TSE CEN ISO/IEC/TS 27006-2

TSE CEN ISO/IEC/TS 27006-2 is a technical specification for bodies that audit and certify privacy information management systems (PIMS). It focuses on how certification bodies should demonstrate competence and reliability when carrying out PIMS audit and certification activities based on ISO/IEC 27701 in combination with ISO/IEC 27001, adding a privacy-specific layer to the broader practice of information security management system certification.

The role of certification bodies in PIMS assurance

In general technical context, a PIMS certification body must be able to interpret privacy management controls, the organization’s personal data processing context, and the relationship between ISO/IEC 27001 and ISO/IEC 27701. This document centers on that assurance role: it addresses the requirements and interpretive guidance needed so that PIMS certification is carried out by bodies that can consistently evaluate privacy-related management system claims with competence and reliability.

What this technical specification adds

The document adds requirements and guidance on top of ISO/IEC 27006 and ISO/IEC 27701. It is positioned as a criteria document for accreditation, peer assessment, or similar audit processes, so it is useful not only as a technical reference but also as a basis for evaluating certification bodies themselves. In practical terms, it does not define a PIMS; it defines the expectations for the bodies that certify one.

• Targets PIMS certification bodies working with ISO/IEC 27701 and ISO/IEC 27001.
• Requires competence and reliability to be demonstrated by the certifying body.
• Provides additional interpretation to support application of ISO/IEC 27006 and ISO/IEC 27701.
• Can serve as a criteria document for accreditation, peer assessment, or other audit processes.