How to Get ISO 27018 Certified for Cloud Services

To get ISO 27018 certified, a cloud provider documents how it protects the personal data it processes for customers, closes any gaps and has the result assessed. You can do that through the classic route with an on-site audit by a certification body, or through an online self-assessment such as the one Zertify offers.

The standard is aimed at providers that run public cloud services and handle personal data on behalf of their customers. If a purchasing department or a data protection officer has asked you for proof, this article shows what to prepare and in which order.

What ISO 27018 covers

ISO 27018 is a code of practice for the protection of personally identifiable information (PII) in public clouds. The 2025 edition builds on the security controls of ISO 27002 and adds controls that apply when you act as a PII processor. The official description is on the ISO page for ISO 27018.

The central idea is simple. Your customer decides why and how personal data is used. You process it on their instructions and nothing else. The standard turns that idea into concrete controls.

In practice, the controls cover topics like these:

• Processing only on the customer's instructions, with no use of the data for your own marketing or advertising unless the customer has expressly agreed.
• Help for the customer when a data subject asks for access, correction or deletion.
• Notice to the customer when a government body or court asks you to hand over data, unless the law forbids it.
• A list of the countries where data may be stored and of the subcontractors that may touch it.
• Return, transfer or secure deletion of the data when the contract ends.
• Encryption of personal data that travels over public networks.
• Staff who are bound by confidentiality and trained in handling personal data.
• Prompt notification of the customer after a breach that affects their data.

The standard does not replace data protection law. A Swiss provider still answers to the revised Federal Act on Data Protection, a provider with EU customers also to the GDPR. ISO 27018 gives you a structured, checkable way to show that your practices match what those laws expect from a processor.

Does your business need it?

You are the target group if you offer software as a service, hosting, storage, backup, a platform or an API in a public cloud, and your customers upload personal data into it. That includes customer lists, employee records, patient data, support tickets and log files with user identifiers.

A company that only uses cloud services for its own data is a customer, not a provider. For that company ISO 27001 is usually the better fit. ISO 27018 becomes relevant at the moment your customers start asking in tender documents or supplier questionnaires how you protect their data inside your service.

Smaller providers often wonder whether this is meant for them. It is. The controls scale with the amount of personal data you handle. A ten-person SaaS company with one product and two subcontractors has a short list of processes to document. Our guide on ISO certification for small and medium businesses explains how the ISO family works for companies of that size.

How to prepare, step by step

1. Map where personal data lives

List every service component that stores or touches customer personal data: databases, object storage, backups, logs, monitoring tools, support systems. Note the region where each one runs. Most gaps appear here, because logs and backups are forgotten.

2. Name your subcontractors

Write down every third party that can access customer data, including your own infrastructure provider and any support tool. For each one, record the country, the purpose and the contract that binds them. Customers will want this list, and the standard expects you to be able to provide it.

3. Check your contracts

Your customer agreements and data processing agreements should state that you act on instructions, how you handle requests from authorities, how long you retain data and what happens at the end of the contract. If these points are missing or vague, fix the template before you start the assessment.

4. Define deletion and return

Decide how a customer gets their data back and how you delete it afterwards, including from backups and from temporary files. Write the steps down and test them once with a real account.

5. Cover security basics

Access control, encryption in transit and at rest, logging, patching and a breach response plan must exist and be written down. If you already work to ISO 27001, most of this is in place. If not, a short written policy for each point is enough to begin with, as long as it describes what you actually do.

6. Train your staff

Everyone who can reach customer data needs to know the rules: instructions only, no private copies, report incidents at once. Keep a record of who was trained and when.

Checklist before you apply

• Inventory of all systems that store or process customer personal data, with regions
• List of subcontractors with country, purpose and contract
• Customer contract or data processing agreement covering instructions, authority requests, retention and exit
• Written statement that customer data is not used for your own marketing
• Procedure for access, correction and deletion requests passed on from customers
• Tested process for returning and deleting customer data at contract end
• Encryption for personal data in transit over public networks
• Breach notification procedure with a named person responsible
• Confidentiality commitments and training records for staff with data access
• One named owner for privacy topics inside the company

If you can tick most of these, the assessment itself will not hold surprises.

Two routes to the certificate

The classic route. A certification body audits your organisation on site, usually in two stages, and issues the certificate if you pass. This route suits providers whose customers explicitly require it, for example in regulated sectors. It takes weeks to months to arrange, and the price depends on the body and the size of your operation. Our overview of what ISO certification costs breaks down the factors.

The online route. You answer a structured self-assessment about your practices and provide the evidence the questions ask for. Nobody visits your office. This is the route Zertify offers, and it fits providers whose customers want a documented, verifiable statement of conformity without a project of several months.

Which one you need depends on who is asking. Read the clause in the tender or supplier questionnaire. If it asks for a certificate to ISO 27018, the online route can answer it. If it names a specific kind of audit, ask the customer what they accept before you decide.

How Zertify fits in

Zertify issues the ISO 27018 certificate on the basis of an online self-assessment. There is no on-site audit. The certificate is issued by Zertify under licence from SICE (Swiss Institute of Certification and Education), and a member of the SICE Certification Board reviews every assessment before the certificate is released.

After you pass the assessment and pay, the certificate arrives within 4 hours as a PDF. It carries a QR code that leads to a public verification page, so a customer or auditor can check it without writing to you. It is valid for three years. Each year you confirm it with a short online re-audit, which is part of a yearly subscription. The pricing page shows the current plans.

One point about expectations. The assessment asks for real answers. If your deletion process exists only in your head, the questions will show it. Use the checklist above, close the gaps, then start the assessment. Our article on certification without an audit explains what an assessment-based certificate is and where it fits.

What to do with the certificate

A certificate only helps if buyers see it at the right moment.

• Attach the PDF to your answers in supplier questionnaires and tenders.
• Put the verification link on your security or trust page, next to your list of subcontractors.
• Mention the certificate in your data processing agreement as evidence of your controls.
• Give your sales team the one-sentence answer to "Do you protect our users' personal data in your cloud?"

Keep the underlying documents current. The yearly re-audit asks whether anything changed, for example a new subcontractor or a new storage region. Update your lists when it happens, not a week before the re-audit.

Common mistakes

The most frequent one is treating the standard as a privacy policy for your website. ISO 27018 concerns the data you process for customers, not the data of your own website visitors. The two can overlap, but the standard looks at your service.

The second is an incomplete subcontractor list. A support tool that receives screenshots with personal data counts as a subcontractor.

The third is promising deletion without a tested process. Backups, replicas and log archives keep data alive long after a customer clicks delete. Decide how long they persist and tell the customer.

The fourth is confusing ISO 27018 with ISO 27001. The first protects personal data inside a cloud service. The second covers information security management for the whole organisation. Many providers hold both over time, but you can begin with the one your customers ask for.