ISO 27018:2019 Cloud Privacy
Is ISO 27018 mandatory?
No law requires an ISO 27018 certificate. In practice, a supplier questionnaire or a tender can turn it into a condition of the contract. If a customer asks for it, you can complete the self-assessment online and receive the certificate within 4 hours after passing and payment.
01: Short answer
Is an ISO 27018 certificate required by law?
No. ISO 27018:2019 is a voluntary standard. Neither the GDPR nor the Swiss FADP names it as a condition for processing personal data. Both laws set duties for processors. The standard describes one structured way to meet them in a public cloud.
A certificate does not replace those duties. It gives your customer written evidence that you handle personally identifiable information (PII) as a processor in a defined way: purpose limitation, deletion and return, sub-processors, breach notification.
02: Customer demand
When does ISO 27018 become mandatory in practice?
The obligation comes from the contract, not from legislation. Four situations account for most requests.
- Supplier questionnaire
- The customer's purchasing or data protection team asks whether you hold ISO 27018. An empty answer slows the onboarding or stops it.
- Tender
- Some invitations to tender list the certificate as a selection criterion. A statement that you comply in substance does not replace it.
- Data processing agreement
- Larger customers write the standard into the agreement or its security annex and ask for the certificate number.
- Industry expectation
- Healthcare cloud providers, HR and payroll software and e-commerce platforms process sensitive personal data. Buyers in these fields compare providers, and a certified one is easier to approve internally.
If you do not offer a cloud service that processes personal data on behalf of others, ask the customer which standard they actually mean.
03: Requirements
What the customer checks behind the certificate
The key requirements of the standard match the questions that appear in security questionnaires. Knowing the pairing helps you answer even before the certificate is in hand.
| Requirement | What the buyer wants to know |
|---|---|
| Transparency about data processing | Which personal data do you process, and why? |
| Purpose limitation | Is the data used only on my instructions? |
| Deletion and return of PII | Can I get my data back and have it deleted when the contract ends? |
| Sub-processors | Which sub-processors do you use, and do they carry the same privacy duties? |
| Data protection impact assessments | Have you assessed the privacy risk of your service? |
| Notification of data breaches | How soon do you inform me if personal data is exposed? |
ISO 27018 extends ISO 27001 with privacy controls for the public cloud. Some customers ask for both, so read the request closely before you decide.
04: Urgent request
A customer asked for ISO 27018: what to do first
A request usually comes with a deadline, a contract signature or a tender closing date. These steps keep the time you have under control.
Read the exact wording
Check whether the customer wants a certificate, a compliance statement or evidence of controls, and which version of the standard they name.
Fix the deadline
Ask for the date by which the proof must be in their hands.
Ask what they accept
Confirm that a certificate based on an online self-assessment, with a public verification page, meets their requirement. Some buyers specify an on-site audit.
Gather your documents
Have the processing agreement, the sub-processor list, the deletion procedure and the breach process ready. The assessment asks about exactly these.
Complete the assessment
Answer the questions, pay, and send the PDF to the customer.
05: Zertify
How to get an ISO 27018 certificate online with Zertify
Zertify issues the certificate on the basis of an online self-assessment. There is no on-site audit. The certificate is issued by G6 Agency AG under licence from SICE, and SICE reviews every assessment before issue.
The assessment has 32 yes/no questions. 11 are mandatory requirements of the standard and must all be answered yes. Among the other 21, at least 14 yes answers are needed to pass. Your customer can check the result on the public verification page, using the certificate number or the QR code on the PDF.
The price is CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the yearly online re-audit. The certificate is valid for 3 years. Billing is an automatic yearly subscription. You can cancel at any time to the end of the current year in your customer account, and the certificate then ends with the paid year. Swiss and Liechtenstein customers pay 8.1% VAT, included in these prices. You do not need an account to buy. If you add a second or third standard, a discount of 20% for two standards or 30% for three or more applies, also on the yearly fee.
06: Other route
Online certificate or on-site audit?
Which route fits depends on who is asking. The classic route with an on-site audit by a certification body is one option. The Zertify certificate is another, and it fits when the buyer accepts an online self-assessment with public verification.
| Aspect | Zertify | Classic route with on-site audit |
|---|---|---|
| Method | Online self-assessment, reviewed by SICE | Audit on your premises by a certification body |
| Time to certificate | 4 hours after passing and payment | Set by the audit schedule of the certification body |
| Yearly check | Short online re-audit | Defined by the certification body |
| Verification | Public, by number and QR code | Defined by the certification body |
07: FAQ
Questions about ISO 27018 being mandatory
08: Guide
Related pages
Check where you stand against ISO 27018
Answer 32 yes/no questions and see whether you pass.
Free and without registration.