ISO 27018:2019 Cloud Privacy
ISO 27018 benefits for cloud providers
An ISO 27018 certificate gives your customers written proof that you handle personal data in the public cloud as a processor should. It shortens security questionnaires, supports your position in tenders and gives your team a fixed set of privacy rules to work to. With Zertify you receive the certificate within 4 hours after passing the self-assessment and payment.
01: Customer trust
Why customers ask for ISO 27018 proof
Your customers hand you payroll records, patient files or order histories. Under the GDPR and the Swiss FADP they remain responsible for that data, so their data protection officer wants to know what you do with it before anyone signs. A certificate answers that in one document instead of ten emails.
ISO 27018 is written for processors in the public cloud. Its wording matches what a customer's reviewer looks for. It does not replace your data processing agreement. It sits next to it and shows that the promises in the contract are backed by defined practice.
- Purpose limitation
- You process personal data only for the purposes the customer has instructed, and you can say so in writing.
- Deletion and return
- The customer can get the data back and have it deleted when the contract ends.
- Sub-processors
- You engage hosting, support or analytics providers in a controlled way and can name them.
- Breach notification
- You know who informs the customer when personal data is affected, and how.
02: Tenders
How an ISO 27018 certificate helps in tenders and supplier checks
Public and corporate buyers of cloud services often score data protection as its own criterion. Without evidence you answer in prose and hope the reviewer is satisfied. With a certificate you give a number and a document.
The table shows where the certificate appears in a sales process.
| Situation | What the certificate gives you |
|---|---|
| Supplier questionnaire from a customer | A certificate number you can quote in the answer on privacy in the cloud. |
| Tender with a data protection criterion | Evidence for that criterion, attached as a PDF. |
| Review by the purchasing department | A verification page the reviewer can open without contacting you. |
| Customer audit of your service | A defined set of privacy controls to walk the auditor through. |
A certificate does not win a tender. It removes one reason for being scored down, and your price and functionality still decide the rest.
03: Efficiency
What the assessment settles inside your company
Many SaaS teams handle personal data well but have never written down who decides what. Working through the standard forces those decisions. The same answers then serve every later questionnaire, so your team stops rewriting them for each customer.
Who sets the purpose of processing
Product, support and sales know which uses of customer data are covered by the contract and which are not.
How a deletion request is carried out
Someone owns the steps, including backups, and the customer receives confirmation.
Which sub-processors are in use
You keep one current list instead of reconstructing it when a customer asks.
Who reports a breach and to whom
Roles and the path to the customer are fixed before an incident, not during one.
When an impact assessment is needed
New features that touch personal data trigger a review before release.
04: Risk
Which risks an ISO 27018 certificate reduces
The standard targets the points where processors usually fail: data used for purposes nobody approved, deletion that stops at the live database, sub-processors the customer never heard of, and breaches reported late. Each is a contract risk as much as a technical one.
ISO 27018 extends ISO 27001 with privacy controls for the cloud. If you already run an information security management system, much of the groundwork is in place. The certificate does not remove your legal duties under the GDPR or the FADP. It supports you in meeting them and in showing that you do.
05: Marketing
Using the certificate and its verification link
Every Zertify certificate carries a number and a QR code on the PDF. Both lead to a public verification page, so a customer can confirm validity without writing to you. That page is the most useful part of the certificate in sales, because a reviewer trusts what they can check themselves.
Put the certificate where buyers look for it: on a trust or security page of your website, in the footer of quotes, in your email signature and as an attachment to tender documents. Describe it accurately as a certificate based on an online self-assessment, reviewed by SICE and confirmed every year by a short online re-audit.
06: Zertify
How to get the ISO 27018 certificate with Zertify
You answer 32 yes/no questions about your cloud service. Eleven of them are mandatory requirements of the standard and must all be answered yes. Among the other 21 you need at least 14 yes answers. The certificate is issued by G6 Agency AG under licence from SICE, and SICE reviews every assessment before it goes out.
The price is CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the yearly online re-audit. The certificate is valid for 3 years. Billing is an automatic yearly subscription that you cancel at any time in your customer account, effective at the end of the current year; the certificate then ends with the paid year. Two standards earn a 20% discount and three or more earn 30%, also on the yearly fee. Customers in Switzerland and Liechtenstein pay prices including 8.1% VAT. You do not need an account to buy.
The classic route with an on-site audit by a certification body takes a different path. The guide below compares both.
07: FAQ
Questions about ISO 27018 benefits
08: Guide
Related pages
Check whether your cloud service meets ISO 27018
Answer the 32 yes/no questions and see whether you pass.
Free and without registration.