Confirm the processing role
Identify public-cloud services where the provider processes PII on behalf of a customer.
ISO/IEC 27018:2025 · PII protection in public clouds
Make cloud privacy accountable.
Connect personal-data flows, public-cloud processors, privacy responsibilities, policies, risks, evidence and remediation in a governed workspace.
The supplied STORM technical description references ISO/IEC 27018 as a cloud-provider requirement, but does not include it in the platform's current built-in standards list. Confirm template availability, 2025 edition alignment and mappings before relying on them.
Public-cloud PII lifecycleProcessor accountability
PIIprotected by design
CollectPurpose · instructions
StoreProtection · location
ProcessRoles · safeguards
TransmitDisclosure · control
DeleteRetention · removal
Collection · storage · processing · transmission · deletion
2025Current ISO publication
Edition 3Aligned with ISO/IEC 27002:2022
Public cloudSpecific service context
PII processorProvider processing for customers
What the standard addresses
Add privacy accountability to cloud security controls.
ISO/IEC 27018:2025 builds on ISO/IEC 27002 for public-cloud providers acting as PII processors. It supports responsible, transparent and secure handling of personal information across its lifecycle.
Follow the information
Understand collection, storage, processing, transmission and deletion in the relevant cloud service.
Make ownership explicit
Clarify customer and provider responsibilities for protecting PII and evidencing safeguards.
Make practices reviewable
Maintain information that allows cloud privacy practices and commitments to be evaluated.
Apply appropriate controls
Connect cloud PII risk to the relevant ISO/IEC 27002-based security safeguards.
Support auditability
Retain evidence that demonstrates how stated privacy and security responsibilities are performed.
Align obligations
Relate provider commitments to applicable contractual, legal and organisational requirements.
Embed privacy early
Use privacy-by-design thinking when cloud services and processing activities are selected or changed.
Product evidence boundary
Strong privacy workflows without an unsupported template claim.
STORM can organise much of the operational evidence around ISO/IEC 27018, but its supplied technical description does not document a ready-made ISO/IEC 27018 assessment.
Documented STORM building blocks
- Personal-data identification and GDPR data mapping
- Connected services, data, systems, users and suppliers
- Configurable supplier questionnaires and evidence
- Risk, policy, incident and remediation workflows
- Supported Microsoft configuration evidence
Must be confirmed or configured
- Licensed ISO/IEC 27018:2025 requirement content
- Ready-made assessment template and control mappings
- Processor-specific privacy evidence taxonomy
- Automated data-subject request or consent workflows
- Coverage of each provider's actual technical controls
Where STORM can support implementation
Connect privacy requirements to operational evidence.
Use the platform to understand personal-data context, evaluate public-cloud providers, control documentation and turn findings into accountable risk and remediation records.
Trace personal-data context
Use data identification, GDPR mapping and Cartography records to connect information with services, software, infrastructure, users, locations and providers.
Data mapping · CartographyQuestion cloud processors
Create tailored supplier questionnaires, capture implementation status and collect supporting attachments for the privacy and security expectations you define.
TPRM · Supplier PortalControl privacy documentation
Maintain policies, procedures and guidance through versioning, approval, acknowledgement, review schedules, reminders and complete document history.
Policy Center · audit trailRecord and treat privacy risk
Capture custom risks with likelihood, impact, controls, treatment strategy, owners, review dates, mitigation actions and supporting evidence.
Risk Registry · treatmentConnect incidents to action
Use incident and corrective-action workflows to document security events, target dates, ownership and follow-through where personal information may be affected.
Incidents · corrective actionsKeep assurance visible
Bring supplier results, risks, policies, incidents, audit findings and compliance inputs together for review and documented management decisions.
Audit · management review
Map before assessing
See where personal information meets public cloud.
STORM documents data identification and GDPR data mapping alongside connected asset and service records. This gives provider assessments a real processing context instead of an isolated checklist.
- Personal-data and service relationships
- Supporting systems, users and suppliers
- Reusable context for risk and assurance
Evaluate and escalate
Turn provider evidence into risk decisions.
Tailored questionnaires and evidence collection can support an organisation-defined ISO/IEC 27018 review. Findings can become custom risks with accountable treatment and remediation.
- Configurable assessment questions
- Evidence attachments and implementation status
- Risks, owners, actions and review dates
Maintain the rules
Keep privacy commitments governed over time.
Use the Policy Center for cloud privacy policies, supplier procedures, data-handling guidance and related documents with controlled ownership and lifecycle evidence.
- Authors, reviewers and approvers
- Versions, planned reviews and reminders
- Acknowledgements and document audit trail
Connect signals and response
Use relevant security evidence without overstating privacy coverage.
Supported Microsoft configuration checks and incident workflows can contribute technical and operational evidence. They do not automatically prove every ISO/IEC 27018 privacy control or legal obligation.
- Historical configuration results where supported
- Incident ownership and corrective actions
- Evidence available for structured review
Practical evaluation themes01 02 03 04 05 06 07 08
Follow accountability across the personal-data lifecycle.
These themes provide implementation orientation only; they do not reproduce or replace the licensed ISO/IEC 27018:2025 text.
Role & instruction
Confirm who determines purposes and how the public-cloud processor is authorised to handle PII.
Customer · processor · instructionProcessing inventory
Connect PII categories and processing activities to services, systems, locations and providers.
Data · purpose · serviceTransparency
Keep relevant provider practices, responsibilities and evidence available for accountable review.
Information · evidence · reviewSupplier chain
Understand which external parties support processing and how their risks and evidence are governed.
Provider · dependency · assuranceSecurity safeguards
Relate PII risk to access, configuration, monitoring, incident and other applicable protections.
Risk · controls · signalsDisclosure & transfer
Document relevant information flows and evaluate them against approved contractual and legal rules.
Flow · location · obligationRetention & deletion
Make lifecycle expectations and supporting evidence visible when processing or services end.
Retention · deletion · evidenceIncident accountability
Clarify detection, notification, investigation, remediation and review responsibilities.
Event · action · learningExact controls and applicability must be determined from the licensed standard, the processing role, contracts and applicable law. STORM organises governance records; it does not replace privacy or legal analysis.
Build a defensible privacy record01 02 03 04 05
From data map to provider assurance.
A practical implementation connects each privacy expectation to processing context, accountable ownership, evidence and action.
Map
Identify PII, processing activities, services, flows and public-cloud providers.
Data · services · providersDefine
Confirm controller, processor and supplier responsibilities and evidence needs.
Roles · contracts · scopeAssess
Apply the approved 2025 requirements using configured questions and evidence.
Questions · controls · proofTreat
Assign gaps, risks, mitigation actions, owners and target dates.
Risk · actions · ownersReview
Reassess changes, incidents, provider evidence and management decisions.
Audit · review · improvePractical questions
Keep privacy support and product claims separate.
ISO guidance, product workflow, provider controls and legal compliance are related—but they are not interchangeable.
Does STORM currently include a built-in ISO/IEC 27018:2025 assessment?
The supplied technical description references ISO/IEC 27018 as relevant to cloud providers but does not include it in the platform's current built-in standards list. STORM supports tailored questionnaires and the surrounding governance workflows; confirm template availability and 2025 mappings directly with ICT PROTECT before claiming built-in coverage.
Who is ISO/IEC 27018 for?
ISO describes it as guidance for public-cloud service providers acting as PII processors. It is also relevant to organisations evaluating cloud providers or seeking assurance when outsourcing personal-data processing.
Does ISO/IEC 27018 cover every type of cloud service?
Its specific scope is protection of PII in public clouds where the provider acts as a PII processor. Broader cloud security across public, private and hybrid environments is addressed by ISO/IEC 27017.
Does ISO/IEC 27018 implementation guarantee GDPR compliance?
No. The standard can support privacy and security practices, but GDPR obligations depend on the organisation's role, processing, contracts, risks and applicable law. Article 28 also requires controllers to use processors providing sufficient guarantees and to govern processing through a binding contract or legal act.
Does STORM automate data-subject requests or consent?
Those dedicated privacy workflows are not documented in the supplied technical description. STORM documents data mapping, governance records, assessments, risks, policies, incidents and actions, but this page does not present it as a consent-management or data-subject request platform.
Do Microsoft configuration checks prove ISO/IEC 27018 conformity?
No. Supported checks can provide relevant technical evidence, but ISO/IEC 27018 also concerns processing context, roles, transparency, contracts and lifecycle accountability. The mapping and applicability of each evidence item must be reviewed.
Does STORM's EU Azure hosting prove a customer's cloud privacy compliance?
No. STORM's documented EU hosting, encryption and tenant segregation can be considered during supplier due diligence, but they do not establish that a customer's wider processing activities or other providers satisfy ISO/IEC 27018 or GDPR.
Bring your processing context
Book a STORM demo Test STORM against the cloud privacy evidence you must actually govern.
Review your personal-data maps, public-cloud processors, provider questionnaires, policies, risks, incidents and evidence—and identify which ISO/IEC 27018:2025 content still needs configuration.