A public cloud provider wants to demonstrate its commitment to data privacy.

ISO/IEC 27018 is the international code of practice specifically developed to govern the protection of personally identifiable information (PII) processed by public cloud service providers, establishing controls and guidelines aimed directly at cloud-specific privacy obligations, which makes it the most precisely applicable standard for a public cloud provider seeking to demonstrate privacy commitment and support adherence to privacy laws such as CCPA. Its scope is deliberately narrower and more specialized than general information security standards, focusing on the unique privacy risks inherent to multi-tenant, provider-managed cloud environments. GDPR (A) is itself a regulation, specifically the European Union's data protection law, rather than a voluntary code of practice or certifiable standard that a provider 'adopts'; while GDPR compliance is important, it is not the type of code-of-practice framework the question is asking about, and it is a distinct legal regime from CCPA, not a code of practice that supports adherence to CCPA specifically. ISO 27007 (B) provides guidelines for auditing information security management systems, a process-oriented standard unrelated to privacy or PII protection directly. ISO 27001 (D) is the foundational standard for establishing an information security management system generally, covering broad security risk management rather than the cloud-specific PII privacy controls that ISO 27018 was purpose-built to address. ISO 27018 is correct.

Reference topic: Cloud-based Data Protection - Privacy Standards for Public Cloud (ISO/IEC 27018).