Public Cloud PII Processor Controls Template (ISO/IEC 27018:2025)

Public Cloud PII Processor Controls: [Organization name]

Records how a public cloud service provider that processes personally identifiable information (PII) on behalf of its customers meets the practice set out in ISO/IEC 27018:2025, the third edition: the commitments made in customer agreements, transparency, sub-processor management, return and deletion, legally binding disclosure requests, breach notification and a control implementation table in the provider's own words. It sits on top of an ISMS under ISO/IEC 27001:2022 + Amd 1:2024 or a PIMS under ISO/IEC 27701:2025. Replace every [bracketed] value and every row marked Example. This is a documentation format, not legal advice.

Document control

Approvals

Revision history

Contents

1. Purpose and scope
2. ISO/IEC 27018:2025 at a glance
3. Service description and roles
4. Customer agreement commitments
5. Transparency
6. Sub-processor management
7. Assistance with data subject rights
8. Return, transfer and deletion
9. Legally binding disclosure requests
10. Breach notification
11. Control implementation table
12. Size tiers
13. Records and evidence
14. Review and maintenance
15. References

1. Purpose and scope

This document sets out how [Organization name] protects PII that customers place in [service name] when the organization acts as a PII processor in a public cloud. It covers:

• customer content that contains PII (for example records uploaded or generated by customer users);
• PII in service operations data: support tickets, logs, backups, temporary files and test copies;
• every environment, region and sub-processor that touches that PII.

It does not cover processing where the organization is the controller (for example its own staff, billing contacts or marketing data). Those activities are handled in the PIMS scope (DOC-ISMS-100) and the record of processing activities (compliance/gdpr-ropa).

2. ISO/IEC 27018:2025 at a glance

ISO/IEC 27018:2025 gives guidelines for public cloud service providers acting as PII processors. It adds cloud and privacy guidance to the information security controls of ISO/IEC 27002:2022 and adds a further set of controls specific to protecting PII in a public cloud. It is used together with an ISMS or a PIMS; it does not replace them.

Providers that mapped their controls to the 2019 edition should re-map to the 2025 edition and update customer-facing statements. Where a PIMS is run, published summaries of ISO/IEC 27701:2025 report an informative mapping to ISO/IEC 27018 that helps align the two control sets; confirm it in your copy of each standard.

3. Service description and roles

4. Customer agreement commitments

Keep the commitment wording here identical to the DPA template (legal-lite/dpa) and the customer security addendum (DOC-ISMS-117). When legal changes the contract template, update this table in the same change.

5. Transparency

6. Sub-processor management

Assess each sub-processor with compliance/supplier-security-assessment (DOC-ISMS-067) and keep the master record in the supplier register (DOC-ISMS-066).

7. Assistance with data subject rights

1. If a data subject contacts the organization directly about customer data, support does not act on the request. It records the request and forwards it to the customer within [2] business days (Example), unless the customer has authorized another route.
2. The service provides self-service features for access, correction, export and deletion where possible. Document them in the customer documentation.
3. Where a customer needs help beyond the features, support opens an assistance ticket, performs the action only on the customer's written instruction and records what was done.
4. Track volume and response time as a PIMS measure.

8. Return, transfer and deletion

Issue a deletion confirmation to the customer on request, stating the date and the data locations covered. Erase or destroy storage media that held customer PII before reuse or disposal; for providers that rely on an IaaS sub-processor, obtain its media sanitization assurance through the supplier assessment. Align periods with data/data-retention-deletion-standard and the cloud exit plan (DOC-ISMS-076).

9. Legally binding disclosure requests

Rules:

• Only legal counsel may accept, challenge or answer a request.
• Reject or challenge requests that are not legally binding or are broader than necessary.
• Try first to redirect the authority to the customer, who is the controller.
• Record every request, including rejected ones, in the disclosure log with date, authority, scope, legal basis, customer notified (yes or no, and why) and data disclosed.
• Publish aggregate request numbers if the organization issues a transparency report.

10. Breach notification

Content of the customer notice: description of the breach, categories and approximate number of data subjects and records, likely consequences, measures taken or proposed, contact point, and what is still unknown. Assess each case with compliance/personal-data-breach-assessment and record it in the incident register (DOC-ISMS-021).

11. Control implementation table

Record the same decisions in the PIMS SoA (DOC-ISMS-101) or the ISMS SoA (DOC-ISMS-011) as additional controls, so each decision lives in one approved place.

12. Size tiers

13. Records and evidence

Add each record to the control evidence matrix (isms/control-evidence-matrix, DOC-ISMS-033).

14. Review and maintenance

Review this document at least every 12 months and when:

• a sub-processor, hosting region or data category changes;
• the DPA or customer security addendum template changes;
• a breach, disclosure request or audit finding shows a gap;
• a law or regulator guidance changes processor duties;
• a new edition or amendment of ISO/IEC 27018 is published.

15. References

Standard and licence note

Structure aligned with ISO/IEC 27018:2025, ISO/IEC 27002:2022 and ISO/IEC 29100:2024. The commitments, procedures, tables, diagrams and examples are original text. No control text, control titles or guidance from ISO/IEC standards are reproduced; control references are placeholders that you fill from the official standard, which you need to implement the practice. Check the current edition of each standard before use. GDPR is cited as an example only.

Template licence: MIT.