ISO/IEC 27018
O que é ISO/IEC 27018?
ISO/IEC 27018A code of practice for the protection of personally identifiable information (PII) in public clouds acting as PII processors, layering privacy-specific controls on top of ISO/IEC 27002.
ISO/IEC 27018:2019 specifies commonly accepted control objectives, controls, and guidelines for implementing measures to protect PII in line with privacy principles for the public cloud computing environment, focusing on public-cloud service providers acting as PII processors. It complements ISO 27001/27002 and ISO 27017 with controls addressing consent, choice, purpose limitation, transparency, accountability, subcontractor disclosure, retention and deletion, and information-security incident response for PII. Many cloud providers and SaaS vendors hold ISO 27018 certification together with ISO 27001 and ISO 27017, and customers use it as an indicator that the provider has implemented baseline privacy controls — especially in jurisdictions where GDPR or local privacy law requires processors to demonstrate adequate technical and organisational measures. ISO 27018 is purely a code of practice; it does not on its own satisfy GDPR but is widely treated as supporting evidence in DPIAs and processor due diligence.
● Exemplos
- 01
A SaaS vendor's trust portal references ISO 27018 alongside ISO 27001/27017 to demonstrate baseline privacy controls for customer PII.
- 02
A privacy team uses ISO 27018 controls as a checklist when assessing a new cloud subprocessor for GDPR Article 28 compliance.
● Perguntas frequentes
O que é ISO/IEC 27018?
A code of practice for the protection of personally identifiable information (PII) in public clouds acting as PII processors, layering privacy-specific controls on top of ISO/IEC 27002. Pertence à categoria Conformidade e frameworks da cibersegurança.
O que significa ISO/IEC 27018?
A code of practice for the protection of personally identifiable information (PII) in public clouds acting as PII processors, layering privacy-specific controls on top of ISO/IEC 27002.
Como funciona ISO/IEC 27018?
ISO/IEC 27018:2019 specifies commonly accepted control objectives, controls, and guidelines for implementing measures to protect PII in line with privacy principles for the public cloud computing environment, focusing on public-cloud service providers acting as PII processors. It complements ISO 27001/27002 and ISO 27017 with controls addressing consent, choice, purpose limitation, transparency, accountability, subcontractor disclosure, retention and deletion, and information-security incident response for PII. Many cloud providers and SaaS vendors hold ISO 27018 certification together with ISO 27001 and ISO 27017, and customers use it as an indicator that the provider has implemented baseline privacy controls — especially in jurisdictions where GDPR or local privacy law requires processors to demonstrate adequate technical and organisational measures. ISO 27018 is purely a code of practice; it does not on its own satisfy GDPR but is widely treated as supporting evidence in DPIAs and processor due diligence.
Como se defender contra ISO/IEC 27018?
As defesas contra ISO/IEC 27018 costumam combinar controles técnicos e práticas operacionais, conforme detalhado na definição acima.
Quais são outros nomes para ISO/IEC 27018?
Nomes alternativos comuns: ISO 27018, Cloud PII processor code of practice.
● Termos relacionados
- compliance№ 620
ISO/IEC 27001
Norma internacional que define os requisitos de um Sistema de Gestão de Segurança da Informação (SGSI) e permite certificação formal das organizações.
- compliance№ 622
ISO/IEC 27017
A code of practice that extends ISO/IEC 27002 with cloud-specific information security controls, providing guidance for both cloud service providers and cloud service customers.
- compliance№ 488
RGPD
Regulamento Geral sobre a Proteção de Dados da União Europeia, que regula o tratamento de dados pessoais de pessoas na UE e no EEE.
- compliance№ 312
Avaliação de Impacto sobre a Proteção de Dados (DPIA)
Avaliação estruturada, exigida pelo artigo 35 do RGPD, que identifica e mitiga riscos para os direitos e liberdades das pessoas antes do início de um tratamento de alto risco.
- privacy№ 957
Privacidade desde a conceção
Abordagem de engenharia e governação que integra a privacidade nos sistemas, processos e configurações por defeito desde as fases iniciais de conceção, em vez de a acrescentar mais tarde.
- privacy№ 914
Informações de Identificação Pessoal (PII)
Qualquer dado que permita identificar uma pessoa específica, isoladamente ou em conjunto com outras informações, como nomes, identificadores ou registos biométricos.