Privacy is the SOC 2 category service organisations most often add by mistake or avoid by mistake: added because a customer asked for "privacy" when Confidentiality would have answered the question, or avoided when the organisation really does collect and decide on personal information and customers need assurance on how. This guide explains the eight privacy criteria groups, P1 to P8, in the AICPA 2017 Trust Services Criteria (with revised points of focus, 2022): what each criterion asks, the controls and evidence auditors usually expect, how the criteria apply when you are a processor rather than the party that collects data, and how Privacy differs from Confidentiality. It is written for privacy and compliance leads, CISOs and product owners at service organisations deciding whether to include Privacy in a SOC 2 report or preparing for one. Criterion wording is summarised from the AICPA text, which is a download behind a free AICPA account; check the official document before relying on detail.
Source note: criteria and point-of-focus titles are summarised from the AICPA 2017 Trust Services Criteria (with revised points of focus, 2022) as reproduced by a secondary reference; evidence examples are practitioner norms, not AICPA requirements. On 28 October 2026 the AICPA published exposure drafts of proposed 2027 Trust Services Criteria, with comments due 15 January 2027 and a proposed effective date for engagements beginning on or after 31 December 2027 if approved. Those proposals are not yet in force and their effect on the privacy criteria was not confirmed for this guide. Confirm against the official text before relying on it.
Key takeaways
- Privacy covers the whole personal information life cycle. Eighteen criteria across P1 to P8 address notice, choice and consent, collection, use, retention and disposal, access, disclosure and notification, quality, and monitoring and enforcement.
- Confidentiality is narrower and often the right answer. Confidentiality protects any information designated confidential, including customer data held as a processor; Privacy tests how personal information is collected, used and disclosed against notices and commitments.
- Processors can still report on Privacy. The 2022 revised points of focus include some that apply only to data controllers and others only to processors (Drata summary of the revision); criteria that do not apply are explained in the system description.
- The privacy notice is the test baseline. Auditors test practice against your published notice and contractual commitments, so a notice that promises more than operations deliver produces exceptions.
- Privacy evidence is operational. Data subject request logs, consent records, disclosure records, deletion evidence and complaint handling records over the whole Type 2 period are what get sampled.
Where Privacy sits in SOC 2
The Trust Services Criteria have five categories: Security (the common criteria CC1 to CC9, always in scope), Availability, Processing Integrity, Confidentiality and Privacy. The service organisation chooses which of the last four to add. Privacy is the largest additional category. See the SOC 2 Guide for the examination itself and the How to Read a SOC 2 Report Guide for how customers read the results.
The privacy criteria descend from the AICPA and CPA Canada Generally Accepted Privacy Principles (GAPP, 2009). GAPP was updated by the AICPA's 2020 Privacy Management Framework, a voluntary programme framework with nine components (management; agreement, notice and communication; collection and creation; use, retention and disposal; access; disclosure to third parties; security for privacy; data integrity and quality; monitoring and enforcement). The PMF is useful for building the programme; the SOC 2 report is tested against the P criteria.
Privacy or Confidentiality
| Question | Confidentiality (C1.1, C1.2) | Privacy (P1 to P8) |
|---|---|---|
| What information | Any information designated confidential: customer data, trade secrets, contracts, source code | Personal information about identifiable individuals |
| What is tested | Identifying, protecting and disposing of confidential information | Notice, consent, collection, use, retention, disposal, data subject access, disclosure, quality, complaints |
| Typical role of the service organisation | Processor or custodian of customer data | Collects personal information directly, or processes it with privacy commitments to controllers |
| Who relies on the report | Customers wanting assurance their data is protected and deleted | Customers, and through them regulators and data subjects, wanting assurance on handling of personal information |
| Effort | Two criteria, modest additional evidence | Eighteen criteria, a privacy programme, and life cycle evidence |
- Choose Confidentiality when: you process customer data on instructions, customers mainly want to know it is protected, access controlled and deleted at contract end, and you make no direct promises to data subjects.
- Choose Privacy when: you collect personal information from individuals through your own product or site, you make privacy commitments in contracts or a public notice that customers rely on, or customers in regulated sectors need assurance mapped to GDPR, HIPAA or state privacy laws.
- Both: common for HR, health, payments and consumer platforms. Many controls (classification, retention, disposal) serve both.
Privacy in SOC 2 is not a certification of legal compliance. A clean opinion says controls met the criteria against your stated commitments; it does not say you comply with GDPR. See the GDPR Compliance Guide for Security Teams and the ISO/IEC 27701 guide for the management system route; ISO/IEC 27701:2025 (edition 2, October 2025) is now a standalone privacy information management system standard.
The criteria at a glance
| Group | Criteria | What they ask (condensed) | Selected points of focus |
|---|---|---|---|
| P1 Notice | P1.1 | Provide notice to data subjects about privacy practices | Covers entities and activities in notice; clear language, current and easy to find; reviews the notice; communicates changes; retains prior notices |
| P2 Choice and consent | P2.1 | Communicate choices on collection, use, retention, disclosure and disposal, and obtain consent where needed | Consequences of denying or withdrawing consent; implicit or explicit consent; consent for new purposes; explicit consent for sensitive information; consent for data transfers |
| P3 Collection | P3.1, P3.2 | Collect personal information consistent with privacy objectives; for information needing explicit consent, communicate the need and obtain and document it | Limits collection; fair and lawful means; reliable sources; informs data subjects when additional information is acquired; documents explicit consent |
| P4 Use, retention, disposal | P4.1, P4.2, P4.3 | Limit use to identified purposes; retain consistent with objectives; dispose securely | Uses for intended purposes; retains and protects; captures and flags deletion requests; disposes, destroys and redacts |
| P5 Access | P5.1, P5.2 | Let identified and authenticated data subjects access their information; correct, amend or append it on request | Authenticates data subjects; understandable response within reasonable time; communicates denials |
| P6 Disclosure and notification | P6.1 to P6.7 | Disclose to third parties only with consent or as permitted; record authorised and unauthorised disclosures; obtain privacy commitments from vendors; notify breaches; give data subjects an accounting of information held and disclosed | Discloses only to appropriate third parties; evaluates third-party compliance; obtains commitments to report unauthorised disclosures; identifies reporting requirements; provides notice of breaches and incidents |
| P7 Quality | P7.1 | Collect and maintain accurate, up-to-date, complete and relevant personal information | Ensures accuracy and completeness; ensures relevance |
| P8 Monitoring and enforcement | P8.1 | Receive, address, resolve and communicate the resolution of inquiries, complaints and disputes, and monitor compliance | Addresses inquiries, complaints and disputes; documents dispute resolution and recourse; reports compliance review results and noncompliance; performs ongoing monitoring |
Controls and evidence by group
P1 and P2: notice, choice and consent
- Controls: a version-controlled privacy notice with an owner and annual review; a change process that tells users of material changes; a consent management platform or product consent flags that record what each user agreed to and when.
- Evidence: current and prior notice versions with dates, review sign-off, change communications, and a sample of consent records matched to the notice version in force at the time. See the Consent Management Guide.
P3 and P4: collection, use, retention and disposal
- Controls: a data inventory and record of processing listing personal information categories, purposes and retention; privacy review in the product change process so new fields and purposes are assessed; retention schedules enforced by automated deletion jobs; deletion request handling that reaches backups, logs, analytics and vendors.
- Evidence: the inventory, privacy reviews or DPIAs for changes in the period, deletion job logs and exception reports, and a sample of deletion requests traced to completion. See the Data Mapping and ROPA Guide, the DPIA Guide and the Data Retention and Secure Deletion Guide.
P5: access and correction
- Controls: a request intake channel, identity verification proportionate to the data returned, a deadline tracked per request, documented reasons for denials, and a route for requests forwarded by customers acting as controllers.
- Evidence: the request log for the whole period, a sample with verification records, response dates and the data returned. Identity verification is the weak point: returning a full profile to an unverified requester is itself a disclosure. See the DSAR Guide.
P6: disclosure and notification
- Controls: an approved list of sub-processors and third parties with data processing agreements that include privacy and breach-reporting commitments; a disclosure register, including law enforcement requests; vendor reviews; and an incident procedure that identifies notification duties by jurisdiction and contract.
- Evidence: agreements for sampled vendors, vendor review records, the disclosure register, unauthorised disclosure records from incidents, and notification decisions with timing. See the Breach Notification Laws by Country Guide.
P7 and P8: quality, monitoring and enforcement
- Controls: user self-service to update details and data quality checks on key fields; a complaints and inquiries process with tracking; periodic internal privacy compliance reviews with findings reported to management.
- Evidence: complaint log with resolution dates, compliance review reports, and remediation tickets for noncompliance found.
When you are a processor
Many SaaS vendors process personal information on behalf of customers who are the controllers. The criteria still apply, but differently. Some of the 2022 revised points of focus are written for processors supporting the controller rather than answering data subjects directly. Criteria that rest on a direct relationship with data subjects, such as presenting a notice under P1.1, may be the controller's responsibility; the system description should say which criteria are not applicable and why, and list complementary user entity controls the customer must operate, such as giving notice and obtaining consent. Agree this split with your auditor during readiness, not during fieldwork.
Where identity fits
Most personal information in a SaaS estate is touched by non-human identities: ETL jobs, analytics exports, support tooling integrations, backup agents and, increasingly, AI agents with read access to customer records. Each is a potential undisclosed use or disclosure under P4.1 and P6.1. Keep an inventory of service accounts and integrations with access to personal information, the purpose each serves and the third party behind it, and review it alongside the sub-processor list. OAuth integrations to support or CRM tools are a common unrecorded disclosure path; the Salesloft Drift breach showed customer contact data reached through one integration's tokens. See the AI and Privacy Guide and the SOC 2 CC6 Logical Access Guide.
How to implement
- Decide scope. Use the table above to choose Privacy, Confidentiality or both, and record why. Confirm whether you act as controller, processor or both for each data set.
- Write commitments down. Align the public notice, customer data processing agreements and the system description so the auditor tests one consistent set of promises.
- Build the inventory. Personal information categories, systems, purposes, retention and third parties, including non-human identities with access.
- Close design gaps. Consent recording, request handling, deletion that reaches every store, disclosure register, vendor commitments and complaint handling.
- Dry run. Pick ten historic requests and five deletions and trace them end to end before the period starts.
- Type 1, then Type 2. Confirm design, then collect operating evidence from day one of the period in a dated repository. See the SOC 2 Readiness Checklist.
- Handle exceptions openly. A late request or missed deletion found in the period should be recorded with root cause and remediation; auditors treat a documented, corrected failure better than a gap they discover.
Detection and measurement
- Monitor: bulk exports of personal information, new integrations granted access to customer data, deletion job failures, data subject request deadline breaches, and access to personal information by service accounts outside their stated purpose.
| Metric | Why it matters |
|---|---|
| Data subject requests closed within the committed deadline | P5 operating evidence |
| Deletion requests verified complete across all stores, including vendors | P4.3 operating evidence |
| Third parties with personal information access and a current agreement and review | P6.1, P6.4 and P6.5 coverage |
| Product changes touching personal information with a privacy review | P3.1 and P4.1 design effectiveness |
| Complaints resolved within target, and repeat complaints | P8.1 effectiveness |
| Days from privacy incident detection to notification decision | P6.6 readiness |
Framework mapping
| Privacy group | NIST SP 800-53 Rev. 5 | ISO/IEC 27001:2022 Annex A | GDPR (indicative) |
|---|---|---|---|
| P1 Notice | PT-5 Privacy Notice | A.5.34 | Art. 12 to 14 |
| P2, P3 Choice, consent, collection | PT-2, PT-3, PT-4 Consent, PT-7 | A.5.34 | Art. 5(1)(b) and (c), 6, 7, 9 |
| P4 Use, retention, disposal | PT-3, SI-12, SI-12(3) | A.8.10 Information deletion | Art. 5(1)(e), 17 |
| P5 Access and correction | PT-2, SI-18 | A.5.34 | Art. 15, 16 |
| P6 Disclosure and notification | PM-21 Accounting of Disclosures, SR-6 | A.5.19, A.5.20, A.5.24 | Art. 28, 33, 34 |
| P7 Quality | SI-18 PII Quality Operations | A.5.34 | Art. 5(1)(d) |
| P8 Monitoring and enforcement | PM-26 Complaint Management | A.5.35, A.5.36 | Art. 77 (right to complain) |
NIST CSF 2.0 places legal and privacy obligations under GV.OC-03. The GDPR column is indicative only: SOC 2 tests your commitments, not compliance with the Regulation. For the NIST privacy control family see the NIST SP 800-53 Privacy Controls and FIPS 199/200 Categorisation Guide.
Common failure patterns
- Privacy chosen when Confidentiality was asked for: a processor takes on eighteen criteria it cannot fully operate and carries not-applicable explanations and exceptions it did not need.
- Notice and practice disagree: the notice lists retention or sharing that engineering does not enforce; the auditor tests the notice.
- Deletion stops at the primary database: copies in analytics, logs, backups, AI training sets or vendor systems survive. See AI Data Retention and Deletion.
- Weak requester verification: access requests answered by email without verifying identity, creating the disclosure P5.1 is meant to prevent.
- Integrations not treated as disclosures: an OAuth app or support tool receiving personal information is missing from the sub-processor list and disclosure register.
- No evidence of the request log over the period: requests handled in a shared inbox leave nothing an auditor can sample.
Practitioner checklist
- Scoping decision for Privacy versus Confidentiality recorded, with controller and processor roles per data set.
- Privacy notice, agreements and system description consistent, with prior notice versions retained.
- Personal information inventory covering systems, purposes, retention, third parties and non-human identities.
- Consent records traceable to the notice version in force.
- Data subject request process with identity verification, deadlines and a complete log.
- Deletion verified across primary stores, derived data and vendors.
- Disclosure register and vendor privacy commitments, reviewed at least annually.
- Incident procedure that identifies notification duties and records decisions.
- Complaint handling and periodic privacy compliance review with tracked remediation.
Standards and references
- AICPA: 2017 Trust Services Criteria (With Revised Points of Focus, 2022)
- AICPA: Proposed update of SOC 2 Trust Services Criteria
- Indiana CPA Society: AICPA Privacy Management Framework overview
- ISO: ISO/IEC 27701:2025 Privacy information management systems
- EUR-Lex: Regulation (EU) 2016/679 (GDPR)
- NIST: SP 800-53 Rev. 5
- Cloudaware: SOC 2 criteria and points of focus reference
Related NHI Mgmt Group resources: SOC 2 Guide · SOC 2 Availability Criteria Guide · SOC 2 Processing Integrity Criteria Guide · DSAR Guide · SOC 2 Auditor Selection. This guide summarises the AICPA SOC 2 privacy criteria and is not legal advice.