{"product_id":"iso-27018-toolkit","title":"ISO\/IEC 27018 Cloud Privacy Documentation Toolkit","description":"\u003cdiv class=\"ucs-desc ucs-desc--toolkit\"\u003e\n  \u003ch3 class=\"ucs-desc__title\"\u003eProduct Description\u003c\/h3\u003e\n\n  \u003cul class=\"ucs-desc__facts-list\"\u003e\n    \u003cli class=\"ucs-desc__fact-point\"\u003e\n\u003cstrong\u003eProduct Type:\u003c\/strong\u003e Digital Download\u003c\/li\u003e\n    \u003cli class=\"ucs-desc__fact-point\"\u003e\n\u003cstrong\u003eFile Format:\u003c\/strong\u003e MS Word (.docx) \u0026amp; MS Excel (.xlsx)\u003c\/li\u003e\n    \u003cli class=\"ucs-desc__fact-point\"\u003e\n\u003cstrong\u003eTotal Documents:\u003c\/strong\u003e 74\u003c\/li\u003e\n    \u003cli class=\"ucs-desc__fact-point\"\u003e\n\u003cstrong\u003eDelivery:\u003c\/strong\u003e Instant — direct to your email inbox\u003c\/li\u003e\n  \u003c\/ul\u003e\n\n  \u003csection class=\"ucs-desc__section\"\u003e\n    \u003ch4 class=\"ucs-desc__section-title\"\u003eWhat Is ISO\/IEC 27018?\u003c\/h4\u003e\n    \u003cp class=\"ucs-desc__intro\"\u003eISO\/IEC 27018 is the international standard for protecting personally identifiable information in public clouds where the provider acts as a PII processor. It provides cloud-specific guidance on the controls of ISO\/IEC 27002 as they apply to personal data, plus an extended control set that addresses obligations arising only from the processor role — processing on customer instruction, disclosure of sub-processors and processing locations, assistance with individual rights, and the handling of legally binding requests for customer data.\u003c\/p\u003e\n    \u003cp\u003eThe third edition, published on 26 August 2025, replaces the 2019 second edition. Its main change is structural: the text is now aligned to the four themes and 93 controls of ISO\/IEC 27002:2022 rather than the fourteen-clause structure used previously. The Annex A extended control set for public cloud PII processors is retained, with 25 controls arranged under the privacy principles of ISO\/IEC 29100, and a correspondence table to the 2019 edition is provided in Annex B.\u003c\/p\u003e\n    \u003cp\u003eWhether you are a SaaS provider answering enterprise due diligence, a managed service provider handling client data, or a cloud platform being asked where your support team works from and whether your staff can read customer records, ISO\/IEC 27018 provides the recognised framework to demonstrate that you can answer those questions.\u003c\/p\u003e\n    \u003cp class=\"ucs-desc__note\"\u003e\u003cem\u003ePlease note: ISO\/IEC 27018 is a code of practice and is not separately certifiable. It is audited as an extension to the scope of an ISO\/IEC 27001 certification, and this toolkit is built to serve exactly that purpose.\u003c\/em\u003e\u003c\/p\u003e\n  \u003c\/section\u003e\n\n  \u003csection class=\"ucs-desc__section\"\u003e\n    \u003ch4 class=\"ucs-desc__section-title\"\u003eWhat’s Included in Our ISO\/IEC 27018 Documents\u003c\/h4\u003e\n    \u003cp class=\"ucs-desc__intro\"\u003eOur toolkit gives you every document needed to extend your information security management system to cover the personal data your customers place in your service — without starting from scratch. All documents are pre-built, clause-mapped, and ready to customise:\u003c\/p\u003e\n    \u003cul class=\"ucs-desc__checklist\"\u003e\n      \u003cli\u003e\n\u003cstrong\u003eSystem Manual \u0026amp; Usage Guide:\u003c\/strong\u003e Get your team up and running quickly with a clear, practical Cloud PII Protection Manual that explains the third-edition structure, maps all 25 Annex A extended controls to the documents that implement them, and sets out a seven-phase implementation roadmap\u003c\/li\u003e\n      \u003cli\u003e\n\u003cstrong\u003ePolicies \u0026amp; Governance Documents:\u003c\/strong\u003e Define the intent, boundaries and direction of your cloud privacy programme from day one — including Cloud PII Protection Policy, PII Processing \u0026amp; Customer Instruction Policy, PII Principal Rights \u0026amp; Consent Support Policy, Data Minimization Retention \u0026amp; Disposal Policy, and Transparency Openness \u0026amp; Customer Notice Policy\u003c\/li\u003e\n      \u003cli\u003e\n\u003cstrong\u003eCustomer Instruction \u0026amp; Rights Documents:\u003c\/strong\u003e Establish that you process personal data on instruction rather than assumption — with an instruction intake and change procedure, source verification, a rights assistance procedure that routes individual requests back to the controller, and the registers that evidence both\u003c\/li\u003e\n      \u003cli\u003e\n\u003cstrong\u003eDisclosure \u0026amp; Law Enforcement Documents:\u003c\/strong\u003e The documents nobody wants to write under pressure: a disclosure request handling procedure, a legal assessment form covering jurisdiction and non-disclosure orders, and a register that records refusals as well as disclosures\u003c\/li\u003e\n      \u003cli\u003e\n\u003cstrong\u003eSub-processor \u0026amp; Supply Chain Documents:\u003c\/strong\u003e Full due diligence package including a selection and due diligence procedure with risk tiering, a Sub-processor Due Diligence Questionnaire, a change notification and objection procedure, and a register that doubles as the source of your published sub-processor list\u003c\/li\u003e\n      \u003cli\u003e\n\u003cstrong\u003eTechnical Control Procedures:\u003c\/strong\u003e Complete operational suite covering encryption in transit and at rest, cryptographic key management with per-tenant keys, user ID lifecycle and unique identifiers, privileged access with just-in-time elevation, logging and monitoring of PII access, multi-tenancy segregation, storage reuse, and secure erasure of temporary files\u003c\/li\u003e\n      \u003cli\u003e\n\u003cstrong\u003eIncident \u0026amp; Breach Documents:\u003c\/strong\u003e Privacy Incident Detection, Triage \u0026amp; Response Procedure with a severity matrix and characterisation set, PII Breach Notification Procedure with a jurisdiction deadline schedule, and a notification template built for phased disclosure\u003c\/li\u003e\n      \u003cli\u003e\n\u003cstrong\u003eReturn, Disposal \u0026amp; Restoration Documents:\u003c\/strong\u003e A return, transfer and disposal procedure with a seventeen-location data inventory checklist, a customer-facing disposal certificate that states backup expiry honestly, and a restoration control procedure that stops a restore silently undoing a deletion commitment\u003c\/li\u003e\n      \u003cli\u003e\n\u003cstrong\u003eRegisters \u0026amp; Logs:\u003c\/strong\u003e Seventeen live Excel workbooks — Master Document Register, PII Inventory \u0026amp; Data Flow Register, Risk Register, Statement of Applicability, Customer Instructions Register, Sub-processor Register, Disclosure Register, Rights Request Register, Incident \u0026amp; Breach Register, Retention \u0026amp; Disposal Schedule, Authorized Users Register, Data Restoration Log, Media \u0026amp; Hardcopy Register, Geographic Location \u0026amp; Transfer Register, Legal Requirements Register, Training Register, and a Privacy Regulation Cross-Reference Matrix\u003c\/li\u003e\n      \u003cli\u003e\n\u003cstrong\u003eContract \u0026amp; Transparency Templates:\u003c\/strong\u003e A processor annex clause set covering roles, instructions, sub-processing, breach notification, location and audit rights, plus a customer-facing transparency statement template that satisfies the Annex A disclosure obligations\u003c\/li\u003e\n      \u003cli\u003e\n\u003cstrong\u003eInternal Assessment Tools:\u003c\/strong\u003e Gap Analysis \u0026amp; Implementation Workbook with a 118-control assessment, a 74-document tracker and a formula-driven readiness dashboard, structured around the questions certification auditors actually ask about a 27018 scope extension\u003c\/li\u003e\n    \u003c\/ul\u003e\n  \u003c\/section\u003e\n\n  \u003csection class=\"ucs-desc__section\"\u003e\n    \u003ch4 class=\"ucs-desc__section-title\"\u003eToolkit Documents by Clause\u003c\/h4\u003e\n    \u003cdiv class=\"ucs-desc__table-wrap\"\u003e\n      \u003ctable class=\"ucs-desc__table\"\u003e\n        \u003cthead\u003e\n          \u003ctr\u003e\n            \u003cth scope=\"col\"\u003eNo.\u003c\/th\u003e\n            \u003cth scope=\"col\"\u003eClause\u003c\/th\u003e\n            \u003cth scope=\"col\"\u003eTheme \/ Phase\u003c\/th\u003e\n            \u003cth scope=\"col\"\u003eDocument Title\u003c\/th\u003e\n            \u003cth scope=\"col\"\u003eType\u003c\/th\u003e\n            \u003cth scope=\"col\"\u003eFormat\u003c\/th\u003e\n          \u003c\/tr\u003e\n        \u003c\/thead\u003e\n        \u003ctbody\u003e\n          \u003ctr\u003e\n\u003ctd\u003e1\u003c\/td\u003e\n\u003ctd\u003eManual\u003c\/td\u003e\n\u003ctd\u003eManual \u0026amp; Usage Guide\u003c\/td\u003e\n\u003ctd\u003eCloud PII Protection Manual\u003c\/td\u003e\n\u003ctd\u003eManual\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e2\u003c\/td\u003e\n\u003ctd\u003eManual\u003c\/td\u003e\n\u003ctd\u003eManual \u0026amp; Usage Guide\u003c\/td\u003e\n\u003ctd\u003eToolkit Documents by Clause (Clause Map)\u003c\/td\u003e\n\u003ctd\u003eDocument\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e3\u003c\/td\u003e\n\u003ctd\u003eCl. 5.1\u003c\/td\u003e\n\u003ctd\u003eGovernance \u0026amp; Policy\u003c\/td\u003e\n\u003ctd\u003eCloud PII Protection Policy\u003c\/td\u003e\n\u003ctd\u003ePolicy\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e4\u003c\/td\u003e\n\u003ctd\u003eCl. 5.34\u003c\/td\u003e\n\u003ctd\u003eGovernance \u0026amp; Policy\u003c\/td\u003e\n\u003ctd\u003ePII Processing and Customer Instruction Policy\u003c\/td\u003e\n\u003ctd\u003ePolicy\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e5\u003c\/td\u003e\n\u003ctd\u003eCl. 5.34\u003c\/td\u003e\n\u003ctd\u003eGovernance \u0026amp; Policy\u003c\/td\u003e\n\u003ctd\u003ePII Principal Rights and Consent Support Policy\u003c\/td\u003e\n\u003ctd\u003ePolicy\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e6\u003c\/td\u003e\n\u003ctd\u003eCl. 5.33\u003c\/td\u003e\n\u003ctd\u003eGovernance \u0026amp; Policy\u003c\/td\u003e\n\u003ctd\u003eData Minimization, Retention and Disposal Policy\u003c\/td\u003e\n\u003ctd\u003ePolicy\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e7\u003c\/td\u003e\n\u003ctd\u003eCl. 5.5\u003c\/td\u003e\n\u003ctd\u003eGovernance \u0026amp; Policy\u003c\/td\u003e\n\u003ctd\u003ePII Disclosure and Law Enforcement Request Policy\u003c\/td\u003e\n\u003ctd\u003ePolicy\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e8\u003c\/td\u003e\n\u003ctd\u003eCl. 5.19\u003c\/td\u003e\n\u003ctd\u003eGovernance \u0026amp; Policy\u003c\/td\u003e\n\u003ctd\u003eSub-processor and ICT Supply Chain Privacy Policy\u003c\/td\u003e\n\u003ctd\u003ePolicy\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e9\u003c\/td\u003e\n\u003ctd\u003eCl. 8.24\u003c\/td\u003e\n\u003ctd\u003eGovernance \u0026amp; Policy\u003c\/td\u003e\n\u003ctd\u003eCryptography and Key Management Policy\u003c\/td\u003e\n\u003ctd\u003ePolicy\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e10\u003c\/td\u003e\n\u003ctd\u003eCl. 5.15\u003c\/td\u003e\n\u003ctd\u003eGovernance \u0026amp; Policy\u003c\/td\u003e\n\u003ctd\u003eAccess Control and User Identity Policy\u003c\/td\u003e\n\u003ctd\u003ePolicy\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e11\u003c\/td\u003e\n\u003ctd\u003eCl. 7.10\u003c\/td\u003e\n\u003ctd\u003eGovernance \u0026amp; Policy\u003c\/td\u003e\n\u003ctd\u003eStorage Media, Hardcopy and Secure Disposal Policy\u003c\/td\u003e\n\u003ctd\u003ePolicy\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e12\u003c\/td\u003e\n\u003ctd\u003eCl. 5.24\u003c\/td\u003e\n\u003ctd\u003eGovernance \u0026amp; Policy\u003c\/td\u003e\n\u003ctd\u003ePrivacy Incident and PII Breach Notification Policy\u003c\/td\u003e\n\u003ctd\u003ePolicy\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e13\u003c\/td\u003e\n\u003ctd\u003eCl. 5.34\u003c\/td\u003e\n\u003ctd\u003eGovernance \u0026amp; Policy\u003c\/td\u003e\n\u003ctd\u003eTransparency, Openness and Customer Notice Policy\u003c\/td\u003e\n\u003ctd\u003ePolicy\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e14\u003c\/td\u003e\n\u003ctd\u003eCl. 5.31\u003c\/td\u003e\n\u003ctd\u003eGovernance \u0026amp; Policy\u003c\/td\u003e\n\u003ctd\u003eGeographic Location and Cross-Border Transfer Policy\u003c\/td\u003e\n\u003ctd\u003ePolicy\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e15\u003c\/td\u003e\n\u003ctd\u003eCl. 5.33\u003c\/td\u003e\n\u003ctd\u003eGovernance \u0026amp; Policy\u003c\/td\u003e\n\u003ctd\u003eDocumented Information and Records Control Policy\u003c\/td\u003e\n\u003ctd\u003ePolicy\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e16\u003c\/td\u003e\n\u003ctd\u003eCl. 5.1\u003c\/td\u003e\n\u003ctd\u003eOrganizational\u003c\/td\u003e\n\u003ctd\u003eCloud Privacy Risk Assessment and Treatment Procedure\u003c\/td\u003e\n\u003ctd\u003eProcedure\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e17\u003c\/td\u003e\n\u003ctd\u003eCl. 5.9\u003c\/td\u003e\n\u003ctd\u003eOrganizational\u003c\/td\u003e\n\u003ctd\u003ePII Inventory and Data Flow Mapping Procedure\u003c\/td\u003e\n\u003ctd\u003eProcedure\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e18\u003c\/td\u003e\n\u003ctd\u003eCl. 5.37\u003c\/td\u003e\n\u003ctd\u003eOrganizational\u003c\/td\u003e\n\u003ctd\u003eCustomer Processing Instruction Intake and Change Procedure\u003c\/td\u003e\n\u003ctd\u003eProcedure\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e19\u003c\/td\u003e\n\u003ctd\u003eCl. 5.34\u003c\/td\u003e\n\u003ctd\u003eOrganizational\u003c\/td\u003e\n\u003ctd\u003ePII Principal Rights Assistance Procedure\u003c\/td\u003e\n\u003ctd\u003eProcedure\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e20\u003c\/td\u003e\n\u003ctd\u003eCl. 5.10\u003c\/td\u003e\n\u003ctd\u003eOrganizational\u003c\/td\u003e\n\u003ctd\u003eRestriction on Commercial and Secondary Use of PII\u003c\/td\u003e\n\u003ctd\u003eProcedure\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e21\u003c\/td\u003e\n\u003ctd\u003eCl. 5.5\u003c\/td\u003e\n\u003ctd\u003eOrganizational\u003c\/td\u003e\n\u003ctd\u003ePII Disclosure Request Handling and Recording Procedure\u003c\/td\u003e\n\u003ctd\u003eProcedure\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e22\u003c\/td\u003e\n\u003ctd\u003eCl. 5.19\u003c\/td\u003e\n\u003ctd\u003eOrganizational\u003c\/td\u003e\n\u003ctd\u003eSub-processor Selection and Due Diligence Procedure\u003c\/td\u003e\n\u003ctd\u003eProcedure\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e23\u003c\/td\u003e\n\u003ctd\u003eCl. 5.22\u003c\/td\u003e\n\u003ctd\u003eOrganizational\u003c\/td\u003e\n\u003ctd\u003eSub-processor Change Notification and Objection Procedure\u003c\/td\u003e\n\u003ctd\u003eProcedure\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e24\u003c\/td\u003e\n\u003ctd\u003eCl. 5.24\u003c\/td\u003e\n\u003ctd\u003eOrganizational\u003c\/td\u003e\n\u003ctd\u003ePrivacy Incident Detection, Triage and Response Procedure\u003c\/td\u003e\n\u003ctd\u003eProcedure\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e25\u003c\/td\u003e\n\u003ctd\u003eCl. 5.5\u003c\/td\u003e\n\u003ctd\u003eOrganizational\u003c\/td\u003e\n\u003ctd\u003ePII Breach Notification Procedure\u003c\/td\u003e\n\u003ctd\u003eProcedure\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e26\u003c\/td\u003e\n\u003ctd\u003eCl. 5.11\u003c\/td\u003e\n\u003ctd\u003eOrganizational\u003c\/td\u003e\n\u003ctd\u003ePII Return, Transfer and Disposal Procedure\u003c\/td\u003e\n\u003ctd\u003eProcedure\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e27\u003c\/td\u003e\n\u003ctd\u003eCl. 5.16\u003c\/td\u003e\n\u003ctd\u003eOrganizational\u003c\/td\u003e\n\u003ctd\u003eUser ID Lifecycle and Access Provisioning Procedure\u003c\/td\u003e\n\u003ctd\u003eProcedure\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e28\u003c\/td\u003e\n\u003ctd\u003eCl. 5.31\u003c\/td\u003e\n\u003ctd\u003eOrganizational\u003c\/td\u003e\n\u003ctd\u003eGeographic Location Disclosure and Transfer Assessment Procedure\u003c\/td\u003e\n\u003ctd\u003eProcedure\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e29\u003c\/td\u003e\n\u003ctd\u003eCl. 6.6\u003c\/td\u003e\n\u003ctd\u003ePeople\u003c\/td\u003e\n\u003ctd\u003eConfidentiality and Non-Disclosure Agreement Procedure\u003c\/td\u003e\n\u003ctd\u003eProcedure\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e30\u003c\/td\u003e\n\u003ctd\u003eCl. 6.2\u003c\/td\u003e\n\u003ctd\u003ePeople\u003c\/td\u003e\n\u003ctd\u003ePrivacy Awareness and Role-Based Training Procedure\u003c\/td\u003e\n\u003ctd\u003eProcedure\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e31\u003c\/td\u003e\n\u003ctd\u003eCl. 7.9\u003c\/td\u003e\n\u003ctd\u003ePhysical\u003c\/td\u003e\n\u003ctd\u003eStorage Media Handling and Off-Premises Transport Procedure\u003c\/td\u003e\n\u003ctd\u003eProcedure\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e32\u003c\/td\u003e\n\u003ctd\u003eCl. 7.7\u003c\/td\u003e\n\u003ctd\u003ePhysical\u003c\/td\u003e\n\u003ctd\u003eHardcopy Restriction and Secure Destruction Procedure\u003c\/td\u003e\n\u003ctd\u003eProcedure\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e33\u003c\/td\u003e\n\u003ctd\u003eCl. 8.10\u003c\/td\u003e\n\u003ctd\u003eTechnological\u003c\/td\u003e\n\u003ctd\u003eSecure Erasure of Temporary Files Procedure\u003c\/td\u003e\n\u003ctd\u003eProcedure\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e34\u003c\/td\u003e\n\u003ctd\u003eCl. 8.13\u003c\/td\u003e\n\u003ctd\u003eTechnological\u003c\/td\u003e\n\u003ctd\u003eData Restoration Control and Logging Procedure\u003c\/td\u003e\n\u003ctd\u003eProcedure\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e35\u003c\/td\u003e\n\u003ctd\u003eCl. 8.24\u003c\/td\u003e\n\u003ctd\u003eTechnological\u003c\/td\u003e\n\u003ctd\u003eEncryption of PII in Transit and at Rest Procedure\u003c\/td\u003e\n\u003ctd\u003eProcedure\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e36\u003c\/td\u003e\n\u003ctd\u003eCl. 8.24\u003c\/td\u003e\n\u003ctd\u003eTechnological\u003c\/td\u003e\n\u003ctd\u003eCryptographic Key Management Procedure\u003c\/td\u003e\n\u003ctd\u003eProcedure\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e37\u003c\/td\u003e\n\u003ctd\u003eCl. 8.2\u003c\/td\u003e\n\u003ctd\u003eTechnological\u003c\/td\u003e\n\u003ctd\u003ePrivileged Access and Administrator Activity Control Procedure\u003c\/td\u003e\n\u003ctd\u003eProcedure\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e38\u003c\/td\u003e\n\u003ctd\u003eCl. 8.15\u003c\/td\u003e\n\u003ctd\u003eTechnological\u003c\/td\u003e\n\u003ctd\u003eLogging and Monitoring of PII Processing Procedure\u003c\/td\u003e\n\u003ctd\u003eProcedure\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e39\u003c\/td\u003e\n\u003ctd\u003eCl. 8.22\u003c\/td\u003e\n\u003ctd\u003eTechnological\u003c\/td\u003e\n\u003ctd\u003eMulti-Tenancy Segregation and Storage Reuse Procedure\u003c\/td\u003e\n\u003ctd\u003eProcedure\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e40\u003c\/td\u003e\n\u003ctd\u003eCl. 5.1\u003c\/td\u003e\n\u003ctd\u003eForms \u0026amp; Templates\u003c\/td\u003e\n\u003ctd\u003eCloud Privacy Risk Assessment Form\u003c\/td\u003e\n\u003ctd\u003eForm\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e41\u003c\/td\u003e\n\u003ctd\u003eCl. 5.37\u003c\/td\u003e\n\u003ctd\u003eForms \u0026amp; Templates\u003c\/td\u003e\n\u003ctd\u003eCustomer Processing Instruction Record\u003c\/td\u003e\n\u003ctd\u003eForm\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e42\u003c\/td\u003e\n\u003ctd\u003eCl. 5.34\u003c\/td\u003e\n\u003ctd\u003eForms \u0026amp; Templates\u003c\/td\u003e\n\u003ctd\u003ePII Principal Rights Assistance Request Form\u003c\/td\u003e\n\u003ctd\u003eForm\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e43\u003c\/td\u003e\n\u003ctd\u003eCl. 5.31\u003c\/td\u003e\n\u003ctd\u003eForms \u0026amp; Templates\u003c\/td\u003e\n\u003ctd\u003ePII Disclosure Request Assessment Form\u003c\/td\u003e\n\u003ctd\u003eForm\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e44\u003c\/td\u003e\n\u003ctd\u003eCl. 5.19\u003c\/td\u003e\n\u003ctd\u003eForms \u0026amp; Templates\u003c\/td\u003e\n\u003ctd\u003eSub-processor Due Diligence Questionnaire\u003c\/td\u003e\n\u003ctd\u003eQuestionnaire\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e45\u003c\/td\u003e\n\u003ctd\u003eCl. 5.26\u003c\/td\u003e\n\u003ctd\u003eForms \u0026amp; Templates\u003c\/td\u003e\n\u003ctd\u003ePII Breach Notification Template\u003c\/td\u003e\n\u003ctd\u003eTemplate\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e46\u003c\/td\u003e\n\u003ctd\u003eCl. 5.11\u003c\/td\u003e\n\u003ctd\u003eForms \u0026amp; Templates\u003c\/td\u003e\n\u003ctd\u003ePII Return, Transfer and Disposal Certificate\u003c\/td\u003e\n\u003ctd\u003eForm\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e47\u003c\/td\u003e\n\u003ctd\u003eCl. 8.13\u003c\/td\u003e\n\u003ctd\u003eForms \u0026amp; Templates\u003c\/td\u003e\n\u003ctd\u003eData Restoration Authorisation and Log Form\u003c\/td\u003e\n\u003ctd\u003eForm\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e48\u003c\/td\u003e\n\u003ctd\u003eCl. 6.6\u003c\/td\u003e\n\u003ctd\u003eForms \u0026amp; Templates\u003c\/td\u003e\n\u003ctd\u003eConfidentiality and Non-Disclosure Agreement Template\u003c\/td\u003e\n\u003ctd\u003eAgreement\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e49\u003c\/td\u003e\n\u003ctd\u003eCl. 5.35\u003c\/td\u003e\n\u003ctd\u003eForms \u0026amp; Templates\u003c\/td\u003e\n\u003ctd\u003eCustomer Audit Request and Response Form\u003c\/td\u003e\n\u003ctd\u003eForm\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e50\u003c\/td\u003e\n\u003ctd\u003eCl. 5.20\u003c\/td\u003e\n\u003ctd\u003eForms \u0026amp; Templates\u003c\/td\u003e\n\u003ctd\u003eCloud Privacy Contract Clause Set (Processor Annex)\u003c\/td\u003e\n\u003ctd\u003eClause Set\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e51\u003c\/td\u003e\n\u003ctd\u003eCl. 5.34\u003c\/td\u003e\n\u003ctd\u003eForms \u0026amp; Templates\u003c\/td\u003e\n\u003ctd\u003eCloud Privacy Transparency Statement Template\u003c\/td\u003e\n\u003ctd\u003eTemplate\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e52\u003c\/td\u003e\n\u003ctd\u003eCl. 8.10\u003c\/td\u003e\n\u003ctd\u003eForms \u0026amp; Templates\u003c\/td\u003e\n\u003ctd\u003eSecure Erasure and Sanitisation Record\u003c\/td\u003e\n\u003ctd\u003eForm\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e53\u003c\/td\u003e\n\u003ctd\u003eCl. 5.35\u003c\/td\u003e\n\u003ctd\u003eAssessment \u0026amp; Review\u003c\/td\u003e\n\u003ctd\u003eCustomer Audit and Assurance Request Procedure\u003c\/td\u003e\n\u003ctd\u003eProcedure\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e54\u003c\/td\u003e\n\u003ctd\u003eCl. 5.35\u003c\/td\u003e\n\u003ctd\u003eAssessment \u0026amp; Review\u003c\/td\u003e\n\u003ctd\u003eInternal Audit of Cloud Privacy Controls Procedure\u003c\/td\u003e\n\u003ctd\u003eProcedure\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e55\u003c\/td\u003e\n\u003ctd\u003eCl. 5.4\u003c\/td\u003e\n\u003ctd\u003eAssessment \u0026amp; Review\u003c\/td\u003e\n\u003ctd\u003eManagement Review and Continual Improvement Procedure\u003c\/td\u003e\n\u003ctd\u003eProcedure\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e56\u003c\/td\u003e\n\u003ctd\u003eCl. 5.31\u003c\/td\u003e\n\u003ctd\u003eAssessment \u0026amp; Review\u003c\/td\u003e\n\u003ctd\u003ePrivacy Legal and Regulatory Monitoring Procedure\u003c\/td\u003e\n\u003ctd\u003eProcedure\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--word\"\u003eWord\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e57\u003c\/td\u003e\n\u003ctd\u003eCl. 5.37\u003c\/td\u003e\n\u003ctd\u003eRegisters \u0026amp; Logs\u003c\/td\u003e\n\u003ctd\u003eMaster Document Register\u003c\/td\u003e\n\u003ctd\u003eRegister (Excel)\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--excel\"\u003eExcel\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e58\u003c\/td\u003e\n\u003ctd\u003eCl. 5.9\u003c\/td\u003e\n\u003ctd\u003eRegisters \u0026amp; Logs\u003c\/td\u003e\n\u003ctd\u003ePII Inventory and Data Flow Register\u003c\/td\u003e\n\u003ctd\u003eRegister (Excel)\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--excel\"\u003eExcel\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e59\u003c\/td\u003e\n\u003ctd\u003eCl. 5.1\u003c\/td\u003e\n\u003ctd\u003eRegisters \u0026amp; Logs\u003c\/td\u003e\n\u003ctd\u003eCloud Privacy Risk Register\u003c\/td\u003e\n\u003ctd\u003eRegister (Excel)\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--excel\"\u003eExcel\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e60\u003c\/td\u003e\n\u003ctd\u003e—\u003c\/td\u003e\n\u003ctd\u003eRegisters \u0026amp; Logs\u003c\/td\u003e\n\u003ctd\u003eStatement of Applicability\u003c\/td\u003e\n\u003ctd\u003eMatrix\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--excel\"\u003eExcel\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e61\u003c\/td\u003e\n\u003ctd\u003eCl. 5.37\u003c\/td\u003e\n\u003ctd\u003eRegisters \u0026amp; Logs\u003c\/td\u003e\n\u003ctd\u003eCustomer Processing Instructions Register\u003c\/td\u003e\n\u003ctd\u003eRegister (Excel)\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--excel\"\u003eExcel\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e62\u003c\/td\u003e\n\u003ctd\u003eCl. 5.19\u003c\/td\u003e\n\u003ctd\u003eRegisters \u0026amp; Logs\u003c\/td\u003e\n\u003ctd\u003eSub-processor Register\u003c\/td\u003e\n\u003ctd\u003eRegister (Excel)\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--excel\"\u003eExcel\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e63\u003c\/td\u003e\n\u003ctd\u003eCl. 5.31\u003c\/td\u003e\n\u003ctd\u003eRegisters \u0026amp; Logs\u003c\/td\u003e\n\u003ctd\u003ePII Disclosure Register\u003c\/td\u003e\n\u003ctd\u003eRegister (Excel)\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--excel\"\u003eExcel\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e64\u003c\/td\u003e\n\u003ctd\u003eCl. 5.34\u003c\/td\u003e\n\u003ctd\u003eRegisters \u0026amp; Logs\u003c\/td\u003e\n\u003ctd\u003ePII Principal Rights Request Register\u003c\/td\u003e\n\u003ctd\u003eRegister (Excel)\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--excel\"\u003eExcel\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e65\u003c\/td\u003e\n\u003ctd\u003eCl. 5.24\u003c\/td\u003e\n\u003ctd\u003eRegisters \u0026amp; Logs\u003c\/td\u003e\n\u003ctd\u003ePrivacy Incident and Breach Register\u003c\/td\u003e\n\u003ctd\u003eRegister (Excel)\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--excel\"\u003eExcel\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e66\u003c\/td\u003e\n\u003ctd\u003eCl. 5.33\u003c\/td\u003e\n\u003ctd\u003eRegisters \u0026amp; Logs\u003c\/td\u003e\n\u003ctd\u003eRetention and Disposal Schedule\u003c\/td\u003e\n\u003ctd\u003eRegister (Excel)\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--excel\"\u003eExcel\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e67\u003c\/td\u003e\n\u003ctd\u003eCl. 5.16\u003c\/td\u003e\n\u003ctd\u003eRegisters \u0026amp; Logs\u003c\/td\u003e\n\u003ctd\u003eAuthorized Users and Unique ID Register\u003c\/td\u003e\n\u003ctd\u003eRegister (Excel)\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--excel\"\u003eExcel\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e68\u003c\/td\u003e\n\u003ctd\u003eCl. 8.13\u003c\/td\u003e\n\u003ctd\u003eRegisters \u0026amp; Logs\u003c\/td\u003e\n\u003ctd\u003eData Restoration Log\u003c\/td\u003e\n\u003ctd\u003eRegister (Excel)\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--excel\"\u003eExcel\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e69\u003c\/td\u003e\n\u003ctd\u003eCl. 7.10\u003c\/td\u003e\n\u003ctd\u003eRegisters \u0026amp; Logs\u003c\/td\u003e\n\u003ctd\u003eStorage Media and Hardcopy Register\u003c\/td\u003e\n\u003ctd\u003eRegister (Excel)\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--excel\"\u003eExcel\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e70\u003c\/td\u003e\n\u003ctd\u003eCl. 5.31\u003c\/td\u003e\n\u003ctd\u003eRegisters \u0026amp; Logs\u003c\/td\u003e\n\u003ctd\u003eGeographic Location and Transfer Register\u003c\/td\u003e\n\u003ctd\u003eRegister (Excel)\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--excel\"\u003eExcel\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e71\u003c\/td\u003e\n\u003ctd\u003eCl. 5.31\u003c\/td\u003e\n\u003ctd\u003eRegisters \u0026amp; Logs\u003c\/td\u003e\n\u003ctd\u003ePrivacy Legal and Regulatory Requirements Register\u003c\/td\u003e\n\u003ctd\u003eRegister (Excel)\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--excel\"\u003eExcel\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e72\u003c\/td\u003e\n\u003ctd\u003eCl. 6.3\u003c\/td\u003e\n\u003ctd\u003eRegisters \u0026amp; Logs\u003c\/td\u003e\n\u003ctd\u003ePrivacy Training and Awareness Register\u003c\/td\u003e\n\u003ctd\u003eRegister (Excel)\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--excel\"\u003eExcel\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e73\u003c\/td\u003e\n\u003ctd\u003e—\u003c\/td\u003e\n\u003ctd\u003eRegisters \u0026amp; Logs\u003c\/td\u003e\n\u003ctd\u003ePrivacy Regulation Cross-Reference Matrix\u003c\/td\u003e\n\u003ctd\u003eMatrix\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--excel\"\u003eExcel\u003c\/td\u003e\n\u003c\/tr\u003e\n          \u003ctr\u003e\n\u003ctd\u003e74\u003c\/td\u003e\n\u003ctd\u003e—\u003c\/td\u003e\n\u003ctd\u003eRegisters \u0026amp; Logs\u003c\/td\u003e\n\u003ctd\u003eGap Analysis and Implementation Workbook\u003c\/td\u003e\n\u003ctd\u003eWorkbook\u003c\/td\u003e\n\u003ctd class=\"ucs-desc__format ucs-desc__format--excel\"\u003eExcel\u003c\/td\u003e\n\u003c\/tr\u003e\n        \u003c\/tbody\u003e\n      \u003c\/table\u003e\n    \u003c\/div\u003e\n  \u003c\/section\u003e\n\n  \u003csection class=\"ucs-desc__section\"\u003e\n    \u003ch4 class=\"ucs-desc__section-title\"\u003eHow It Works\u003c\/h4\u003e\n    \u003cp class=\"ucs-desc__intro\"\u003eFrom Purchase to Implementation\u003c\/p\u003e\n    \u003col class=\"ucs-desc__steps\"\u003e\n      \u003cli\u003e\n\u003cstrong\u003eSelect Your Toolkit:\u003c\/strong\u003e Choose the ISO toolkit that fits your organisation and objectives.\u003c\/li\u003e\n      \u003cli\u003e\n\u003cstrong\u003ePurchase \u0026amp; Download:\u003c\/strong\u003e Complete checkout and receive instant access to all documents via email.\u003c\/li\u003e\n      \u003cli\u003e\n\u003cstrong\u003eCustomise:\u003c\/strong\u003e Edit the templates to match your services, sub-processors, processing locations and requirements.\u003c\/li\u003e\n      \u003cli\u003e\n\u003cstrong\u003eImplement:\u003c\/strong\u003e Follow the Manual and the gap workbook to deploy the system and start using it immediately.\u003c\/li\u003e\n    \u003c\/ol\u003e\n    \u003cp class=\"ucs-desc__note\"\u003e\u003cem\u003eMost organisations achieve full alignment and audit readiness within 4 weeks using our toolkits — compared to 3+ months when building documentation from scratch.\u003c\/em\u003e\u003c\/p\u003e\n  \u003c\/section\u003e\n\n  \u003csection class=\"ucs-desc__section\"\u003e\n    \u003ch4 class=\"ucs-desc__section-title\"\u003eWhy Buy from UCStoolkit\u003c\/h4\u003e\n    \u003cdiv class=\"ucs-desc__card-grid\"\u003e\n      \u003cdiv class=\"ucs-desc__card\"\u003e\n        \u003ch5\u003eReduce Implementation Time from 3 Months to 1 Month\u003c\/h5\u003e\n        \u003cp\u003eBuilding ISO documentation from scratch takes significant time, expertise, and resources. Our pre-built, clause-mapped toolkits eliminate the research, drafting, and formatting work — so your team can focus on customisation and go live fast. Most customers are audit-ready within 4 weeks of purchase.\u003c\/p\u003e\n      \u003c\/div\u003e\n      \u003cdiv class=\"ucs-desc__card\"\u003e\n        \u003ch5\u003eBuilt on the 2025 Third Edition — With the Annex Structure Verified\u003c\/h5\u003e\n        \u003cp\u003eMost cloud privacy documentation on the market still maps to the 2019 edition and the withdrawn ISO\/IEC 27002:2013 control set. Our toolkit is structured on the third edition throughout — the four ISO\/IEC 27002:2022 themes and all 25 Annex A extended controls. We also checked the annex structure against the published contents page rather than secondary summaries, several of which incorrectly describe Annex B as extended implementation guidance when it is in fact the correspondence table to the 2019 edition.\u003c\/p\u003e\n      \u003c\/div\u003e\n      \u003cdiv class=\"ucs-desc__card\"\u003e\n        \u003ch5\u003eAudit-Ready Documents — No Guesswork\u003c\/h5\u003e\n        \u003cp\u003eEvery document in our toolkits is structured with certification audits in mind. Content, terminology, and formatting are aligned directly to the relevant ISO standard’s clause requirements — reducing non-conformities, simplifying the audit process, and giving your team confidence when the assessor arrives.\u003c\/p\u003e\n      \u003c\/div\u003e\n      \u003cdiv class=\"ucs-desc__card\"\u003e\n        \u003ch5\u003eWritten for the Questions Customers Actually Ask\u003c\/h5\u003e\n        \u003cp\u003eWhere is our data, who else can reach it, can your staff read it, and can you prove a deletion reached the backups. The procedures answer those questions with step tables, named responsibilities, worked decisions and the common non-conformities raised in processor audits — not one-page outlines.\u003c\/p\u003e\n      \u003c\/div\u003e\n      \u003cdiv class=\"ucs-desc__card\"\u003e\n        \u003ch5\u003eThe Lowest Price on the Market — Guaranteed\u003c\/h5\u003e\n        \u003cp\u003eUCStoolkit offers the most complete, expert-built ISO documentation packages at the lowest price available anywhere. You get enterprise-grade documentation at a fraction of what an ISO consultant would charge. If you find a comparable toolkit at a lower price, we’ll match it.\u003c\/p\u003e\n      \u003c\/div\u003e\n    \u003c\/div\u003e\n  \u003c\/section\u003e\n\n  \u003csection class=\"ucs-desc__section\"\u003e\n    \u003ch4 class=\"ucs-desc__section-title\"\u003eNot Sure Yet? Talk to Us\u003c\/h4\u003e\n    \u003cp class=\"ucs-desc__intro\"\u003eNot ready to buy? No problem. Our team is happy to answer your questions, walk you through the toolkit, or help you decide if it’s the right fit for your organisation — no pressure, no sales pitch.\u003c\/p\u003e\n    \u003cp\u003e\u003cstrong\u003eSend Us a Message\u003c\/strong\u003e\u003c\/p\u003e\n    \u003cp\u003e📞 Melbourne: +61 460 766 472 | Dubai: +971 58 588 1553\u003c\/p\u003e\n    \u003cp\u003e📧 contact@ucstoolkit.store\u003c\/p\u003e\n    \u003cp\u003e⏱️ We respond within 24 hours\u003c\/p\u003e\n  \u003c\/section\u003e\n\n  \u003csection class=\"ucs-desc__section\"\u003e\n    \u003ch4 class=\"ucs-desc__section-title\"\u003eFrequently Asked Questions\u003c\/h4\u003e\n    \u003cdiv class=\"ucs-desc__faq\"\u003e\n      \u003cdiv class=\"ucs-desc__faq-item\"\u003e\n        \u003ch5 class=\"ucs-desc__faq-question\"\u003eWhat format are the documents in, and how are they delivered?\u003c\/h5\u003e\n        \u003cdiv class=\"ucs-desc__faq-answer\"\u003e\n          \u003cp\u003eAll documents are provided as fully editable MS Word (.docx) and MS Excel (.xlsx) files. After completing your purchase, you’ll receive an instant download link delivered directly to your email inbox — no waiting, no shipping.\u003c\/p\u003e\n        \u003c\/div\u003e\n      \u003c\/div\u003e\n      \u003cdiv class=\"ucs-desc__faq-item\"\u003e\n        \u003ch5 class=\"ucs-desc__faq-question\"\u003eCan I get certified to ISO\/IEC 27018?\u003c\/h5\u003e\n        \u003cdiv class=\"ucs-desc__faq-answer\"\u003e\n          \u003cp\u003eNot on its own. ISO\/IEC 27018 is a code of practice rather than a requirements standard, so there is no separate certificate. It is audited as an extension to the scope of an ISO\/IEC 27001 certification, and this toolkit is built to sit inside an existing ISO\/IEC 27001 management system rather than alongside it. If you are not yet certified to ISO\/IEC 27001, pair this toolkit with our ISO 27001 package.\u003c\/p\u003e\n        \u003c\/div\u003e\n      \u003c\/div\u003e\n      \u003cdiv class=\"ucs-desc__faq-item\"\u003e\n        \u003ch5 class=\"ucs-desc__faq-question\"\u003eWhat changed in the 2025 third edition?\u003c\/h5\u003e\n        \u003cdiv class=\"ucs-desc__faq-answer\"\u003e\n          \u003cp\u003eThe structure. The text moved from the fourteen-clause layout of the 2019 edition to the four themes and 93 controls of ISO\/IEC 27002:2022. The Annex A public cloud PII processor extended control set is retained with its 25 controls, and a correspondence table to the 2019 edition has been added as Annex B. Note that several third-party summaries describe Annex B as extended implementation guidance — it is not, and our toolkit is built on the published structure.\u003c\/p\u003e\n        \u003c\/div\u003e\n      \u003c\/div\u003e\n      \u003cdiv class=\"ucs-desc__faq-item\"\u003e\n        \u003ch5 class=\"ucs-desc__faq-question\"\u003eWe already hold ISO\/IEC 27001. What does this add?\u003c\/h5\u003e\n        \u003cdiv class=\"ucs-desc__faq-answer\"\u003e\n          \u003cp\u003eISO\/IEC 27001 asks whether information is protected. ISO\/IEC 27018 asks whether you process personal data only on your customer’s instruction, whether you disclose where it is held and who else touches it, whether you can prove nobody browsed it, and whether you can demonstrate it was deleted. The Annex A extended control set covers exactly the ground a 27001 certificate does not — and it is what enterprise customers and their regulators ask about.\u003c\/p\u003e\n        \u003c\/div\u003e\n      \u003c\/div\u003e\n      \u003cdiv class=\"ucs-desc__faq-item\"\u003e\n        \u003ch5 class=\"ucs-desc__faq-question\"\u003eHow long does it take to implement a toolkit?\u003c\/h5\u003e\n        \u003cdiv class=\"ucs-desc__faq-answer\"\u003e\n          \u003cp\u003eMost organisations can customise and deploy a full toolkit within 3–4 weeks. This is a significant reduction compared to building documentation from scratch, which typically takes 3 months or more. The bulk of the effort sits in populating the registers rather than editing the documents.\u003c\/p\u003e\n        \u003c\/div\u003e\n      \u003c\/div\u003e\n      \u003cdiv class=\"ucs-desc__faq-item\"\u003e\n        \u003ch5 class=\"ucs-desc__faq-question\"\u003eWill these documents help us pass a certification audit?\u003c\/h5\u003e\n        \u003cdiv class=\"ucs-desc__faq-answer\"\u003e\n          \u003cp\u003eYes. Every document is structured to meet the clause requirements of its respective ISO standard and is designed to hold up under third-party assessment. Our customers consistently report fewer non-conformities and a smoother audit experience.\u003c\/p\u003e\n        \u003c\/div\u003e\n      \u003c\/div\u003e\n      \u003cdiv class=\"ucs-desc__faq-item\"\u003e\n        \u003ch5 class=\"ucs-desc__faq-question\"\u003eDoes the toolkit apply if we are a SaaS company rather than an infrastructure provider?\u003c\/h5\u003e\n        \u003cdiv class=\"ucs-desc__faq-answer\"\u003e\n          \u003cp\u003eYes. The standard addresses any organisation processing personal data in a public cloud on behalf of a customer, whatever layer you operate at. Where a control is delivered by your infrastructure provider rather than by you, the toolkit shows you how to verify and evidence that through the sub-processor procedures rather than how to implement it yourself.\u003c\/p\u003e\n        \u003c\/div\u003e\n      \u003c\/div\u003e\n      \u003cdiv class=\"ucs-desc__faq-item\"\u003e\n        \u003ch5 class=\"ucs-desc__faq-question\"\u003eDoes the toolkit cover GDPR and other privacy laws?\u003c\/h5\u003e\n        \u003cdiv class=\"ucs-desc__faq-answer\"\u003e\n          \u003cp\u003eIt is built around ISO\/IEC 27018:2025 and includes a cross-reference matrix mapping requirement themes to GDPR, UAE PDPL, KSA PDPL, Qatar PDPPL, Singapore PDPA, Brazil LGPD and India DPDP, alongside a legal requirements register. Statutory references are bracketed for you to verify against current law in your jurisdictions. The toolkit is not legal advice.\u003c\/p\u003e\n        \u003c\/div\u003e\n      \u003c\/div\u003e\n      \u003cdiv class=\"ucs-desc__faq-item\"\u003e\n        \u003ch5 class=\"ucs-desc__faq-question\"\u003eCan we edit the templates to suit our organisation?\u003c\/h5\u003e\n        \u003cdiv class=\"ucs-desc__faq-answer\"\u003e\n          \u003cp\u003eAbsolutely. All documents are fully editable and built to be customised to your organisation’s specific context, processes, and terminology. The toolkit gives you the professional framework — you tailor the details.\u003c\/p\u003e\n        \u003c\/div\u003e\n      \u003c\/div\u003e\n      \u003cdiv class=\"ucs-desc__faq-item\"\u003e\n        \u003ch5 class=\"ucs-desc__faq-question\"\u003eDoes the toolkit include a copy of the ISO standard itself?\u003c\/h5\u003e\n        \u003cdiv class=\"ucs-desc__faq-answer\"\u003e\n          \u003cp\u003eNo. ISO standards are protected by copyright and must be purchased separately from ISO or your national standards body. Our documents map to the published clause and control numbering of ISO\/IEC 27018:2025, but the guidance text itself sits only in the standard. Organisations pursuing certification will need a licensed copy in any event.\u003c\/p\u003e\n        \u003c\/div\u003e\n      \u003c\/div\u003e\n      \u003cdiv class=\"ucs-desc__faq-item\"\u003e\n        \u003ch5 class=\"ucs-desc__faq-question\"\u003eAre the toolkits up to date with the current versions of the standards?\u003c\/h5\u003e\n        \u003cdiv class=\"ucs-desc__faq-answer\"\u003e\n          \u003cp\u003eYes. We monitor changes to international standards and update our toolkits accordingly, so you’re always working with accurate, current documentation recognised by accrediting bodies worldwide.\u003c\/p\u003e\n        \u003c\/div\u003e\n      \u003c\/div\u003e\n      \u003cdiv class=\"ucs-desc__faq-item\"\u003e\n        \u003ch5 class=\"ucs-desc__faq-question\"\u003eAre the documents compatible with standard software?\u003c\/h5\u003e\n        \u003cdiv class=\"ucs-desc__faq-answer\"\u003e\n          \u003cp\u003eYes. All documents are created in Microsoft Office (Word and Excel), ensuring compatibility with the latest versions of both applications. No specialist software is required.\u003c\/p\u003e\n        \u003c\/div\u003e\n      \u003c\/div\u003e\n      \u003cdiv class=\"ucs-desc__faq-item\"\u003e\n        \u003ch5 class=\"ucs-desc__faq-question\"\u003eWhat support is included after purchase?\u003c\/h5\u003e\n        \u003cdiv class=\"ucs-desc__faq-answer\"\u003e\n          \u003cp\u003eEvery purchase includes lifetime unlimited email support from our ISO-certified consultants. There is no time limit and no cap on questions — we support you through implementation and beyond.\u003c\/p\u003e\n        \u003c\/div\u003e\n      \u003c\/div\u003e\n      \u003cdiv class=\"ucs-desc__faq-item\"\u003e\n        \u003ch5 class=\"ucs-desc__faq-question\"\u003eCan I request a custom toolkit or a standard that isn’t listed?\u003c\/h5\u003e\n        \u003cdiv class=\"ucs-desc__faq-answer\"\u003e\n          \u003cp\u003eYes. We can build custom ISO documentation toolkits and training materials on request. Contact us with your requirements and our team will respond within 24 hours.\u003c\/p\u003e\n        \u003c\/div\u003e\n      \u003c\/div\u003e\n    \u003c\/div\u003e\n  \u003c\/section\u003e\n\u003c\/div\u003e","brand":"ucstoolkit","offers":[{"title":"Default Title","offer_id":50552082268230,"sku":"DTISO27018","price":499.0,"currency_code":"USD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0556\/8584\/0966\/files\/ISO_IEC_27018_2025_Cloud_Privacy_Toolkit.png?v=1791021235","url":"https:\/\/ucstoolkit.store\/products\/iso-27018-toolkit","provider":"ucstoolkit","version":"1.0","type":"link"}