ISO/IEC 27018: PII Protection in Cloud

CSPs must provide customers with explicit documentation detailing all PII processing activities, including purposes, categories of data processed, recipients of data, and retention periods.

Data centers must maintain and publish privacy impact assessments and processing notices that clearly delineate customer responsibilities from provider obligations.

This requirement mandates real-time visibility into where PII resides, how it flows through infrastructure, and what transformations occur—fundamentally requiring CSPs to map PII through their data center network topology and document every processing operation.

Cloud providers must ensure PII is processed only for explicitly consented purposes and implement technical controls preventing secondary use or reuse beyond original collection intent.

Data centers must architect systems where PII tagged for specific purposes (e.g., billing, service delivery) cannot be accessed by systems serving different functions (e.g., analytics, marketing).

This requires implementing purpose-aware access controls, data classification schemas, and enforcement mechanisms that prevent unauthorized purpose expansion or data linkage across unrelated processing contexts.

ISO 27018 requires CSPs to establish explicit responsibility matrices documenting whether specific controls are implemented by the provider, the customer, or jointly.

Data center operators must maintain documented evidence of control ownership for each of the 37 PII protection controls, including which party is responsible for encryption, access management, audit logging, and breach notification.

This documentation must be provided to customers pre-engagement and updated whenever responsibility allocations change, creating ongoing operational documentation requirements within data center management systems.

Upon customer request or contract termination, CSPs must delete or return all customer PII within a defined timeframe and provide written certification of deletion completion.

Data centers must implement secure deletion procedures meeting NIST 800-88 guidelines that ensure cryptographic erasure or physical destruction of media containing PII.

This requirement mandates maintaining deletion logs, implementing deletion verification processes, and coordinating deletion across geographically distributed data center facilities where customer data may be replicated or backed up.

CSPs must establish incident response procedures ensuring customers are notified of any suspected or confirmed PII security incidents without undue delay, typically within 72 hours or per applicable jurisdiction requirements.

Data centers must implement automated incident detection systems, maintain incident logs with tamper-proof timestamps, and establish escalation procedures that trigger immediate customer notification upon discovery of unauthorized PII access or suspected breaches.

This requires integration between security operations centers and customer communication channels with documented evidence of notification timing.

ISO 27018 grants cloud customers explicit audit rights allowing them to verify CSP compliance with PII protection controls through on-site audits, independent third-party audits, or remote assessment mechanisms.

Data centers must maintain audit-ready infrastructure with comprehensive logs, access controls documentation, and the ability to demonstrate control implementation to customer auditors within defined timeframes.

This includes maintaining evidence of segregation of duties, encryption key management, staff training records, and vendor management procedures related to PII processing.

Cloud providers must implement encryption for PII both in transit (TLS 1.2+) and at rest, with encryption key management procedures ensuring customers maintain control or escrow of encryption keys.

Data centers must architect systems where customer PII encryption keys are never accessible to provider staff, implementing hardware security modules (HSMs), key escrow services, or customer-managed key infrastructures.

This requirement impacts data center design, requiring separate cryptographic key infrastructure, customer key management interfaces, and procedures preventing commingling of keys across customer tenants.

CSPs must contractually bind all subcontractors, backup providers, disaster recovery vendors, and other third parties processing customer PII to equivalent PII protection obligations.

Data centers must maintain approved vendor lists, documented contracts containing PII protection clauses, and periodic verification that subcontractors maintain compliance.

This extends PII protection responsibility across the entire data center supply chain, including disaster recovery providers, managed service providers, and infrastructure suppliers, requiring ongoing vendor audit procedures.