ISO 27018 process: from self-assessment to verifiable certificate

The whole process runs online. You do not need an account to place the order, and no auditor comes on site. These are the steps in the order you will meet them.

1. 01

   Check that the standard fits

   ISO 27018 is written for cloud providers that process personal data on behalf of their customers, as processors. A payroll tool, a B2B SaaS product or an e-commerce platform holding customer data are typical cases. If you only handle your own staff data, the standard adds little.

2. 02

   Collect your evidence

   Have the processing agreements, the list of sub-processors, the deletion and return procedure and the breach notification process at hand. You answer from the documents, not from memory.

3. 03

   Answer the 32 questions

   Each question is a yes or a no. The self-assessment is free and needs no registration.

4. 04

   Pass and order

   You pass if all 11 mandatory questions are answered yes and at least 14 of the other 21 are yes. After that you pay online and the review starts.

5. 05

   Review and issue

   SICE reviews your assessment. G6 Agency AG then issues the certificate under licence from SICE. It reaches you within 4 hours after passing and payment.

6. 06

   Use the certificate and keep it current

   The PDF carries a certificate number and a QR code. Your customer scans the code or enters the number on the public verification page. Once a year a short online re-audit confirms that your answers still hold.

• How Zertify works

The questions follow ISO 27018:2019. The standard extends ISO 27001 with privacy controls for processors of personally identifiable information (PII) in the public cloud. Eleven questions are mandatory requirements of the standard. If you answer no to one of them, the assessment cannot be passed. The remaining 21 questions carry the rest, and 14 yes answers among them are enough.

Transparency

Your customers know which personal data you process and for what purpose, and your contract says so.

Purpose limitation

You process PII on the customer's instructions and for no purpose of your own.

Deletion and return

A defined procedure returns or deletes a customer's PII when the contract ends or on request.

Sub-processors

You engage sub-processors under privacy-compliant terms and can tell customers who they are.

Impact assessments

You carry out data protection impact assessments where processing carries risk.

Breach notification

You detect incidents and notify the affected customers when their PII is involved.

• The ISO 27018 standard in detail

Passing the assessment does not issue the certificate by itself. SICE reviews every assessment before anything is released. This review is the step that separates a completed questionnaire from a certificate.

Once the review is done, G6 Agency AG issues the certificate under licence from SICE. You receive a PDF with your company name, the standard, the certificate number and a QR code.

Every certificate has an entry on the public verification page. A purchasing department or an auditor on the customer side scans the QR code, or types the number, and sees whether the certificate is valid. You do not have to send confirmation letters.

• Certification without an on-site audit

The certificate is valid for 3 years. Each year a short online re-audit confirms that your answers still match your setup. It is part of the yearly fee, so there is no separate booking.

The price is CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the online re-audit. For customers in Switzerland and Liechtenstein the prices include 8.1% Swiss VAT.

Billing is an automatic yearly subscription. You can cancel at any time in your customer account, effective at the end of the current year. If you cancel, the certificate ends with the paid year.

• Guide to certification cost

The classic route means an on-site audit by a certification body. You request quotes, agree dates with the auditor and prepare for the visit. Both routes test your processing of personal data against the same standard. They differ in method, calendar and upkeep.

• Compare the certification routes

Zertify is the route for a provider that already runs its privacy controls and needs the certificate for a quote, a tender or a customer questionnaire. The 32 questions show quickly whether your setup meets ISO 27018:2019. If it does not, you see which requirement is missing before you pay anything.

Companies that need more than one standard get a discount: 20% for two standards and 30% for three or more, also on the yearly fee. Cloud providers often combine ISO 27018 with ISO 27001 or ISO 27017.

• ISO 27018 certificate
• Pricing
• Start the free self-assessment