ISO 27018 requirements: what a cloud provider has to show

ISO 27018:2019 is a code of practice for protecting personally identifiable information (PII) in the public cloud. It is written for the processor, meaning the company that stores or handles personal data for a customer who decides why the data is collected.

The standard extends ISO 27001. The information security controls stay in place, and a set of privacy controls is added on top. Those additions cover purpose limitation, deletion and return of data, sub-processors and breach notification. They help a provider meet its obligations under the GDPR and the Swiss FADP, but they do not replace legal advice for your specific case.

If you sell software to other companies, the requirements are less abstract than they sound. Most of them correspond to a question you already find in a customer's supplier questionnaire.

• ISO 27018 at a glance
• ISO 27001 for comparison

Each requirement below is stated as an obligation, followed by the evidence an assessor or a customer expects to see.

Transparency about data processing

Customers must be able to find out what you do with their PII, where it is processed and who else touches it. Usually documented: a data processing agreement, a description of processing locations and a privacy notice for the service.

Purpose limitation

You process PII only on the customer's instructions and not for your own marketing or product analytics. Usually documented: the instruction clauses in the contract and an internal rule that bars secondary use.

Deletion and return of PII

When the contract ends, or on request, the customer gets its data back and you delete the rest, including copies and backups within a stated period. Usually documented: an export procedure, a deletion routine and a retention schedule.

Privacy-compliant sub-processors

Every hosting provider, support tool or subcontractor that touches PII is known, bound by a contract and disclosed to the customer. Usually documented: a sub-processor register and the contract terms passed on to each one.

Data protection impact assessments

Where processing carries a higher risk to individuals, you assess that risk before going live and record the outcome. Usually documented: an assessment template and the completed assessments for relevant services.

Notification of data breaches

You detect incidents involving PII and tell the affected customer without delay, so that the customer can meet its own reporting duties. Usually documented: an incident procedure, a contact route to customers and an incident log.

Because the standard builds on ISO 27001, it rests on the same management system frame: clauses 4 to 10 of the high level structure. The privacy requirements sit inside that frame. The table shows where the evidence usually belongs.

Purchasing departments and data protection officers rarely quote the standard. They ask where the data is stored, whether sub-processors are used, how fast you report an incident and what happens to the data after termination. Those four questions map directly onto the requirements above.

A provider that has already written the answers down for ISO 27018 can paste the same wording into a tender response or a customer audit. A provider without that groundwork writes a new answer each time, and the answers drift apart.

• ISO 27017 for cloud security
• ISO 27701 for privacy management

Gather the following before you open the self-assessment. Most of it already exists in some form.

1. 01

   Contract templates

   Your data processing agreement and the terms that govern deletion, return and sub-processors.

2. 02

   Sub-processor list

   Every third party that can access customer PII, with its role and location.

3. 03

   Incident procedure

   Who detects, who decides and who informs the customer, with a named contact.

4. 04

   Deletion and export routine

   The steps you take when a customer leaves, including backups.

5. 05

   Risk and impact assessments

   The latest risk assessment and any impact assessments for services with higher risk.

Zertify tests these requirements through an online self-assessment of 32 yes/no questions. Eleven of them are mandatory requirements of the standard and must all be answered yes. Among the other 21, at least 14 must be yes. There is no on-site audit. The certificate is issued by G6 Agency AG under licence from SICE, and SICE reviews every assessment before it is issued. After you pass and pay, the certificate arrives within 4 hours.

It costs CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the yearly online re-audit. The certificate is valid for 3 years, and every certificate can be checked publicly by number or QR code. The subscription renews automatically and can be cancelled at any time in the customer account, to the end of the current year. If you want to compare this with the classic route with an on-site audit by a certification body, the guide on routes lays out the differences.

• Start the free self-assessment
• See pricing
• Compare certification routes