Personal data protection in the cloud means ISO 27018. Certify it.
Private clients and the Italian public administration, through the cloud service qualification now run by ACN (the National Cybersecurity Agency), increasingly ask cloud providers handling personal data for proof of protection: ISO 27001 extended with ISO 27018 controls is the most recognised way to provide it. With Complaion, the time required to obtain this certification is significantly reduced: a Lead Auditor manages every critical phase, while the platform automates the rest.
Renewal included
Valid 3 years
Upcoming audits
ISO 27018
ISO 27018
Audit esterno
Da pianificare
ISO 27018
ISO 27018
31/07/26
Audit interno
All audits
“Audit completato. Report caricato, solo 2 Osservazioni!”
Alessandro, Lead Auditor
our method
This is how we get you ISO Certified.
80%
automated
Data protection control documentation generated by the platform.
5×
faster
Shorter wait times, less bureaucracy: from gap analysis to audit, with the same rigor required by ISO 27018.
100%
success
We prepare your ISO 27018 audit with accredited bodies: no surprises on the day of the assessment.
protection of personal information in public clouds
Certify what you are already doing to protect personal data.
Procedure n. 5897
Stage 1 + Stage 2
Revision 02
Reviewed
BUILD OR EXPAND YOUR SYSTEM
We build your ISO 27001 system or extend the one you already have.
If you are starting from scratch, we build the entire information security management system. If you are already ISO 27001 certified, we simply map data segregation, asset return, and roles between the cloud provider and the customer, and integrate them into your existing system.
Work without surprises.
We write your procedures; our platform keeps them up to date.
Data access and deletion rights, customer notification in the event of a breach, and management of subcontractors processing PII: we draft the procedures required by the additional controls of ISO 27018, while the platform monitors each control over time, flagging non-conformities before they become issues during an audit.
Compliance status
Aligned with
96%
Updated in real time
2 to close
ISO 9001
Completa 100%
Attiva
ISO 14001
70%
ISO 45001
75%
ISO 27001
80%
Base HLS
70% pronto
Prepare to grow
Build a foundation that integrates with the rest of your IT system.
ISO 27018 integrates into the same control matrix as ISO 27001 and ISO 27017. From there, you are just one step away from compliance with GDPR, NIS 2, and DORA: a single risk assessment, one platform, and no parallel systems to manage.
complaion's process
We'll be with you every step of the way from 0 to 27018.
Documents
Documents
3 gap
Upload documents
We analyze what you already have, what is missing, and what is needed to be ready.
Procedure n.123
3 ready
We write procedures
We develop procedures, policies, and registers based on the way you actually work.
Compliant
Let's do the Audit
We conduct the internal audit, produce the reports, and verify that everything is ready.
Valid for 3 years
Get the certificate
A Certification Body carries out the External Audit and issues the Certificate.
ISO 27018:2025
ISO 27018 CERTIFIED COMPANY
Certification issued by an Accredited Body.
Valid for 3 years
Recognized in over 170 countries
Demand in public tenders
Renewal managed by us
Client stories
Who has obtained ISO 27018
with Complaion.
OFTEN COMBINED
Start with ISO 27018 and build the complete management system.
Those who already hold ISO 27018 have a head start regarding other standards: same structure, same Lead Auditor, same platform.
ISO 27018 cost and timelines
ISO 27018 certification: cost and timelines.
Every company asks the same two questions about ISO 27018: how much does certification cost, and how long does it take? Here are clear, honest answers.
Cost
ISO 27018 certification cost
Wondering how much ISO 27018 certification costs? It depends on concrete factors: company size, sites, the scope to certify, the volume of personal data processed in cloud, and your starting point. After a free initial analysis, Complaion prepares your ISO 27018 quote, tailored to your organization, so you know exactly what you are investing in.
Timelines
ISO 27018 certification timelines
Wondering how long ISO 27018 certification takes? It depends on concrete factors: company size, sites, the scope to certify, an ISO 27001 management system already in place, and your available internal resources. With a dedicated Lead Auditor and the Complaion platform, ISO 27018 timelines are significantly shortened, down to a few months or even weeks.
FREQUENTLY ASKED QUESTIONS
Do you have any questions about ISO 27018 or how Complaion can help you?
What is ISO 27018 and why is it important for my company?
ISO 27018 is the standard that defines specific controls for protecting personally identifiable information (PII) in the public cloud, in addition to those in ISO 27001. The current edition is ISO 27018:2025. It is not certified on its own: it is verified as an extension of ISO 27001. It matters because clients and the Italian public administration, through the cloud service qualification now run by ACN, increasingly ask for proof of data protection in the cloud, and because it supports GDPR compliance for anyone processing personal data in the cloud.
How can you help my company achieve ISO 27018 certification?
If you don’t yet have ISO 27001 certification, we build it together with the privacy controls of ISO 27018 already integrated. If you already have it, a Lead Auditor maps data subject rights, breach notifications, and subcontractor management, adding them to your existing system. The platform generates the required documentation and monitors each control over time.
How long does it usually take to obtain ISO 27018 certification with Complaion?
It depends on your starting point: if you already have ISO 27001 certification, the time required is significantly reduced because you are extending an existing system rather than building one from scratch. Your Lead Auditor will provide a precise estimate after the initial analysis.
What kind of support does Complaion offer during the process?
A dedicated Lead Auditor oversees every critical phase, from mapping privacy controls to audit preparation, while the platform automates documentation and monitors each control over time.
How do I start the process with Complaion?
Request information via the website: a Lead Auditor checks whether you already hold ISO 27001 certification and proposes the most suitable plan, whether you are starting from scratch or building upon an existing system.
Do you provide assistance with certifications other than ISO 27018?
Yes. ISO 27018 integrates into the same control matrix as ISO 27001 and ISO 27017. From there, you are already closer to compliance with GDPR, NIS 2, and DORA. Your Lead Auditor builds everything upon the same system.
Learn more
