ISO 27018 Code of practice for protection of Personally Identifiable Information (PII) in public clouds acting as PII processors
ISO/IEC 27018 was published in July 2014 by the International Organization for Standardization (ISO), as a new component of the ISO 27001 standard. ISO 27018 adds controls to the ISO/IEC 27001/27002 standards to address processing personally identifiable information (PII) in a cloud computing environment.
The code of practice provides guidance for Cloud Service Providers (CSP) that act as processors of PII and recommends a set of controls. Furthermore, ISO 27018 provides guidance on what CSPs need to achieve in terms of contractual obligations related to processing PII.
ISO 27018 provides controls that reflect considerations specifically for protecting PII in public cloud services. For example, new controls prohibit the use of customer data for advertising and marketing purposes without the customer’s express consent. ISO 27018 also provides clear guidance to CSPs for the return, transfer and/or secure disposal of PII belonging to customers leaving their service. And it provides guidance to the CSP to identify any sub-processor before their use, and inform customers promptly of new sub-processors, to give customers an opportunity to object or terminate their agreement.
ISO 27018 is the first international set of privacy controls in the cloud, and Microsoft Azure was the first cloud computing platform to adopt ISO 27018 as validated during an independent audit by the British Standards Institution (BSI). Office 365, Dynamics CRM Online, and Microsoft Intune have also adopted ISO 27018.
Maintaining compliance with this and similar international standards is part of a broader commitment from Microsoft to protect the privacy of our customers, as described in this Microsoft on the Issues post from Brad Smith, General Counsel & Executive Vice President.
Microsoft will continue to conduct annual audits by independent third parties to confirm Azure compliance, which can then be relied upon by the customer to support their own regulatory obligations.
We understand that security and compliance are extremely important to our customers so we make it a core part of how we design and manage Azure. As we rapidly innovate in productivity services with Azure, we will continue to invest in fielding a service that emphasizes security and compliance with global as well as regional and industry specific standards and regulations.
