Define the processing purpose
Specify the task and select the fields the receiving party needs.
ISO/IEC 27018 · Personal information in public clouds
ISO/IEC 27018 and personal information in public clouds
Use a sample customer record to review how a public cloud processor handles personal information. Identify the instructions, recipients and disposition of copies before approving a transfer.
Trace handling instructions
Identify who can access the copy and where the processor acts on customer instructions.
Agree the end of the assignment
Record the agreed process for returning or disposing of copies and obtaining evidence.
Trace a personal information release
Follow a representative file from preparation through receipt and the agreed end of processing.
Purpose and content
List the fields required for the receiving party’s assignment and remove unrelated personal information.
Roles and instructions
Identify who sets the purpose and what instructions each processor receives.
Providers and locations
Confirm which providers may handle a copy and where the proposed processing takes place.
Return and removal
Document what happens to retained copies at the end of the assignment and who checks completion.
Assign responsibility for follow-up
Identify who answers customer questions, approves additional recipients and confirms the handling of retained copies.
Your organization
Specify the permitted recipients, review period and point of contact for changes.
Purpose · instructions · oversightThe proposed service
Ask the provider for evidence about access arrangements, processing locations and end-of-service handling.
Processing · protection · supportUse a sample record.
Ask specific questions.
Bring a representative file with synthetic personal information. Explore the proposed exchange with MX and document the questions your privacy team needs resolved.
Review your privacy requirementsQuestions for
your review.
Does ISO/IEC 27018 replace privacy law?
No. A standard does not remove your legal obligations. Assess applicable laws, processing roles and contractual requirements for the actual exchange.
How does this differ from ISO/IEC 27017?
ISO/IEC 27017 addresses cloud security controls more broadly. ISO/IEC 27018 focuses on personal-information protection where a public-cloud provider acts as a processor.
Is MX certified to ISO/IEC 27018?
No certification claim is made on this page. Request current evidence and verify the service, scope and processing activities it covers.
Is this relevant to both UK and US teams?
Both can use the guidance when evaluating public-cloud processing. Their legal obligations and contractual requirements still depend on the specific circumstances.