TS EN ISO/IEC 27706

TS EN ISO/IEC 27706 defines requirements for bodies that perform audit and certification of privacy information management systems (PIMS). It addresses the competence and reliability of organisations certifying PIMS under ISO/IEC 27701, while also building on the general certification-body requirements of ISO/IEC 17021-1.

Role and competence in PIMS certification

A privacy information management system applies a management-system approach to the handling of personal data and privacy-related processes. In practice, certification bodies need more than generic auditing capability: they require consistent expertise in privacy, information security and conformity assessment. This standard focuses on how certification activities in that field are to be carried out with credibility and consistency; it does not describe the organisation’s internal privacy controls or the technical design of a PIMS itself.

What the scope means in practice

• Provides additional requirements for bodies certifying PIMS according to ISO/IEC 27701.
• Designed to be used together with ISO/IEC 17021-1, rather than as a standalone general certification framework.
• Addresses the competence, consistency and reliability expected from a certification body.
• Can be used as a criteria document for accreditation, peer assessment or other audit processes.

In general technical terms, the purpose of a document like this is to support certification that is carried out in a systematic and comparable way. It helps align auditor competence, assessment consistency and certification decision reliability, so that PIMS certification remains technically meaningful in the privacy management domain.