ISO/IEC 27018:2025
Annex A – Public cloud PII processor extended control set – ISO/IEC 27018:2025

ISO/IEC 27018:2025 A.12.1: Geographical location of PII

What does A.12.1 require?

The processor states and documents the countries where PII may be stored. 2019 guidance, not confirmed for this edition: countries from sub-contracted processing included, transfer arrangements named, and customers told in good time of changes so they can object or terminate.

Maintained by Gerard Blokdyk

Other controls in Annex A – Public cloud PII processor extended control set – ISO/IEC 27018:2025

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.