TSE ISO/IEC TS 27006-2

TSE ISO/IEC TS 27006-2 addresses the requirements for bodies that audit and certify privacy information management systems (PIMS). It focuses on certification bodies assessing a PIMS established according to ISO/IEC 27701 in combination with ISO/IEC 27001, and on how those bodies demonstrate competence and reliability in certification activities.

Its role in PIMS certification

A PIMS is a management system approach used to systematically handle personal data protection and privacy obligations. This technical specification adds guidance for organizations that perform PIMS certification, helping ensure that certification processes are carried out consistently and with the technical understanding needed for privacy-related assessments. In general technical terms, that matters because certification quality depends not only on management system structure, but also on auditor competence, decision consistency, and trustworthy evaluation practices.

What the scope means in practice

• It applies in addition to the requirements in ISO/IEC 27006 and ISO/IEC 27701.
• It is intended to support bodies providing, or preparing to provide, PIMS certification.
• It can be used as a criteria document for accreditation.
• It may also serve as a basis for peer assessment and similar audit processes.

This document functions as a reference point for strengthening the technical and organizational discipline of PIMS certification. By clarifying the relationship between information security management and privacy management, it helps certification bodies apply more consistent and auditable evaluation practices in this field. This TSE record represents a withdrawn standard; its subject remains the certification competence framework for privacy information management systems.