Checklist: ISO 27018 Requirements for Platforms Handling Customer or Patient Data

Platforms that handle customer or patient data need more than basic cloud security. They need clear privacy controls, strong evidence, and a simple way to prove how personal data is protected in the cloud.

ISO/IEC 27018 gives guidance for protecting personally identifiable information, or PII, in public cloud services when the cloud provider acts as a PII processor. The current ISO/IEC 27018:2025 edition is designed around PII protection in public cloud environments and is based on ISO/IEC 27002:2022 guidance.

Introduction

Customer and patient data changes the security conversation.

A normal SaaS platform may already need strong access control, logging, vendor management, and incident response.

But once the platform handles sensitive personal information, healthcare records, appointment details, claims data, intake forms, support tickets, uploaded documents, or patient identifiers, the bar gets higher.

• Buyers want proof.
• Healthcare clients want confidence.
• Auditors want evidence.
• Privacy teams want clear responsibility.
• Regulators expect personal data to be handled with care.

ISO 27018 helps cloud platforms organize privacy controls for personal data processed in public cloud environments. It does not replace privacy law. It does not replace healthcare compliance. It helps create a practical control structure that supports trust, contracts, audits, and customer due diligence.

This checklist is written for SaaS, healthtech, medtech, patient portals, cloud platforms, and service providers that handle customer or patient data.

Why ISO 27018 Matters for Customer and Patient Data

ISO 27018 matters because cloud privacy is not only about where data is stored.

It is about how data is collected, used, accessed, retained, deleted, disclosed, monitored, and protected. For platforms handling customer or patient data, the hard questions usually sound like this:

• Who can access patient records?
• Where is customer data stored?
• Which vendors process personal data?
• How is data deleted when a customer leaves?
• Are support staff access actions logged?
• Can administrators export sensitive data?
• How are privacy incidents handled?
• Are sub-processors reviewed?
• Can the platform prove encryption is enabled?
• Are backups covered by retention and deletion rules?

Common High-Risk Data Types

The ISO 27018 Readiness Checklist

Use this checklist before a customer review, ISO audit, healthcare vendor assessment, privacy review, or security questionnaire.

1. Define the Personal Data in Scope

Start with a clear data inventory.

Do not write policies first. First, understand what personal data your platform actually processes.

What to Check

2. Confirm Privacy Roles and Responsibilities

ISO 27018 readiness depends on role clarity.

Your team needs to know whether your platform acts as a processor, sub-processor, service provider, or controller in each context.

This is especially important for patient data because one platform may support clinics, employers, insurers, labs, healthcare providers, or other SaaS companies.

Privacy Responsibility Table

Evidence auditors and buyers like:

• role and responsibility matrix
• data processing agreement
• sub-processor list
• privacy escalation process
• security ownership map
• vendor owner register

3. Limit Processing to Approved Purposes

Customer and patient data should not be used casually.

Your platform should define why data is processed and make sure internal teams do not use it outside those approved purposes.

Strong evidence includes:

• data processing purpose register
• privacy review for new features
• support access procedure
• test data policy
• approval record for new data uses
• customer-facing privacy terms

4. Keep Customer and Patient Data Separated

For SaaS and health platforms, data separation is a trust issue.

Customers want confidence that one client cannot access another client’s records. Patients expect their data to be protected from unauthorized viewing.

5. Enforce Strong Access Control

Access control is one of the highest-impact parts of ISO 27018 readiness.

If staff, contractors, developers, or vendors can access customer or patient data too easily, trust breaks quickly.

Access Control Checklist

6. Encrypt Data in Storage, Transit, and Backups

Encryption is expected. But saying “we use encryption” is not enough.

You need to prove where encryption is enabled and how keys are managed.

Encryption Evidence Table

7. Control Data Retention and Deletion

Retention and deletion are where many platforms fail privacy reviews.

Customer or patient data may be deleted from the application but still remain in logs, backups, exports, support tickets, or analytics tools.

Retention and Deletion Checklist

8. Manage Sub-Processors and Vendors

Cloud platforms rarely process personal data alone.

They rely on hosting providers, email services, analytics tools, monitoring platforms, ticketing systems, payment processors, identity tools, and support vendors.

For patient data, this becomes even more sensitive.

Vendor Checklist

9. Log Access and Monitor Activity

For platforms handling customer or patient data, logging is not optional.

You need to know what happened, when it happened, who did it, and whether anything looked suspicious.

Logging Checklist

Evidence auditors trust:

• log source inventory
• retention settings
• sample audit log
• monthly log review
• alert-to-ticket sample
• incident escalation record
• access review sign-off

10. Make Privacy Incidents Reportable and Traceable

Privacy incidents need clear handling.

A privacy incident may involve unauthorized access, accidental disclosure, wrong-recipient email, exposed storage, lost device, vendor incident, excessive access, or data sent to the wrong customer.

Incident Response Checklist

11. Support Data Subject and Customer Requests

Platforms handling personal data need a way to support privacy requests.

Depending on contracts and laws, this may include access, correction, deletion, export, restriction, or investigation support.

Your platform may not respond directly to the individual if your customer is the controller. But you still need a process to support your customer.

Request Support Checklist

Evidence to keep:

• request workflow
• sample ticket
• response timeline
• approval record
• export or deletion proof
• customer communication sample

12. Protect Support, Admin, and Engineering Workflows

Many privacy failures happen outside the main product.

Support teams use tickets. Engineers use logs. Admins use dashboards. Customer success teams view account records. Developers troubleshoot production issues.

These workflows need controls.

Operational Privacy Checklist

13. Prove Privacy by Design in Product Changes

Privacy should not be reviewed only after launch.

New features can introduce new data collection, new integrations, new analytics, new exports, or new AI processing.

Product Change Checklist

Strong evidence includes:

• privacy impact review
• secure design review
• change approval
• data flow update
• release record
• customer notice update

ISO 27018 Evidence Pack

A good ISO 27018 evidence pack should be simple, current, and easy to defend.

Recommended Evidence Pack Structure

Common Mistakes to Avoid

• Mistake 1: Treating ISO 27018 like a policy checklist. Policies help, but buyers want proof that privacy controls actually operate.
• Mistake 2: Forgetting support tickets and logs. Customer and patient data often appears in tickets, logs, screenshots, and exports.
• Mistake 3: Assuming the cloud provider covers everything. Cloud provider assurance does not prove your access controls, deletion process, tenant model, or support workflows are working.
• Mistake 4: Weak sub-processor tracking. If a vendor processes personal or patient data, it needs ownership, review, approval, and monitoring.
• Mistake 5: No deletion evidence. Many platforms say data can be deleted but cannot prove the deletion path across systems.
• Mistake 6: Logging without review. Logs are weak evidence if nobody reviews them or turns alerts into action.
• Mistake 7: Using real patient data in testing. This creates avoidable risk and is hard to defend during privacy reviews.
• Mistake 8: No privacy incident rehearsal. A plan that has never been tested often fails under pressure.

What Buyers and Auditors Usually Want to See

For platforms handling customer or patient data, buyers and auditors usually want proof that:

• personal data is inventoried
• patient data is identified and protected
• sub-processors are known
• access is limited and reviewed
• encryption is enabled
• logs are collected and reviewed
• deletion is controlled
• support access is monitored
• privacy incidents are handled quickly
• contracts define responsibilities
• evidence is current and retrievable

Canadian Cyber’s Take

At Canadian Cyber, we often see platforms with strong technical teams but weak privacy evidence.

The product may be secure. The cloud may be well configured. The team may care deeply about patient or customer trust.

But when a healthcare client, enterprise buyer, auditor, or privacy reviewer asks for proof, the evidence is scattered.

That creates friction.

The strongest platforms can show what data they process, where it lives, who can access it, which vendors support it, how it is protected, how it is deleted, and how incidents are handled. That is what turns privacy from a sales blocker into a trust advantage.

Takeaway

ISO 27018 is valuable for platforms that handle customer or patient data because it gives cloud privacy work a practical structure.

Start with your data inventory. Then:

• map privacy roles
• limit processing
• review access
• protect tenant separation
• encrypt sensitive data
• control retention and deletion
• manage sub-processors
• log access
• test privacy incident response
• support customer requests
• build privacy review into product changes

Stay Connected With Canadian Cyber

Follow Canadian Cyber for practical guidance on ISO 27018, cloud privacy, SaaS security, healthcare data protection, audit readiness, and vCISO support.