Cloud Privacy Protection (ISO/IEC 27018) Fundamentals Training
A one-day fundamentals programme on ISO/IEC 27018. Learn how public cloud providers acting as processors protect customers' personal information. Participants work through practical examples and a guided case before drafting actions for their own organisation.
Who should attend: Cloud service owners, DPOs, privacy, procurement, compliance and IT teams. No prior framework knowledge is required.
HRD Corp claim support available
Programme Agenda
9:00 AM to 10:00 AM
Cloud Privacy and Processor Roles
Introduce ISO/IEC 27018:2025 and PII processing in public clouds. Distinguish controller decisions, processor instructions and the cloud provider's responsibilities from broader security control guidance.
10:00 AM to 10:15 AM
Break
10:15 AM to 11:30 AM
Processing Purposes and Instructions
Map what personal data enters the service, who controls its use and which instructions apply. Identify secondary use and disclosure questions that need contractual clarity.
11:30 AM to 12:30 PM
Access, Disclosure and Transparency
Discuss authorised access, support personnel, subprocessors and requests for disclosure. Identify the information a customer needs to understand and supervise the processing arrangement.
12:30 PM to 1:30 PM
Lunch
1:30 PM to 2:45 PM
Retention, Return and Deletion
Follow information through storage, backup, support and service termination. Ask practical questions about deletion evidence, retention limits and what happens when a supplier changes.
2:45 PM to 3:00 PM
Break
3:00 PM to 4:00 PM
Incidents, Transfers and Assurance
Introduce processor incident communications and cross-border processing questions. Review supplier evidence with its service scope and legal limitations in mind.
4:00 PM to 5:00 PM
Practical Exercise: A Cloud HR Service
Map a fictional HR platform's personal data, suppliers and exit process. Identify privacy questions, select controls and draft a processor due diligence and follow-up checklist.
Key Outcomes
- Explain public-cloud processor privacy responsibilities
- Identify purpose, access and disclosure questions
- Plan retention and exit checks
- Draft a cloud privacy supplier review
Training Mode Physical / Online / Hybrid
HRD Corp Subject to programme eligibility and HRD Corp approval
Level Fundamentals / Beginner. No prior framework knowledge required.
Duration 1 Day | 9:00 AM to 5:00 PM (6.5 learning hours, excluding breaks)
Venue In-house at the client's premises, or delivered via the client's preferred platform (Microsoft Teams, Zoom, or equivalent)
Assessment Group case exercise and a 10-question knowledge check
Certificate Orbix Certificate of Completion upon full attendance; not a professional certification
Malaysia Relevance
Relevant to Malaysian cloud providers and teams buying cloud processing services. ISO/IEC 27018:2025 guidance supports processor safeguards while local privacy laws, contracts and transfer conditions still require separate checks.
Practical Takeaways
A public-cloud processor questionnaire and privacy exit checklist.
Download a sample practice worksheet (TXT). This fictional exercise is a preview of the learning approach. About Orbix; contact us to confirm the facilitator and relevant experience for your delivery.
Course Completion and Next Steps
Participants receive an Orbix Certificate of Completion upon full attendance. This introductory course does not confer professional certification or establish an organisation's compliance. Further implementation and assessment depend on the organisation's scope and obligations.
Frequently Asked Questions
Related Fundamentals Training
GDPR Fundamentals Data Privacy & Secure Information Handling Privacy Information Management (ISO/IEC 27701) Fundamentals Personal Data Protection (Malaysia PDPA) Fundamentals View all fundamentals programmes
Reference material: ISO: ISO/IEC 27018:2025.