wider engagement. A senior consultant will reply within a few business hours.
- CERT-In Empanelled
- EC-Council ATC · CompTIA Authorized
- 20,000+ professionals trained
- India + UAE engagements