ISO 27018 AWS: What Singapore Businesses Must Know

Why ISO 27018 and AWS Matter for Singapore Organisations

Cloud adoption has accelerated sharply across Singapore’s commercial and industrial sectors. Many organisations now store employee records, incident reports, risk assessments, and operational data on Amazon Web Services (AWS). What fewer organisations fully appreciate is how ISO 27018 — the international code of practice for protection of personally identifiable information (PII) in public cloud services — directly intersects with their compliance obligations under Singapore law.

AWS holds ISO 27018 certification, meaning the platform itself meets the standard’s requirements for a cloud service provider processing PII on behalf of customers. However, certification on AWS’s side does not automatically make your organisation compliant. The Personal Data Protection Act (PDPA) and workplace safety data obligations under the Workplace Safety and Health (WSH) Act (Cap. 354A) place clear accountability on the data controller — that is, your organisation — not the cloud vendor.

For companies operating under bizSAFE levels or pursuing ISO 45001 certification, the storage and processing of WSH records on cloud platforms introduces a layer of data governance that must be actively managed. Understanding where ISO 27018 and AWS fit into your broader compliance framework is not optional; it is a practical necessity.

Understanding ISO 27018 in the Context of Singapore Regulations

ISO 27018 is built on top of ISO 27001 and ISO 27002, extending their controls specifically to PII processed in cloud environments. When your organisation uses AWS to store data — whether HR records, workplace injury reports submitted to the Ministry of Manpower (MOM), or risk assessment documentation required under the WSH (Risk Management) Regulations 2006 — that data is subject to both the PDPA and, where applicable, sector-specific MOM requirements.

The Workplace Safety and Health Council (WSHC) expects organisations to maintain accurate and secure records of risk assessments, incident investigations, and safety audits. When these records reside on AWS, ISO 27018 provides the technical and organisational controls framework to ensure PII within those records is handled lawfully, transparently, and securely.

Key principles of ISO 27018 that align with Singapore’s regulatory expectations include:

• Consent and purpose limitation: PII collected for WSH purposes must not be used beyond those purposes — consistent with PDPA obligations.
• Transparency: Employees must be informed about how their personal data is stored and processed on cloud platforms.
• Data minimisation: Only the PII necessary for compliance with MOM reporting or internal risk management should be stored.
• Sub-processor accountability: If AWS uses sub-processors in its infrastructure, your organisation must be aware of and accept those arrangements under your data processing agreements.
• Breach notification: ISO 27018 requires cloud providers to notify customers of breaches; your organisation must then meet PDPA mandatory breach notification timelines to the Personal Data Protection Commission (PDPC).

AWS’s ISO 27018 certification is independently audited and publicly verifiable through AWS’s compliance portal. Organisations should request and retain the relevant AWS certification documents as part of their own audit trail, particularly when undergoing bizSAFE Star or ISO 45001 assessments.

Practical Steps: Building ISO 27018 AWS Compliance Into Your WSH Framework

Achieving meaningful compliance requires deliberate action on your organisation’s side. The following checklist is designed for Singapore businesses using AWS to store or process WSH-related or HR data.

• Review your Data Processing Agreement (DPA) with AWS: AWS provides a standard DPA that references ISO 27018 obligations. Ensure your legal or compliance team has reviewed and accepted this agreement. Retain a signed copy for audit purposes.
• Conduct a Data Inventory: Map all PII stored on AWS, including employee injury records, medical surveillance data, and risk assessment outputs required under the WSH (Risk Management) Regulations. Classify data by sensitivity level.
• Implement AWS Identity and Access Management (IAM) controls: Restrict access to PII on AWS to authorised personnel only. Role-based access controls align directly with ISO 27018’s access limitation requirements and support your WSH record integrity obligations.
• Enable AWS CloudTrail and logging: Audit logs are essential for demonstrating compliance to MOM inspectors, WSHC auditors, or PDPC investigators. CloudTrail records all API activity, providing the evidentiary trail ISO 27018 requires.
• Establish a breach response procedure: Define internal escalation steps if AWS notifies you of a security incident. Your procedure must align with PDPA’s mandatory notification requirement of three calendar days for notifiable data breaches.
• Train relevant staff: Employees who upload, access, or manage WSH records on AWS must understand their data protection obligations under the PDPA and your organisation’s ISO 27018-aligned policies.
• Integrate cloud data governance into your Risk Management process: Under the WSH (Risk Management) Regulations, risk assessments must account for all foreseeable hazards. Data breaches involving employee PII stored on cloud platforms constitute an operational risk that should appear in your risk register.
• Verify AWS’s current certification status: ISO 27018 certifications are subject to periodic renewal. Check AWS’s compliance page annually to confirm the certification remains valid before relying on it in your own compliance documentation.

Common Questions from Singapore Businesses

Q: If AWS is ISO 27018 certified, does that mean our organisation is automatically compliant with Singapore’s PDPA?

No. AWS’s ISO 27018 certification covers the cloud infrastructure and the controls AWS applies as a data processor. Your organisation, as the data controller, remains responsible for how you collect, use, and manage PII. PDPA compliance requires your organisation to have its own data protection policies, appoint a Data Protection Officer where required, conduct data protection impact assessments for high-risk processing activities, and respond appropriately to data subject requests. AWS’s certification is a supporting factor, not a substitute for your own obligations.

Q: Are WSH incident records stored on AWS considered PII under the PDPA?

Yes, in most cases. Workplace incident reports typically contain an injured employee’s name, NRIC number, employment details, medical information, and circumstances of the incident. All of these constitute personal data under the PDPA. When stored on AWS, they must be protected in accordance with the PDPA’s Protection Obligation, which requires reasonable security arrangements. Aligning your AWS configuration with ISO 27018 controls is a practical and defensible way to demonstrate that reasonable security has been applied. MOM also requires that WSH records be maintained accurately and securely, so proper cloud governance serves dual regulatory purposes.

Take the Next Step With Sage Shield Safety Consultants

Navigating the intersection of ISO 27018, AWS cloud infrastructure, MOM regulatory requirements, and PDPA obligations is complex. Sage Shield Safety Consultants works with Singapore businesses to integrate data governance into their WSH and bizSAFE frameworks, ensuring that cloud-stored records meet both safety and data protection standards. Whether you are preparing for a bizSAFE Star audit, pursuing ISO 45001 certification, or simply seeking to strengthen your organisation’s compliance posture, our consultants provide practical, regulation-grounded guidance tailored to your industry. Book a free consultation today at sageshield.com/contact and let us help you build a compliant, resilient cloud data management approach that satisfies Singapore’s regulatory expectations.

For the full requirements, scope and certification pathway, see our ISO 27018 Singapore guide.