Standards Search

Certification Area

Sector

Certificate

ISO/IEC 27018

Protection of personally identifiable information (PII) in public clouds

Cloud Computing Services are a model for delivering technological resources that allows direct and remote access to informed resources - such as applications, databases, usability or storage space - over the internet.

Cloud computing is increasingly used by companies to migrate their data, information or infrastructure, thanks to its flexibility, high availability, accessibility, mobility and cost reduction.

To manage the security risks of personally identifiable information (PII), an internationally recognized code of practice was developed, focused on the protection of personal data in the cloud - ISO/IEC 27018. This is an extremely useful tool that contributes and provides confidence to the market regarding the capacity, suitability and commitment of cloud computing service providers to the applicable legislation.

ISO/IEC 27018 is based on the ISO/IEC 27002 information security standard, complements the set of controls in Annex A to ISO/IEC 27001, and includes controls for the protection of Personally Identifiable Information (PII), in accordance with the privacy principles of ISO/IEC 29100 for the public cloud computing environment.

The main benefits of the implementation and subsequent certification in accordance with this standard include:

Increased customer trust in the protection of data and personal information, by confirmation of compliance with ISO/IEC 27018 by an independent third party;

Competitive advantage, through the provision of services with protection of personal information at the highest level;

Reduction of information security risks applicable to PII in the public cloud;

Facilitated access to the global market, through compliance with common guidelines in different countries, which facilitate the conduct of business worldwide and access as a preferred supplier;

Compliance with legislation applicable to cloud service providers, reducing the risk of fines for personal data breaches.