ISO/IEC 27018 extends ISO 27002 with specific controls for the protection of Personally Identifiable Information (PII) in public cloud services. Defines obligations for cloud providers acting as data processors: transparency in data processing, informed consent, data residency, portability, secure deletion, breach notification, and multi-tenant environment segregation.