ISO 27018 for IT companies

If you run software, hosting or managed services, your customers hand you personal data that they remain responsible for. So their purchasing department adds a line to the supplier questionnaire: do you hold ISO 27018? The same question shows up in tenders, in security reviews before a contract is signed and in partner onboarding.

The standard is written for processors in the public cloud. A buyer gets one recognised reference instead of a long list of individual promises about deletion, sub-processors and breach reporting. For you, a certificate number and a QR code answer the question in a single reply and spare you a long email exchange.

ISO 27018:2019 extends ISO 27001 with privacy controls for providers that process personally identifiable information (PII) on behalf of customers. It supports your obligations under the GDPR and the Swiss FADP. Six requirements matter most in daily IT work.

Transparency about processing

Customers can see where and how their data is processed. A SaaS provider, for example, publishes its hosting locations and a current sub-processor list in the customer portal.

Purpose limitation

Personal data is processed only on the customer's instructions. Support staff do not reuse customer records to train internal tools or for your own marketing.

Deletion and return

When a contract ends, you export the data in an agreed format and delete production data and backups on a defined schedule.

Sub-processors

A managed service provider that uses an external ticketing tool or backup service has a written agreement with it and informs customers before adding a new one.

Data protection impact assessments

Before a new analytics module goes live, the product team documents which end-user data it touches, what the risks are and which measures apply.

Breach notification

An on-call runbook names who informs the customer, and within which time, when unauthorised access to a database is found.

• ISO 27018 in detail

Most privacy failures at IT companies do not come from the core product. They come from the processes around it. The table shows where the standard asks for a clear rule.

You can answer the questions in one sitting if the basics are written down. Five documents or lists cover most of what the assessment asks.

1. 01

   List the services that process customer PII

   Name each product or hosted service where you act as processor, and the type of personal data it holds.

2. 02

   Write down your sub-processors

   Include hosting, backup, monitoring, email delivery and support tools, with the agreement that covers each.

3. 03

   Describe deletion and return

   Set out who starts it, in which format data is returned and how long backups are kept.

4. 04

   Define the breach notification path

   Name the contact on your side, the contact at the customer and the time limit you commit to in the contract.

5. 05

   Keep your contract template at hand

   The processing terms in your customer contract show that purpose limitation and instructions are agreed in writing.

The self-assessment has 32 yes/no questions. Eleven of them are mandatory requirements of the standard and must all be answered yes. Among the other 21 you need at least 14 yes answers. After you pass and pay, the certificate arrives within 4 hours. It is issued by G6 Agency AG under licence from SICE, and SICE reviews every assessment before the certificate is issued.

Every certificate can be checked publicly by its number or by scanning the QR code on the PDF. You can put the verification link straight into a tender response or a supplier questionnaire.

The price is CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the yearly online re-audit. The certificate is valid for 3 years. Billing is an automatic yearly subscription. You can cancel it at any time in your customer account, effective at the end of the current year, and the certificate then ends with the paid year. If you certify two standards you get 20% off, with three or more 30%, also on the yearly fee. Customers in Switzerland and Liechtenstein pay prices that include 8.1% VAT. You do not need an account to buy.

• Start the free self-assessment
• See pricing
• Standard page ISO 27018

The Zertify certificate rests on an online self-assessment. There is no on-site audit, and a short online re-audit confirms it every year. The classic route means an on-site audit by a certification body. It takes more planning and a larger budget, and for some tenders it is the stated requirement.

Read the tender wording before you decide. If the document only asks for an ISO 27018 certificate, a publicly verifiable one may be enough. If it names a specific audit procedure, ask the customer what they expect. ISO 27018 builds on ISO 27001, so companies that hold or plan that certificate can approach both together.

• Compare the certification routes
• Certification without an on-site audit
• ISO 27001