Identify the purpose
Confirm which fields the recipient needs and why the processing is authorised.
ISO/IEC 27018 · Personal information in public clouds
ISO/IEC 27018 and personal data in public clouds
Before sharing a personal-data extract, establish the purpose, the instructions given to the processor and the arrangements for copies at the end of the assignment.
Follow the copy
Map who handles the extract and where it is held during review.
Plan the end of processing
Agree who handles return, retention or deletion under the applicable instructions.
Review a sample personal-data extract
Start with the minimum information required and trace the proposed processing through each party.
Purpose and content
List the fields required for the receiving party’s assignment and remove unrelated personal information.
Roles and instructions
Identify who sets the purpose and what instructions each processor receives.
Providers and locations
Confirm which providers may handle a copy and where the proposed processing takes place.
Return and removal
Document what happens to retained copies at the end of the assignment and who checks completion.
Distinguish the parties’ decisions
Record who determines the purpose, who follows instructions and who answers a request about the file.
Your organisation
Specify the permitted recipients, review period and point of contact for changes.
Purpose · instructions · oversightThe proposed service
Ask the provider for evidence about access arrangements, processing locations and end-of-service handling.
Processing · protection · supportUse a sample record.
Ask specific questions.
Bring a representative file with synthetic personal information. Explore the proposed exchange with MX and document the questions your privacy team needs resolved.
Review your privacy requirementsQuestions for
your review.
Does ISO/IEC 27018 replace privacy law?
No. A standard does not remove your legal obligations. Assess applicable laws, processing roles and contractual requirements for the actual exchange.
How does this differ from ISO/IEC 27017?
ISO/IEC 27017 addresses cloud security controls more broadly. ISO/IEC 27018 focuses on personal-information protection where a public-cloud provider acts as a processor.
Is MX certified to ISO/IEC 27018?
No certification claim is made on this page. Request current evidence and verify the service, scope and processing activities it covers.
Is this relevant to both UK and US teams?
Both can use the guidance when evaluating public-cloud processing. Their legal obligations and contractual requirements still depend on the specific circumstances.