ISO 27018 consulting: when you need it and when you don't

It depends on what is already in place. ISO 27018:2019 applies to cloud providers that process personally identifiable information (PII) on behalf of their customers. It builds on ISO 27001 and adds privacy controls for the public cloud.

A company that has signed processing agreements with customers, keeps a list of sub-processors and can delete a customer's data on request is mostly documenting what it already does. A company that cannot say where customer data is stored has a different problem. No certificate fixes that, and an outside expert can.

A consultant is likely useful

Your data flows are undocumented, you use several sub-processors without contracts, or nobody owns data protection in the team.

A self-assessment is likely enough

Your processes exist and run, a customer or tender now asks for proof, and you need a certificate to attach to the supplier questionnaire.

• The ISO 27018 standard

The work follows the structure of the standard and of your service. Most projects contain the same building blocks.

1. 01

   Gap analysis

   The consultant compares your current controls with the requirements and lists what is missing.

2. 02

   Data flow mapping

   Together you record where PII enters your service, where it is stored, who can reach it and which sub-processors touch it.

3. 03

   Contracts and policies

   Processing agreements, the sub-processor list and the privacy policy are drafted or corrected so that purpose limitation is written down.

4. 04

   Deletion and return

   A procedure is defined for returning and deleting customer PII at the end of a contract, including backups.

5. 05

   Breach notification

   Roles, deadlines and a template are set so that customers are informed without delay if a breach occurs.

6. 06

   Audit preparation

   Evidence is collected and the team is briefed before the assessment or the on-site audit.

Consulting is priced by the day, and the number of days depends on your size and your starting point. The figures below are indicative ranges only. Quotes differ by consultant, country and the maturity of your documentation.

A small SaaS provider that already holds ISO 27001 sits at the low end. A provider starting without an information security system sits at the high end, because the ISO 27001 foundations come first.

• Certification cost explained

Whether you hire help or not, the same six topics must be in order. They are the core of ISO 27018 and the questions you will be asked.

Transparency

Customers can see how their PII is processed, by whom and where.

Purpose limitation

You process PII only for the purposes the customer instructed. No own advertising use, no side projects.

Deletion and return

You can hand back and erase PII on request and at contract end.

Sub-processors

Every sub-processor is engaged under a contract that carries the same privacy duties, and customers are informed.

Impact assessments

You carry out data protection impact assessments where the processing calls for them.

Breach notification

A defined path exists to notify customers if PII is compromised.

The assessment consists of 32 yes/no questions for ISO 27018. Eleven of them are mandatory requirements of the standard and must all be answered yes. Among the other 21 questions you need at least 14 yes answers. The questions work as a checklist, so you see your gaps while you answer.

Once you have passed and paid, the certificate arrives within 4 hours. It is issued by G6 Agency AG under licence from SICE, and SICE reviews every assessment before issue. No on-site audit takes place. Each certificate carries a number and a QR code, so your customer's purchasing department can check it on the public verification page.

The price is CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the yearly online re-audit. The certificate is valid for 3 years. The subscription renews automatically and you can cancel it at any time in your customer account, to the end of the current year. Prices include 8.1% Swiss VAT for customers in Switzerland and Liechtenstein. Two standards earn 20% discount, three or more 30%, also on the yearly fee. You do not need an account to buy.

• Start the free self-assessment
• See prices
• ISO 27018 certificate

Yes, and for many companies this is the sensible split. Run the assessment first. Every question answered with no marks a gap. Bring that list to a consultant and pay for a few days of targeted work instead of a full project.

Afterwards you repeat the assessment, pass, and receive the certificate. The yearly online re-audit then keeps it current without a new consulting engagement. If your customers insist on the classic route with an on-site audit by a certification body, the comparison guide shows how the routes differ.

• Compare the certification routes
• Certification without an on-site audit