TS EN 17799

TS EN 17799 is a standard that defines baseline requirements for processing activities involving personal data and is intended to support the data protection certification mechanism under Article 42 of the GDPR. It strengthens the framework used to demonstrate compliance for personal data controllers and/or processors and provides a basis for conformity assessment aligned with EN ISO/IEC 17065.

The document does not apply to products or to management systems destined for processing personal data. Instead, it may be used for all of an organization’s processing activities or for a defined subset, provided that this choice does not lead to non-conformity with the EU personal data protection normative framework. This distinction matters because data protection is usually assessed through governance, processing purposes, records, responsibilities, and control measures rather than through a single technical device or isolated process step.

How the standard frames certification-oriented data protection

In general technical terms, personal data protection is about ensuring that data are processed lawfully, for specified purposes, with appropriate limitation, and under controlled conditions for access, retention, transfer, and deletion. Certification-oriented standards help organizations present consistent evidence of those controls. TS EN 17799 serves that purpose by setting baseline requirements and by offering indications for conformity assessment, while remaining distinct from a product standard and not by itself a guarantee of legal compliance.

• Supports the certification mechanism referred to in GDPR Article 42.
• Applies to personal data controllers and/or processors.
• May cover an organization’s full set of processing activities or a defined subset.
• Provides a basis for conformity assessment in line with EN ISO/IEC 17065.
• Does not apply to products or to management systems intended for processing personal data.