ISO 270187 min read
ISO 27018 and GDPR: what it covers and what it does not
ISO 27018 does not make a cloud provider GDPR compliant. It does cover many processor duties that customers ask about. Here is the overlap and the gaps.
By Fabio Sestito, Managing Director SICE, expert and auditor for ISO 27001, 9001 and 20000-1
ISO 27018 does not make you GDPR compliant. It is a code of practice for protecting personal data in public cloud services, and it covers many of the duties the GDPR places on a processor. If you host or process personal data on behalf of customers, it is a recognised way to show how you handle that data.
The difference matters in practice. A customer who asks whether you are GDPR compliant wants a legal answer. A certificate can support that answer, but it cannot replace it.
What ISO 27018 requires
ISO 27018 applies to providers of public cloud services that act as processors of personal data. It extends the security controls of ISO 27002 with controls specific to personal data, and it builds on the privacy principles of ISO 29100. The official ISO page lists the current edition and its scope. The 2025 edition is the one Zertify assesses against.
The controls cover topics a processor deals with every week:
- processing personal data only on the customer's instructions
- no use of customer data for marketing or advertising without the customer's express consent
- telling the customer which sub-processors and which countries are involved
- notifying the customer of a data breach
- returning or securely deleting data at the end of the contract
- confidentiality commitments from staff who can access the data
None of this is exotic. Most of it already appears in a decent data processing agreement. The standard asks you to turn those promises into documented, repeatable practice.
Where ISO 27018 and the GDPR overlap
The GDPR sets out processor duties mainly in Article 28 and Article 32. ISO 27018 addresses most of the same ground from an operational side.
| GDPR requirement | What ISO 27018 contributes |
|---|---|
| Article 28(3)(a): process only on documented instructions | Controls on processing according to customer instructions and on the use of data for marketing |
| Article 28(3)(b): confidentiality of authorised persons | Confidentiality agreements and training for personnel |
| Articles 28(2) and 28(4): sub-processors | Disclosure of sub-processors to the customer |
| Article 28(3)(g): deletion or return after the service ends | Rules for return, transfer and secure disposal of data |
| Article 32: security of processing | Information security controls drawn from ISO 27002 |
| Article 33(2): processor informs controller of a breach | Incident handling and notification to the customer |
| Chapter V: transfers to third countries | Disclosure of the countries where data may be stored |
The overlap is real, but it is not one to one. The standard is written for cloud providers, and the GDPR is written for everyone who processes personal data of people in the EU.
What ISO 27018 does not cover
The GDPR is a law with fines and supervisory authorities. ISO 27018 is a voluntary standard. Several things sit outside it.
Your role as a controller. If you also decide why and how personal data is used, for example your own customer list or your own employees, the controller duties apply to you. These include a lawful basis, information notices, data subject rights and records of processing under Article 30. ISO 27018 is aimed at the processor role.
A legal assessment of data transfers. The standard asks you to be transparent about where data goes. It does not decide whether a transfer to a given country is lawful. That remains a legal question.
Official GDPR certification. Article 42 of the GDPR provides for approved certification mechanisms. An ISO 27018 certificate is not one of those, and nobody should present it as proof of compliance. Describe it as evidence that you have implemented a recognised set of controls for personal data in the cloud.
Switzerland, Germany, Austria and France
Germany, Austria and France apply the GDPR directly, with national supplements. Switzerland has its own Federal Act on Data Protection, which has applied since 1 September 2023. The structure is similar: a processor must keep to the controller's instructions, secure the data and engage sub-processors only with approval.
A Swiss provider with customers in the EU usually has to deal with both. The controls in ISO 27018 do not depend on the jurisdiction, so one set of practices serves both legal frameworks. The legal wording in your contracts still needs to match each.
Who benefits from ISO 27018
The standard is most useful for providers whose customers decide where personal data may live. A SaaS start-up that stores customer data, an agency that runs client websites and mailing tools, a managed hosting company, a small software house with a customer portal. In all of these, the customer's purchasing department sends a supplier questionnaire, and the section on data protection is long.
A certificate does not answer every line. It shortens the conversation, because several answers become a reference to a published, verifiable document. Small teams in particular gain from this, and the guide on ISO certification for small and medium businesses explains how a company of ten people can approach a standard written with larger providers in mind.
Checklist: are you ready to claim ISO 27018 alignment?
If you can tick most of these, an assessment will mainly be about documenting what you already do. Gaps in sub-processor lists and deletion procedures are the most common ones.
How to present the certificate to customers
Be precise. Write that your cloud service has been assessed against ISO 27018:2025 and that you process personal data on the customer's instructions under a data processing agreement. Do not write that you are GDPR certified.
The certificate carries a QR code that leads to a public verification page. A customer or auditor can check it without contacting you. Put the reference in your reply to the supplier questionnaire and in your tender documents, next to your data processing agreement and your list of sub-processors.
How Zertify fits in
Zertify issues certificates based on an online self-assessment. There is no on-site audit. You answer questions about how you handle personal data in your cloud service, and a member of the SICE Certification Board reviews every assessment before the certificate is issued. The certificate is issued by Zertify under licence from SICE. After a passed assessment and payment, you receive it within 4 hours.
The certificate is valid for three years. It is confirmed each year with a short online re-audit, which is part of a yearly subscription. The pricing page shows what that includes. If you want to understand what separates this model from a classic audit, the guide on ISO certification without an audit sets out the differences and who each route suits.
The details of the standard are on the ISO 27018 page. When you are ready, you can start the assessment. Have your data processing agreement, your sub-processor list and your breach procedure at hand, because the questions refer to them.
What to do before your next customer questionnaire
Work through the checklist, close the gaps in your contracts and procedures, and then decide whether a certificate helps your sales conversations. If customers in regulated sectors or larger companies ask for it by name, it probably does. If they only ask about GDPR, a clean data processing agreement and a clear sub-processor list come first.
Frequently asked questions
Does ISO 27018 make my company GDPR compliant?
No. ISO 27018 covers many processor duties for personal data in the cloud, but GDPR compliance also depends on your role as a controller, your contracts, your lawful bases and your handling of data subject rights. The certificate is supporting evidence, not proof of compliance.
Is ISO 27018 a certification under Article 42 of the GDPR?
No. Article 42 provides for approved GDPR certification mechanisms. ISO 27018 is an international standard that is not one of those mechanisms. You can say your service was assessed against it, but not that it is a GDPR certificate.
Does ISO 27018 apply to Swiss companies under the FADP?
Yes, it can be used by Swiss providers. The standard does not depend on a jurisdiction. Its controls on instructions, security, sub-processors and breach notification match what the Swiss Federal Act on Data Protection expects from a processor. Contract wording still has to follow the applicable law.
Do I need ISO 27001 before ISO 27018?
ISO 27018 builds on the information security controls of ISO 27002, so a working security practice is the base. A separate ISO 27001 certificate is not a precondition for the Zertify assessment, but the security topics in it will be asked about.
Which customers ask for ISO 27018?
Mostly larger companies, public bodies and regulated sectors that buy cloud services and send supplier questionnaires or tender requirements about personal data. Smaller customers usually ask about the data processing agreement first.
