PII processing
Identify the personal information processed through the public cloud service and the activities performed on behalf of customers.
PUBLIC CLOUD PII PROTECTION • ISO/IEC 27018
ISO/IEC 27018 Certification in UAE & Dubai
Independent assessment of applicable ISO/IEC 27018 guidance for public cloud services where the cloud service provider acts as a PII processor, with a defined scope covering relevant services, processing activities, locations and supporting controls.
ISO/IEC 27018:2025
Public cloud PII
Independent assessment
ISO/IEC 27018Public Cloud PII Protection
CLOUD PRIVACYProtect PII.
Protect PII.
Clarify processing.
Cloud-specific privacy guidance for public cloud providers acting as PII processors, aligned with the ISO/IEC 27002 control framework.
ISO/IEC 27018:2025 • PUBLIC CLOUD PIIA cloud privacy framework focused on PII processing by public cloud providers.
ISO/IEC 27018 provides guidance for protecting personally identifiable information in public cloud services when the provider acts as a PII processor.
WHAT IS ISO/IEC 27018?
ISO/IEC 27018:2025 gives public cloud providers a focused reference for protecting PII processed on behalf of customers.
ISO/IEC 27018:2025 is the third edition of the standard for protection of personally identifiable information in public clouds acting as PII processors. It is built on ISO/IEC 27002 and provides cloud-specific guidance for PII processing.
For organizations in Dubai and across the UAE, the standard can help structure how public cloud services address PII protection, roles and responsibilities, transparency, accountability and security within the defined service scope.
Current editionISO/IEC 27018:2025 was published in August 2025. ISO lists ISO/IEC 27018:2019 as withdrawn and the 2025 edition as the current published version.
ISO/IEC 27018 IN PRACTICE
Build cloud privacy controls around the PII processing your public cloud service actually performs.
ISO/IEC 27018 is designed for public cloud providers acting as PII processors. Its practical application therefore starts with understanding the services delivered, the PII processed, the customer-provider relationship and the controls used to protect that information.
A UAE cloud provider may host applications, storage, databases, platforms or managed services that process customer PII. The relevant assessment scope should identify those services and the processing activities that the provider controls or performs.
The standard complements information-security controls with cloud-specific privacy guidance. It can help organizations make responsibilities clearer, provide useful information to customers and demonstrate how PII processing is governed within the cloud service.
ISO/IEC 27018 does not replace privacy laws, contracts or an organization’s broader privacy governance. Those obligations should be evaluated separately and reflected where applicable to the organization and service relationship.
Roles and responsibilities
Make the provider and customer roles clear within the cloud service relationship and the defined processing scope.
Transparency
Provide appropriate information about relevant PII processing, service practices and changes affecting the cloud service.
Security controls
Apply relevant information-security controls to protect PII across the cloud services and processing activities in scope.
Customer support
Maintain appropriate processes for responding to customer requests and information connected with the cloud processing relationship.
Accountability
Maintain evidence that applicable privacy and security practices are implemented and operated within the agreed service scope.
ISO/IEC 27018 IMPLEMENTATION GUIDE
Translate public-cloud PII processing into an operational control framework.
Start with the cloud services, processing activities and customer relationships actually operated, then map applicable privacy and information-security practices to the defined scope.
Confirm the cloud service scope
Identify public cloud services, locations, platforms, processing activities and organizational functions included in the intended scope.
Map PII processing
Identify categories of PII, processing activities, customer relationships and relevant information flows within the service.
Set cloud privacy controls
Establish practical controls for PII protection, access, transparency, customer information and supporting security activities.
Review control performance
Use incidents, service information, customer feedback and control records to understand how the cloud privacy framework operates.
Build people capability
Ensure relevant personnel understand their responsibilities for PII processing, information security and customer-facing cloud services.
Review and improve
Use internal reviews, assessment findings, incidents and changes in the cloud service to strengthen PII protection.
UAE BUSINESS CONTEXT
Keep the assessment scope aligned with the actual public cloud service.
UAE cloud providers may operate from corporate facilities, data centres, free-zone locations or distributed technology environments. The scope should accurately describe the public cloud services, PII processing activities, locations and supporting functions intended for assessment.
See the certification process
THE FOUNDATION OF ISO/IEC 27018
Core cloud privacy practices behind accountable PII processing.
ISO/IEC 27018 connects public-cloud information security with practical privacy considerations for providers acting as PII processors.
Public cloud processing
Define the public cloud services and PII processing activities covered by the applicable assessment scope.
PII processor accountability
Clarify the provider's role as a PII processor and the responsibilities connected with customer information.
Processing transparency
Provide customers with appropriate information about relevant PII processing practices and service arrangements.
Information protection
Apply suitable security controls to protect PII against unauthorized access, disclosure, alteration or loss.
Customer relationship
Address provider responsibilities, customer interactions and service arrangements affecting customer PII processing.
Incident handling
Maintain processes for identifying, managing and communicating relevant security and privacy incidents.
Continual improvement
Use reviews, incidents, customer feedback and control information to improve cloud service practices.
ISO/IEC 27018 + ISO/IEC 27001
Use ISO/IEC 27018 alongside an information security management system for cloud-specific PII protection.
ISO/IEC 27018 is built on ISO/IEC 27002 and complements an ISO/IEC 27001-based information security management system. The standards address related but distinct layers of information protection.
27001
Establish information security governance
Use the ISO/IEC 27001 management-system framework to govern information-security risks, controls, responsibilities and improvement.
27018
Apply cloud PII guidance
Address public cloud PII processing through cloud-specific guidance for providers acting as PII processors.
SCOPE
Define services and processing
Identify the public cloud services, locations, PII processing activities and organizational functions included in the assessment.
REVIEW
Evaluate protection in operation
Use control evidence, incidents, customer information and service changes to review whether the cloud privacy framework performs as intended.
ISO/IEC 27018 CLOUD PRIVACY FRAMEWORK
Key areas to consider when assessing public cloud PII processing.
The exact evidence depends on the agreed scope, services, processing activities and provider role. The following areas provide a practical structure for review.
PII inventory and processing
Understand what PII is processed, where it is handled and which cloud services are involved.
Access and protection
Review access management and security controls protecting PII within the cloud environment.
Customer information
Provide appropriate information to customers about processing, service practices and relevant changes.
Third-party services
Consider suppliers and sub-processors that can affect PII processing within the cloud service.
Incidents and response
Maintain processes for identifying, handling and communicating relevant security and privacy events.
Retention and disposal
Control PII handling through applicable storage, retention and secure disposal practices within the service scope.
AUDIT READINESS
Audit readiness is demonstrated through evidence from the public cloud service.
A strong assessment file connects cloud-service operations, PII processing, security controls, customer information and supporting records to the actual scope being assessed.
Defined services, locations, platforms and processing activities covered by the assessment.
Evidence showing how PII is collected, stored, processed, transmitted or deleted within the service.
Operational evidence for access, protection, monitoring and other applicable information-security controls.
Service information and communications relevant to PII processing and customer responsibilities.
Evidence concerning relevant third parties, sub-processors and cloud-service dependencies.
Incident records, reviews, corrective actions and improvement information connected with the cloud service.
INDUSTRIES WE CERTIFY
ISO certification across the industries we serve.
Public cloud providers and organizations delivering cloud-enabled services process sensitive information across many sectors. ISO/IEC 27018 can be scoped around the actual cloud services and PII processing activities operated.
Data Centres & Cloud Services
Protect PII and supporting information across public cloud infrastructure, hosting, managed platforms and digital services.
Explore IndustryInformation Technology & Communication
Address cloud-hosted applications, customer data, digital services and technology operations that process PII.
Explore IndustryTelecommunications
Manage customer and subscriber information processed through cloud platforms, digital channels and connected services.
Explore IndustryBanking & Financial Services
Protect customer PII processed through cloud applications, digital banking platforms, support services and technology environments.
Explore IndustryHealthcare
Address protection of patient and customer information handled through public cloud services and supporting digital platforms.
Explore IndustryManufacturing
Protect employee, customer, supplier and operational PII processed through cloud applications and connected systems.
Explore IndustryGovernment & Public Sector
Support accountable handling of citizen, employee and service-user PII processed through public cloud services.
Explore IndustryRetail & E-commerce
Protect customer PII handled through online stores, payment-related services, customer support and cloud platforms.
Explore IndustryISO/IEC 27018 CERTIFICATION SCOPE
Your ISO/IEC 27018 scope should describe the public cloud service and PII processing actually assessed.
The certification or conformity assessment scope identifies the public cloud services, processing activities, locations, systems and organizational functions covered by the assessment.
For organizations operating in Dubai, Abu Dhabi or other UAE emirates, the scope should accurately describe the provider role, cloud service model and PII processing activities included.
Cloud services
Define the public cloud services, platforms and customer-facing offerings included in the scope.
PII processing
Identify the PII processing activities and information flows performed on behalf of customers.
Sites & functions
Clarify locations, departments, technology teams and supporting functions covered by the assessment.
Suppliers & sub-processors
Identify relevant external providers that can affect the PII processing service within scope.
ISO/IEC 27018 CERTIFICATION PROCESS
From cloud scope definition to independent assessment and ongoing evaluation.
The programme is planned around public cloud services, PII processing activities, locations, technology, suppliers and readiness. The sequence below shows a typical certification route.
Define the assessment scope
Provide the public cloud services, PII processing activities, locations, personnel, technology and intended ISO/IEC 27018 scope.
Establish and operate controls
Implement applicable cloud privacy and information-security practices and generate evidence through normal service operations.
Readiness assessment
Review the defined scope, cloud service model, PII processing, supporting controls and readiness for independent assessment.
Certification audit
Assess implementation and evidence against the applicable ISO/IEC 27018 criteria within the agreed scope.
Certification decision
Assessment results and applicable findings proceed through the certification decision process.
Ongoing evaluation
Maintain the cloud privacy framework, review control operation, address findings and improve the service throughout the certification cycle.
BENEFITS OF ISO/IEC 27018 CERTIFICATION
Why organizations in Dubai and the UAE consider ISO/IEC 27018 certification.
ISO/IEC 27018 can support public cloud providers seeking stronger PII protection, clearer customer communication and independent evidence of cloud privacy practices within a defined scope.
Focused PII protection
Apply cloud-specific guidance to protect personally identifiable information processed for customers.
Clearer responsibilities
Clarify provider and customer roles within the public cloud PII processing relationship.
Greater transparency
Support appropriate customer information about relevant processing practices and cloud service controls.
Stronger accountability
Maintain objective evidence that applicable privacy and information-security practices operate within scope.
Cloud service assurance
Provide customers with a structured reference for evaluating PII protection in public cloud services.
Independent assessment evidence
Where an assessment or certificate is requested, independent conformity evidence can demonstrate the assessed scope and applicable practices.
AFTER ISO/IEC 27018 CERTIFICATION
ISO/IEC 27018 practices are maintained through active cloud service operations.
A certified or assessed public cloud service should continue operating, monitoring and improving its PII protection practices rather than treating them as static documentation.
Internal review
Evaluate whether cloud privacy and information-security practices are implemented and operating as intended.
Management review
Give leadership structured information about incidents, customer feedback, control performance, audit results and improvement needs.
Corrective action
Address relevant control gaps, investigate causes and verify the effectiveness of corrective actions.
Continual improvement
Use service changes, incidents, customer insights and control information to improve PII protection in the cloud environment.
ISO/IEC 27018 FAQ
Frequently asked questions about ISO/IEC 27018 certification in UAE.
Find concise answers about ISO/IEC 27018:2025, public cloud PII processing, provider responsibilities, assessment scope and related ISO standards.
Request an ISO/IEC 27018 QuoteWhat is ISO/IEC 27018 certification in the UAE?
ISO/IEC 27018 certification refers to an independent conformity assessment programme covering the applicable ISO/IEC 27018 guidance within a defined scope. The 2025 edition focuses on protecting personally identifiable information (PII) in public cloud services when the cloud service provider acts as a PII processor.
What is ISO/IEC 27018:2025?
ISO/IEC 27018:2025 is the third edition of the standard titled Information security, cybersecurity and privacy protection — Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors. It provides guidance tailored to public cloud PII processing and is built on ISO/IEC 27002.
Who is ISO/IEC 27018 intended for?
ISO/IEC 27018 is primarily relevant to public cloud service providers acting as PII processors. It can also help organizations evaluating cloud providers and organizations that need to understand how outsourced public-cloud PII processing is addressed.
Does ISO/IEC 27018 apply to public cloud services?
Yes. ISO/IEC 27018:2025 specifically addresses public cloud services where the cloud service provider acts as a PII processor. The certification or assessment scope should identify the cloud services and processing activities covered.
Does ISO/IEC 27018 apply to private clouds?
The 2025 standard is specifically focused on public cloud services where the provider acts as a PII processor. A private-cloud environment may use related information-security and privacy practices, but the applicability of ISO/IEC 27018 should be determined against the actual service model and scope.
What is PII in the context of ISO/IEC 27018?
PII means personally identifiable information: information that can be associated with an identified or identifiable individual. ISO/IEC 27018 addresses protection of PII handled by public cloud providers on behalf of their customers as part of cloud processing services.
What is the role of a PII processor?
A PII processor processes personal information on behalf of another organization or entity according to the applicable service arrangement. In ISO/IEC 27018, the focus is on public cloud providers acting in that processor role.
How does ISO/IEC 27018 relate to ISO/IEC 27001?
ISO/IEC 27018 complements an ISO/IEC 27001-based information security management system by providing cloud-specific guidance for protecting PII when a public cloud provider acts as a processor. It is not a replacement for ISO/IEC 27001.
How does ISO/IEC 27018 relate to ISO/IEC 27002?
ISO/IEC 27018 is built on ISO/IEC 27002 and adapts information-security guidance to public cloud PII processing. The 2025 edition is aligned with ISO/IEC 27002:2022.
What changed in ISO/IEC 27018:2025?
ISO/IEC 27018:2025 is the third edition and was published in August 2025. ISO states that it is aligned with ISO/IEC 27002:2022 and includes a new Annex B with extended implementation guidance.
What types of PII processing can ISO/IEC 27018 address?
The standard can be relevant to PII handled through public cloud processing activities such as collection, storage, processing, transmission and deletion, depending on the services and processing operations included in scope.
Can ISO/IEC 27018 support cloud customer due diligence?
Yes. ISO/IEC 27018 can provide a structured reference when customers evaluate how a public cloud provider protects PII and manages roles, responsibilities, transparency and accountability within the cloud service relationship.
Does ISO/IEC 27018 address both cloud providers and cloud customers?
Its primary focus is public cloud providers acting as PII processors. Cloud customers can use the standard as a reference when evaluating provider arrangements, while the provider-side assessment focuses on the applicable processing activities within the defined scope.
Can ISO/IEC 27018 be used with ISO/IEC 27701?
Yes. ISO/IEC 27018 and ISO/IEC 27701 can complement each other. ISO/IEC 27018 focuses specifically on PII protection in public cloud services where the provider acts as processor, while ISO/IEC 27701 provides a broader privacy information management framework.
Is ISO/IEC 27018 a standalone management system standard?
No. ISO/IEC 27018 provides cloud-specific guidance for PII protection rather than establishing a standalone management system in the same way as ISO/IEC 27001. It is commonly considered alongside an ISO/IEC 27001-based information security management system.
What evidence may be reviewed for an ISO/IEC 27018 assessment?
Depending on the agreed scope, evidence may include cloud service descriptions, PII processing information, security controls, access controls, supplier arrangements, incident handling, data-handling practices, contractual information, customer communications and records showing how applicable controls operate.
Can an organization in Dubai pursue ISO/IEC 27018 certification?
Organizations operating in Dubai and other UAE emirates can consider an ISO/IEC 27018 assessment where the cloud service model and defined scope are appropriate. The applicable certification programme should reflect the organization’s actual public-cloud processing activities and role as a PII processor.
Is ISO/IEC 27018 mandatory in the UAE?
ISO/IEC 27018 is not universally mandatory for every organization in the UAE. Its use may be driven by customer contracts, cloud-service assurance programmes, procurement criteria, privacy governance or organizational policy. Sector-specific legal obligations should be evaluated separately.
Does ISO itself issue ISO/IEC 27018 certificates?
No. ISO develops and publishes standards but does not perform ordinary certification. Organizations seeking independent certification or conformity assessment engage an external certification body or other appropriate assessment provider for the applicable programme.
Is ISO/IEC 27018:2019 still current?
No. ISO/IEC 27018:2019 has been withdrawn. ISO lists ISO/IEC 27018:2025 as the published third edition, dated August 2025.
LATEST FROM THE KNOWLEDGE CENTRE
Latest guidance and insights for organizations in the UAE.
The four newest published articles from the Veritas Assurance Knowledge Centre are displayed automatically, keeping this section current across all certification and service pages.
ISO 9001:2026 Changes, Differences from ISO 9001:2015 and Implementation Guide
Learn about ISO 9001:2026 changes, differences from ISO 9001:2015, the transition deadline, implementation steps and practical guidance for organizations preparing to update their Quality Management System.
Read articleISO 14001 Certification in UAE: Requirements, Process and Benefits
ISO 14001 certification in UAE helps organizations establish a practical Environmental Management System (EMS) for controlling environmental impacts, meeting applicable requirements, reducing waste, and improving environmental performance. Learn about ISO 14001 requirements, certification process, benefits, and its importance for UAE businesses.
Read article
ISO 9001 Certification in UAE: Complete Guide
ISO 9001 certification in the UAE demonstrates that an organization has established a structured Quality Management System (QMS) based on internationally recognized quality management principles. Learn what ISO 9001 certification means, its requirements, benefits, process, and applicability to businesses in the UAE.
Read articleAUTHORITATIVE ISO REFERENCES
ISO/IEC 27018 information and certification guidance.
Technical information about ISO/IEC 27018, public cloud PII processing and the current publication status has been checked against official ISO publications.
ISO.ORG · OFFICIAL SOURCEISO/IEC 27018:2025 — Public cloud PII protectionOfficial ISO standard page for the current third edition and its scope.Open official source
ISO.ORG · OFFICIAL SOURCEISO/IEC 27018:2019 — Withdrawn editionOfficial ISO page showing the previous edition and its withdrawal status.Open official source
ISO.ORG · OFFICIAL SOURCEISO/IEC 27001 — Information security managementOfficial ISO reference for the information security management system standard commonly used alongside ISO/IEC 27018.Open official source
ISO.ORG · OFFICIAL SOURCEISO/IEC 27002 — Information security controlsOfficial ISO reference for the control guidance on which ISO/IEC 27018 is built.Open official source
ISO/IEC 27018 CERTIFICATION IN UAE
Start your ISO/IEC 27018 programme with a clearly defined public cloud and PII processing scope.
Share your public cloud services, PII processing activities, locations, technology environment and provider role so the appropriate ISO/IEC 27018 assessment programme can be considered.
Request an ISO/IEC 27018 Certification Quotation
