ISO/IEC 27018:2019

ISO/IEC 27018:2019 is the international code of practice for protection of Personally Identifiable Information (PII) in public cloud computing environments. It establishes commonly accepted control objectives, controls, and guidelines for implementing measures to protect PII processed by public cloud service providers acting as PII processors.

ISO/IEC 27018:2019 is needed by organisations in Singapore that require protection of pii in public clouds to meet regulatory requirements, client expectations, or supply chain qualifications. The standard applies to organisations of all sizes across relevant sectors in Singapore.

Key requirements include: PII processing in cloud — consent & purpose limitation; Transparency obligations for cloud PII processors; Data subject rights fulfilment in cloud environments; PII disclosure restrictions & sub-processor controls. ICPL conducts a comprehensive gap assessment to identify your organisation's specific requirements against the standard and develops a tailored implementation plan.

ICPL follows a structured 8-step process: gap analysis, awareness training, documentation development, system implementation, internal audit, certification body audit support, non-conformance closure, and award of ISO/IEC 27018:2019. Each step is led by a dedicated senior consultant with documented deliverables and progress reporting.

A typical Singapore SME can achieve ISO/IEC 27018:2019 certification in 3–6 months. Larger organisations or those with complex operations may require 6–12 months. ICPL provides milestone-based project plans with clear deliverables, deadlines, and regular progress updates from day one.

Required documentation typically includes: management system policy, documented procedures, risk assessment records, internal audit reports, management review minutes, and corrective action records. ICPL develops all required documentation tailored to your organisation's operations and the standard's specific requirements.

ICPL is a consultancy firm — we help you prepare for and achieve ISO/IEC 27018:2019 certification. We do not issue the certification ourselves. The certification is issued by an independent, accredited body after a formal audit. ICPL supports you through the entire process, but the final certification decision rests with the certification body.

ISO/IEC 27018:2019 may be eligible for EDGE Grant (formerly EDG) support, which can offset up to 50% of qualifying consultancy costs for eligible SMEs. Grant eligibility, approval and funding are subject to Enterprise Singapore's assessment and are not guaranteed. ICPL assists with grant application and claims at no additional cost.

ICPL provides end-to-end certification support: gap assessment, awareness training, documentation development, system implementation, internal audit, certification body audit support, non-conformance remediation, and post-certification advisory. We also assist with EDGE Grant (formerly EDG) application and claims for eligible projects.

Before starting, we recommend: identifying key personnel to participate in the project, gathering existing policies and procedures, allocating internal resources for documentation and implementation, and securing management commitment. ICPL provides a detailed preparation checklist during the initial gap assessment to ensure a smooth project start.