Step 1 – Initial Consultation

Understand your cloud services, PII processing activities, privacy objectives, and certification requirements.

Step 2 – Gap Assessment

Review existing cloud privacy and information-security practices against applicable ISO/IEC 27018 requirements.

Step 3 – Define Scope

Determine the cloud services, locations, systems, processes, PII activities, and organizational boundaries covered by the assessment.

Step 4 – PII Assessment

Identify how personal information is collected, stored, processed, transferred, retained, and deleted.

Step 5 – Privacy Risk Assessment

Identify and evaluate privacy and information-security risks associated with cloud-based PII processing.

Step 6 – Documentation

Develop privacy policies, procedures, risk assessments, PII handling processes, records, and supporting documentation.

Step 7 – Implementation

Implement appropriate cloud privacy and PII protection controls.

Step 8 – Employee Training

Train employees on privacy responsibilities, PII protection, cloud security, and applicable procedures.

Step 9 – Internal Audit

Conduct internal audits to evaluate conformity and identify areas requiring corrective action.

Step 10 – Management Review

Review privacy performance, risks, incidents, audit findings, customer requirements, and improvement opportunities.

Step 11 – Corrective Actions

Address identified nonconformities and verify corrective-action effectiveness.

Step 12 – Certification Assessment

An independent certification body conducts the external assessment against the applicable certification requirements.

Step 13 – Certification Decision

The certification body independently reviews the assessment results and makes the certification decision.

Step 14 – Continual Improvement

Monitor privacy controls, review risks, address incidents, and continually improve cloud privacy practices.