TS EN ISO/IEC 27706

TS EN ISO/IEC 27706 focuses on how bodies that audit and certify privacy information management systems (PIMS) should operate in a competent, consistent, and reliable way. In addition to the general requirements of ISO/IEC 17021-1, it provides specific requirements and guidance for audit and certification activities aligned with ISO/IEC 27701.

What this document addresses in certification practice

Its focus is the assessment of a management system that governs how an organisation handles personal information. In general technical terms, a PIMS brings privacy-related controls, responsibilities, and processes into a management-system framework, so protection of personal information depends not only on isolated technical safeguards but also on governance, risk-based implementation, and continual improvement. TS EN ISO/IEC 27706 supports a consistent approach for bodies certifying such systems.

Relationship with ISO/IEC 17021-1 and ISO/IEC 27701

ISO/IEC 17021-1 provides the core framework for bodies certifying management systems, while TS EN ISO/IEC 27706 adapts that framework to the privacy management domain. As a result, topics such as auditor competence, audit programme management, certification decision-making, and scope interpretation are addressed more specifically in the PIMS context. ISO/IEC 27701 defines the requirements and guidance for a privacy information management system, and this document complements it by setting expectations for how certification against that standard is carried out.

• Provides additional requirements and guidance for certification bodies.
• Used together with ISO/IEC 17021-1.
• Intended for auditing and certifying PIMS according to ISO/IEC 27701.
• Supports a consistent evaluation approach in privacy information management.