Compliance tools · Cybersecurity and data protection

Toolkit for ISO 27018

ISO/IEC 27018:2025 · European Union and United Kingdom · Voluntary standard

Name anyone on your staff. The system makes them your compliance person.

A member of your own staff, with no compliance background, reads the training module, answers the interview, and finishes with your Toolkit for ISO 27018 documentation cited clause by clause. The knowledge stays in the business.

Every account level runs inside a dedicated Claude account. Anyone can try a toolkit in their own Claude account; compliance work runs in a dedicated one. The Claude Max plan is £90 a month, paid to Anthropic, and is not included in any level.

See a finished report before you pay

Toolkit for ISO 27018 is ISO/IEC 27018:2025, a voluntary standard in the European Union and United Kingdom. Protection of personal data in public cloud services. The toolkit runs alongside your own licensed copy of the ISO standard.

The free assessment screens for Toolkit for ISO 27018 when a business handles personal data, or makes or supplies products or services with digital elements, or operates online or provides digital services.

Sectors this instrument reaches: cloud services; SaaS; IaaS and PaaS vendors; IT and technology; data hosting.

This is a voluntary standard rather than binding law. Businesses adopt it because customers, insurers or public buyers ask for it.

Screen your business against all 116 agent toolkits, free →

• Your exact position under Toolkit for ISO 27018: what is in place, what is missing, and what to do about each gap.
• Documentation with clause citations, ready for auditors, insurers, customers and public buyers.
• A trained person inside the business who understands what the standard requires, and stays.
• A dated record of every section completed, with the reports themselves staying in your own Claude account. The toolkit is carried by an account level, see the plans.
• All of it completed in-house, at your own pace, without booking a single meeting.

Check that Toolkit for ISO 27018 applies to your business, free →

Does Toolkit for ISO 27018 apply to my business?

ISO 27018 applies to you if you are a public cloud service provider acting as a PII processor on behalf of cloud customers who are PII controllers (Clause 1). It covers SaaS, IaaS and PaaS providers that process, store or transmit PII under a customer's instructions.

Who does ISO 27018 apply to?

It applies to public cloud service providers acting as PII processors, and to the top management of that provider, which carries all 40 entity-facing obligations. It does not directly govern PII controllers, who are the cloud customers.

Does Toolkit for ISO 27018 apply to a small business?

The standard has no size threshold. It covers all types and sizes of organisations providing cloud computing services where PII processing occurs (Clause 1), and it is highly relevant to SMEs operating as cloud service providers or SaaS, IaaS or PaaS vendors.

When does ISO 27018 apply from, and what are the deadlines?

There are no statutory deadlines. Certification runs on the ISO 27001 cycle: a two-stage initial audit, surveillance audits at approximately 12-month and 24-month intervals, and recertification every three years. Internal audits and management reviews run at planned intervals (ISO/IEC 27001 Clauses 9.2 and 9.3).

What does ISO 27018 require me to do?

You must operate an ISMS extended for cloud PII protection, covering context analysis, leadership and a PII protection policy (ISO/IEC 27001 Clause 5.2), planning and PII risk assessment (Clause 6), support and documented information (Clause 7), operation (Clause 8), performance evaluation (Clause 9) and improvement (Clause 10). You must also apply the 25 Annex A cloud PII processor controls declared applicable in your Statement of Applicability.

What records or documents does ISO 27018 require me to keep or produce?

You must maintain a PII protection policy available to cloud customers (ISO/IEC 27001 Clause 5.2), documented information on PII protection objectives and results (Clause 6.2), and a Statement of Applicability including the ISO 27018 Annex A controls. You must also record disclosures of PII (A.6.2) and retain security policies (A.10.2).

What happens if I do not comply with ISO 27018?

ISO is not a regulator and imposes no fines, and the standard carries no direct regulatory penalty. The certification body raises minor nonconformities, typically with 90 days for corrective action, and major nonconformities, which can stop the certificate being issued or continued until resolved, typically within six months. Unresolved major nonconformities can lead to suspension and then withdrawal of the certificate.

How is ISO 27018 different from ISO 27701?

ISO 27701 provides a broader privacy management system that extends ISO 27001 and ISO 27002, incorporates many ISO 27018 requirements and supersedes them within the PIMS scope, while ISO 27018 remains the more targeted standard for cloud PII processor scenarios. A CSP may adopt ISO 27701 instead of or in addition to ISO 27018.

How do I start complying with ISO 27018?

The first practical step is to define the scope and perform PII-specific risk assessments before adopting ISO 27018 controls (ISO/IEC 27001 Clauses 4 and 6). You must also hold or be pursuing ISO 27001 certification, because ISO 27018 is obtained as an extension scope to it.

Which ComplianceSME account includes the Toolkit for ISO 27018 toolkit?

The Toolkit for ISO 27018 agent toolkit is included in Compliance Complete.

Related in cybersecurity and data protection: GDPR · ePrivacy Directive · NIS2 Directive · CER Directive