ISO 27018 Cloud Privacy
ISO 27018 online: from self-assessment to certificate
You answer 32 yes/no questions about how you protect personal data as a cloud processor. Once you have passed and paid, the certificate reaches you within 4 hours as a PDF with a QR code. No auditor visits your office.
01: Process
How do you get an ISO 27018 certificate online?
The route has five steps, and all of them take place in the browser.
Start the self-assessment
It is free and needs no registration. You get 32 yes/no questions on the requirements of ISO 27018:2019.
Pass the assessment
All 11 mandatory questions must be answered yes. Of the other 21 questions, at least 14 must be yes.
Pay
You buy the certificate at checkout. You do not need to create an account.
Review and issue
SICE reviews your assessment. G6 Agency AG then issues the certificate under licence from SICE, within 4 hours after you have passed and paid.
Download and share
The PDF carries a certificate number and a QR code. You can attach it to a quote or send it to a customer straight away.
02: Preparation
What should you prepare before you start?
The questions deal with things a cloud processor already does or has to do. Sit down with the people who run the service: engineering, operations and whoever signs your customer contracts. Five topics decide most of the answers.
- Description of the processing
- Which personal data you process for customers, and for which purposes only. This covers transparency and purpose limitation.
- Deletion and return
- How a customer gets their data back, and how you delete it at the end of the contract or on request.
- Sub-processors
- Hosting, support and other providers that can touch customer data, and the agreements you have with them.
- Impact assessments
- Whether you carry out data protection impact assessments where the processing carries a high risk.
- Breach notification
- Who detects an incident, who informs the customer, and by which channel.
If you cannot answer one of these today, you have found what to fix. Since the assessment costs nothing, many companies run through it once just to see where the gaps are.
03: Scoring
How is the 32-question assessment scored?
Two rules apply at the same time. The 11 mandatory questions correspond to requirements of the standard that cannot be offset against anything else, so one no there means you do not pass. The remaining 21 questions leave a little room.
| Part | Questions | Pass rule |
|---|---|---|
| Mandatory requirements | 11 | All 11 answered yes |
| Further questions | 21 | At least 14 answered yes |
| Total | 32 | Both rules met |
Answer from what your service does today, not from what is planned. SICE reviews every assessment before a certificate is issued, and a short online re-audit confirms the certificate each year.
04: Verification
How does a customer check your certificate?
Every Zertify certificate can be verified publicly. A customer scans the QR code on the PDF or enters the certificate number on the verification page, and sees the status of the certificate there. Nobody has to phone you or wait for a reply by email.
This helps most when a supplier questionnaire asks for proof of your privacy controls in the cloud, or when a purchasing department wants evidence before signing a data processing agreement. You send the PDF, and the buyer confirms it in a minute.
The certificate is valid for 3 years. The yearly online re-audit keeps it current.
05: Comparison
Online or on-site audit: what changes for you?
With the classic route, a certification body sends an auditor to examine your documents and systems. Zertify replaces that visit with a structured self-assessment that SICE reviews. The practical differences are these.
| Aspect | Zertify online | Classic route with on-site audit |
|---|---|---|
| Evidence | Self-assessment with 32 yes/no questions, reviewed by SICE | Auditor examines documents and systems on site |
| Scheduling | You start when it suits you | Audit dates agreed with the certification body |
| Time to certificate | Within 4 hours after passing and payment | Depends on the audit calendar and any findings |
| Yearly confirmation | Short online re-audit | Follow-up audits as set by the certification body |
| Pricing | Published, with first-year and yearly fee | Quote per engagement |
Some tenders or customers specify the classic route. Check what your counterpart requires before you choose.
06: Zertify
Where does Zertify fit in?
Zertify issues ISO certificates on the basis of an online self-assessment. The certificate is issued by G6 Agency AG under licence from SICE, the Swiss Institute of Certification and Education. ISO 27018 extends ISO 27001 with privacy controls for cloud providers acting as processors. The standard page explains the requirements in full.
The certificate costs CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the yearly online re-audit. It is a yearly subscription that renews automatically. You can cancel at any time in your customer account, effective at the end of the current year, and the certificate then ends with the paid year.
If you certify more than one standard, you get 20% off for two standards and 30% off for three or more, also on the yearly fee. Customers in Switzerland and Liechtenstein see prices including 8.1% VAT.
07: FAQ
Questions about ISO 27018 online
08: Guide
Related pages
Start your ISO 27018 assessment
Answer the 32 questions and see whether your cloud service meets the standard.
Free and without registration.