Overview
ISO/IEC 19944-2:2022 - "Cloud computing and distributed platforms - Data flow, data categories and data use - Part 2: Guidance on application and extensibility" is the guidance companion to ISO/IEC 19944-1. It helps organizations apply the standardized data taxonomy, data processing and data use statements defined in Part 1 to real-world cloud and distributed platform scenarios, and explains how to develop safe, consistent extensions to that taxonomy.
Key topics
- Application guidance: Practical examples showing how to map real datasets and services (e.g., eCommerce, privacy, organization-identifiable data, AI, IoT, EVs) to the ISO/IEC 19944-1 taxonomy.
- Data flow and categories: Advice on identifying and labeling flows between devices and cloud services, and assigning categories such as customer content, PII (personally identifiable information), organizational protected data.
- Data use statements and qualifiers: How to describe purposes, scopes and de-identification qualifiers (identified, anonymized, aggregated) to improve transparency about data use.
- Extensibility: Guidelines for extending the standard’s elements - data categories, custom data facets, data processing and data use categories - with examples (e.g., extending demographic or financial sub-types, adding AI/IoT-specific categories).
- Data facets and policy: Use of facets to express additional attributes (control, provenance, sharing/locational constraints) that inform policy enforcement and stakeholder communications.
- Domain examples: Concrete scenarios for privacy-centric AI (facial recognition), IP-centric automotive AI/IoT, and other implementations to illustrate best practices.
Applications and who should use it
ISO/IEC 19944-2 is aimed at practitioners and decision-makers who need to classify, govern and communicate data uses in cloud or distributed systems:
- Cloud service providers (CSPs) and cloud service customers (CSCs) for consistent data use disclosure and contract alignment.
- Cloud architects and engineers designing data flows, de-identification, and processing controls.
- Privacy and compliance officers mapping data categories to regulatory obligations (PII handling, data residency).
- AI and IoT system designers who need to extend taxonomy for domain-specific data types and processing.
- Standards developers and policy makers seeking repeatable extension patterns and example use statements.
Practical benefits include improved transparency, consistent data use statements, clearer policy application across services, and better alignment with legal and stakeholder expectations.
Related standards
Keywords: ISO/IEC 19944-2:2022, cloud computing, data taxonomy, data flow, data use statements, extensibility, PII, IoT, AI, CSP, CSC.