ISO 27018 for financial services

If you sell cloud software to a bank, an insurer or a wealth manager, the supplier questionnaire arrives before the quote. It asks whether you process personal data on behalf of the client, who your sub-processors are, how data is deleted when the contract ends and how quickly you report a breach. ISO 27018 gives a standard answer to all four.

Financial data is personal data of the most sensitive kind: account holders, transaction histories, credit files, claims. Your client acts as the controller and has to show that its processors are under control, both under the GDPR and under the Swiss FADP. A certificate saves the client's purchasing department from judging your answers one by one.

In a tender, the certificate number and the QR code on the PDF go into the appendix. The client checks them on the public verification page. Nobody has to call you.

• ISO 27018 at a glance

ISO 27018 applies to the role of the processor. In financial services that role covers more data than most providers first list.

Account and payment data

IBANs, card tokens and transaction histories that a payment or banking app stores on behalf of a bank.

Onboarding documents

Passport scans, proof of address and identity-check results held by a provider of client onboarding software.

Portfolio and advisory records

Holdings, risk profiles and meeting notes that a wealth manager keeps in a cloud-based advisory tool.

Claims files

Medical reports, photos and correspondence that an insurer's claims platform stores for each case.

Credit and scoring data

Income details and credit enquiries used by a lending platform to prepare a decision.

The standard names six areas. The table shows what each looks like at a provider of financial software.

The first risk is the length of the processor chain. A single lending platform may rely on a hosting provider, an SMS gateway, a document scanner and an analytics tool. Each one touches client data. ISO 27018 requires you to know this chain, to bind each link by contract and to keep your client informed.

The second risk is deletion. Financial clients keep records for retention periods that they define themselves. The standard does not make you decide how long data stays. It requires that you can delete and return data on the client's instruction, and that you do so in backups too.

The third risk is time. When a breach occurs, the client has its own duties to meet, and it can act only once you have told it. A defined notification path is the control that matters here.

ISO 27018 extends ISO 27001 with these privacy controls. It does not replace the compliance work of your clients, but it documents your share of it.

• ISO 27001 for information security
• ISO 27017 for cloud security

Most of the material already exists in a provider that serves financial clients. Collect your standard data processing agreement, the current list of sub-processors, the written deletion and return procedure, the breach notification procedure and the latest impact assessment record.

Gaps show up in the questions. A missing sub-processor list or an undocumented deletion step is a no, and you can fix it and answer again. The self-assessment is free and needs no registration, so you can use it as a first check of where you stand.

• ISO for small and medium businesses

The certificate rests on an online self-assessment, without an on-site audit. G6 Agency AG issues it under licence from SICE, and SICE reviews every assessment before the certificate is released.

The price is CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the yearly online re-audit. The certificate is valid for 3 years. The yearly subscription can be cancelled at any time in your customer account, effective at the end of the paid year, and the certificate then ends with that year. For two standards you get 20% off, for three or more 30%, also on the yearly fee. Customers in Switzerland and Liechtenstein pay 8.1% VAT, which is included in the prices.

Teams that prefer the classic route with an on-site audit by a certification body can compare both routes in our guide.

1. 01

   Start the self-assessment

   No account is needed. You answer 32 yes/no questions on ISO 27018.

2. 02

   Pass the assessment

   All 11 mandatory requirements must be answered yes. Of the other 21 questions, at least 14 need a yes.

3. 03

   Pay and receive the certificate

   After passing and payment, the PDF arrives within 4 hours.

4. 04

   Share the verification

   Every certificate has a number and a QR code that lead to a public verification page. Add both to your next tender or questionnaire.

• Start the free self-assessment
• See pricing
• Compare the certification routes