Features Frameworks Guide Pricing

Frameworks · Global

SOC 2 Privacy

The Privacy category is an optional SOC 2 add-on to the Security criteria for how personal information is collected, used, retained, disclosed and disposed of. It covers privacy notices, choice and consent, data subject access and correction, third-party disclosures, data quality and complaint handling. Include it when your service handles personal information about your customers' users or collects it directly from individuals.

Version
2017 Trust Services Criteria (revised points of focus 2022)
Requirements
27, each mapped to ProofTrail’s controls
Try it in the demo $20 a year per installation

Requirements and controls

  • P1 Privacy Criteria Related to Notice and Communication

    • P1.0 Privacy notice and communication objectives

      The organization has a defined approach for telling data subjects about its privacy practices and the objectives those practices support.

      • Published Privacy Policy
      • Privacy Notices on Data Collection Forms

    • P1.1 Privacy notice to data subjects

      Data subjects receive a clear and timely privacy notice describing how their personal information is handled, which is updated and re-communicated when practices change.

      • Published Privacy Policy
      • Privacy Notices on Data Collection Forms
      • Privacy by Design Policy

  • P2 Privacy Criteria Related to Choice and Consent

    • P2.1 Data subject choice and consent

      Data subjects are told what choices they have over the collection, use, retention, disclosure and disposal of their personal information, and their consent is obtained and recorded where needed.

      • Consent Management
      • Personal Data Inventory
      • Contractual Obligations Register

  • P3 Privacy Criteria Related to Collection

    • P3.1 Collection limited to stated purposes

      Personal information is collected only to the extent needed for the purposes described in the privacy notice.

      • Data Protection Policy & Procedure
      • Personal Data Inventory
      • Published Privacy Policy
      • Privacy Notices on Data Collection Forms

    • P3.2 Explicit consent before collection

      When explicit consent is required, data subjects are told the consequences of refusing and their consent is obtained and documented before collection.

      • Personal Data Inventory
      • Consent Management
      • Published Privacy Policy
      • Privacy Notices on Data Collection Forms

  • P4 Privacy Criteria Related to Use, Retention, and Disposal

    • P4.1 Use limited to stated purposes

      Personal information is used only for the purposes identified in the privacy notice and agreed to by the data subject.

      • Identity Validation
      • Personal Data Inventory
      • Published Privacy Policy
      • Privacy Notices on Data Collection Forms

    • P4.2 Retention of personal information

      Personal information is kept only as long as its purpose or the law requires and is then marked for disposal.

      • Data Retention Policy
      • Personal Data Inventory
      • Published Privacy Policy
      • Privacy Notices on Data Collection Forms

    • P4.3 Secure disposal of personal information

      Personal information is securely deleted or destroyed when it is no longer needed, including on request from the data subject where applicable.

      • Data Retention Policy
      • Personal Data Inventory
      • Data Subject Requests
      • Published Privacy Policy
      • Privacy Notices on Data Collection Forms

  • P5 Privacy Criteria Related to Access

    • P5.1 Data subject access to personal information

      Authenticated data subjects can find out what personal information is held about them and get a copy of it on request.

      • Data Subject Requests
      • Published Privacy Policy
      • Privacy Notices on Data Collection Forms

    • P5.2 Correction of personal information

      Data subjects can ask for their personal information to be corrected or amended, and the organization makes the change or explains why it was refused.

      • Processor Data Protection Agreements
      • Data Subject Requests
      • Published Privacy Policy
      • Privacy Notices on Data Collection Forms

  • P6 Privacy Criteria Related to Disclosure and Notification

    • P6.1 Third-party disclosure with consent

      Personal information is shared with third parties only for the purposes in the privacy notice and with the data subject's consent where required.

      • Third-Party Criticality Assessments
      • Consent Management
      • Processor Data Protection Agreements
      • Data Protection Impact Assessments

    • P6.2 Records of authorized disclosures

      The organization keeps complete and accurate records of when and to whom personal information was disclosed with authorization.

      • Personal Data Inventory
      • Data Subject Requests
      • Privacy Officer

    • P6.3 Records of unauthorized disclosures

      Unauthorized disclosures of personal information, including breaches, are logged completely and accurately when they are detected or reported.

      • Incident Tracking
      • Data Breach Notification Policy
      • Breach Risk Assessment & Notification
      • Privacy Officer
      • PII Breach Notification Guidelines

    • P6.4 Third-party privacy commitments and oversight

      Vendors and other third parties that receive personal information are contractually bound to privacy commitments, and their compliance is reviewed with corrective action taken when needed.

      • Vendor Management Policy & Procedure
      • Cross-Border Data Transfers
      • Processor Data Protection Agreements

    • P6.5 Third-party notification of unauthorized disclosures

      Third parties that handle personal information must report any unauthorized disclosure promptly so the organization can respond and notify those affected.

      • Automated Incident Reporting
      • Cross-Border Data Transfers
      • Consent Management
      • Processor Data Protection Agreements
      • Breach Risk Assessment & Notification

    • P6.6 Breach notification to data subjects and regulators

      Affected data subjects, regulators and other required parties are notified of breaches and incidents involving personal information as the law and commitments require.

      • Automated Incident Reporting
      • Incident Tracking
      • Data Breach Notification Policy
      • Breach Risk Assessment & Notification
      • PII Breach Notification Guidelines

    • P6.7 Accounting of personal information and disclosures

      On request, data subjects receive an account of the personal information held about them and the third parties it was disclosed to.

      • Consent Management
      • Data Subject Requests

  • P7 Privacy Criteria Related to Quality

    • P7.1 Accuracy and quality of personal information

      Personal information is kept accurate, complete, current and relevant for the purposes it is used for.

      • Personal Data Inventory
      • Data Subject Requests
      • Privacy Officer
      • Published Privacy Policy
      • Privacy Notices on Data Collection Forms

  • P8 Privacy Criteria Related to Monitoring and Enforcement

    • P8.1 Privacy inquiries, complaints and compliance monitoring

      A process exists to receive, resolve and track privacy inquiries, complaints and disputes, and compliance with privacy commitments is monitored and corrected where needed.

      • Consent Management
      • Data Subject Requests
      • Published Privacy Policy

Also in SOC 2