ISO 27018 for service companies

A service company rarely owns the data it works with. Payroll records, applicant files, customer lists, support tickets and invoices belong to the client. Once these sit in a cloud platform that you operate, the client's purchasing department needs something to put in the file.

That is usually where the question appears: a line in the supplier questionnaire, a requirement in the tender documents, a clause in the framework agreement. A certificate with a number that the buyer can check themselves closes that line without a long email exchange about your data protection practice.

Partners ask for the same reason. A larger provider that subcontracts work to you has to answer to its own clients. It prefers subcontractors who can show an independent confirmation of how personal data is processed.

• ISO 27018 certification at a glance

ISO 27018:2019 extends ISO 27001 with privacy controls for cloud providers that act as processors of personally identifiable information (PII). It supports your obligations under the GDPR and the Swiss FADP. The key requirements look like this in a service company:

Transparency about processing

A payroll provider tells each client which data categories it processes, where, and which sub-processors are involved.

Purpose limitation

A marketing agency uses a client's customer list only for the campaign ordered, never for its own newsletter.

Deletion and return of PII

An IT support firm hands back the ticket export at the end of the contract and deletes the remaining copies, including backups, on a defined date.

Privacy-compliant sub-processors

A consultancy that uses external hosting, e-signature or survey tools keeps a current list and a written agreement with each provider.

Data protection impact assessments

Before an HR software service takes on health-related absence data for the first time, it assesses the risks for the people concerned.

Notification of data breaches

A named person knows how to inform the client without delay when an account is compromised, and the steps are written down.

The risk sits where client data is copied, shared or kept longer than needed. The table shows four processes common in service companies and what the standard expects of each.

It applies if you offer a cloud-based service and process personal data on behalf of your clients. That covers SaaS providers, HR and payroll platforms, e-commerce platforms and service firms that run client data in their own cloud environment.

If you only use cloud tools for your own internal data, ISO 27001 is usually the closer match. Cloud security controls as such are the subject of ISO 27017, and many providers combine the standards.

• ISO 27001
• ISO 27017
• ISO for small and medium businesses

Four documents save most of the time. First, a list of every tool and provider that touches client data, with the contract status of each. Second, the procedure for deleting or returning data when a mandate ends. Third, the path for reporting a breach to a client, with names and a deadline. Fourth, a record of which client data you hold and for which purpose.

If one of these is missing, write it before you start. The questions are yes or no, so the assessment shows quickly where a gap would cost you the answer.

Zertify is the online route: no on-site audit, no waiting for an auditor's calendar. Your own self-assessment is the basis. The certificate is issued by G6 Agency AG under licence from SICE, and SICE reviews every assessment before issue. It costs CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the yearly online re-audit. The certificate is valid for 3 years.

1. 01

   Answer 32 yes/no questions

   11 of them are mandatory requirements of the standard and must all be answered yes. Of the other 21, at least 14 must be yes.

2. 02

   Pay and receive the certificate

   After you pass and pay, the PDF arrives within 4 hours. No account is needed to buy.

3. 03

   Show it to your client

   Every certificate has a number and a QR code on the PDF. The buyer opens the public verification page and sees that it is genuine.

4. 04

   Confirm it each year

   A short online re-audit keeps the certificate current. The subscription renews automatically and can be cancelled at any time in your customer account, effective at the end of the paid year.

• Start the free self-assessment
• See pricing
• Compare the certification routes