SOC 2 privacy criteria

The SOC 2 privacy criteria, SOC 2 P1.1 to P8.1, test how a service handles personal information through its life: notice, choice and consent, collection, use and retention, access, disclosure and breach notification, quality, and complaints. Add the category only when you collect personal information for your own purposes or a customer asks; GDPR applies either way.

The requirement in plain English

Privacy is one of the four optional categories, organised as eight series. Each criterion is measured against your own privacy commitments: what your notice and contracts say you do.

Notice (SOC 2 P1.1): you tell people about your privacy practices.
Choice and consent (SOC 2 P2.1): you explain the choices people have and get consent where your commitments need it.
Collection (SOC 2 P3.1 and P3.2): you collect only what your objectives need, with explicit consent where it is required.
Use, retention and disposal (SOC 2 P4.1 to P4.3): you use personal information only for the stated purposes, keep it no longer than needed, and dispose of it securely.
Access (SOC 2 P5.1 and P5.2): people can see their information and have it corrected.
Disclosure and notification (SOC 2 P6.1 to P6.7): the largest series. You disclose only as committed, keep records of disclosures, hold suppliers to matching commitments, and notify people and customers of breaches.
Quality (SOC 2 P7.1): the information you hold is accurate, complete and relevant.
Monitoring and enforcement (SOC 2 P8.1): you handle enquiries, complaints and disputes, and check that you keep your commitments.

UK and EU GDPR are law; SOC 2 privacy is a voluntary report. GDPR starts from a lawful basis for each purpose, adds duties the criteria do not test (data protection impact assessments, records of processing, rules on international transfers), and gives a regulator powers to enforce. The privacy criteria start from the commitments you choose to make and ask whether your controls keep them, with notice and choice at the centre. A clean SOC 2 privacy opinion does not show GDPR compliance, and a GDPR programme does not by itself produce SOC 2 privacy evidence, though much of the work overlaps.

When to leave it out

The criteria fit an organisation that collects personal information from people directly. If you process personal data only on your customers’ instructions, as a GDPR processor, many criteria (notice, consent, access) are your customers’ to meet. In that case Security plus Confidentiality usually answers what customers ask, and your processor duties under GDPR stay as they are.

This is guidance to help you understand the requirement, not legal advice.

What good looks like

A 30-person consumer health app company in London collects personal information directly from users, and a US insurance partner asks for SOC 2 with Privacy. Its privacy notice is versioned, shown at sign-up and linked in the app, and every change is dated. Optional uses such as research need a separate in-app consent, recorded with the notice version the person saw.

A data inventory lists each category of personal information, its purpose and its retention period, and a monthly job deletes what has expired. Users can download and correct their data in the app; requests that need a person go to a tracked queue with a target response time. A disclosure log records every sharing with a third party, and each supplier’s contract carries matching privacy terms.

The breach procedure sets who decides on notification and how quickly users and partners hear. Complaints have their own tracked channel, and the privacy lead reviews the queue, the log and the inventory every quarter and records what changed.

Evidence an auditor expects

The criteria name no documents; these are what SOC 2 auditors usually sample for the P series.

Privacy notice versions: dated, with evidence of where and when each was shown.
Consent records: who agreed to what, against which notice version.
Data inventory and retention schedule: categories, purposes and periods, with deletion evidence.
Access and correction requests: a sample, with response times against your commitments.
Disclosure records: third parties and what was shared, under which commitment.
Supplier contracts: privacy terms for each supplier handling personal information.
Breach records and notifications: decisions, timing and who was told.
Complaints and enquiries log: each one tracked to resolution.

Common mistakes

Adding Privacy as a processor

A processor that adds the category ends up explaining why most of the notice and consent criteria do not apply. Check your role first; Confidentiality may answer the customer’s question.

A GDPR programme gives you notices, a retention schedule and a request process, but often no disclosure log or consent records tied to a notice version. Map your GDPR evidence to the eight series before the period starts.

A notice that says more than you do

The auditor tests against your notice. A promise in it that no control keeps becomes an exception. Edit the notice or build the control.

No record of disclosures

The disclosure series needs a record of what went to whom. Sharing through integrations and support tools counts too.

How Sted helps

Sted’s SOC 2 catalogue holds the privacy category as eight series-level rows, P1.0 to P8.0, rather than as individual criteria, and no policy or record template in Sted’s knowledge base is mapped to them.
The SOC 2 privacy criteria are listed on the SoA card but Sted’s knowledge base has nothing to draft for them.
For UK GDPR and for EU GDPR Sted’s knowledge base carries 34 policies, procedures and notices and 35 record templates each, led by the Personal Data Protection Policy, the Data Subject Rights Handling Policy, the Data Retention and Erasure Policy and the two privacy notices.
Sted keeps a Statement of Applicability for each adopted standard with a control catalogue.
Only standards with a control catalogue get a Statement of Applicability card.
You can exclude a control with a coded reason and justification and record its implementation status.

Sted’s knowledge base carries its privacy documents for GDPR and keeps the SOC 2 privacy criteria at series level by design. Sted does not judge whether your privacy practices meet them or the law.

GDPR: the law that applies to your personal data whether or not you add the category.
Records of processing: the GDPR inventory that feeds the data inventory above.
Data subject access requests: handling the access requests the P5 series tests.
SOC 2 confidentiality criteria: the category that usually suits a processor better.
The SOC 2 hub: choosing categories for your report.

Frequently asked questions

Does a SOC 2 privacy report show we comply with GDPR?

No. A SOC 2 privacy opinion says your controls met the AICPA privacy criteria against your own privacy commitments. GDPR tests things the criteria do not, such as your lawful basis, data protection impact assessments and international transfers, and only a regulator or court decides compliance.

Should a UK B2B software company add the privacy category?

Usually not, if you process personal data on your customers’ instructions. Many of the criteria then belong to your customers, and Security with Confidentiality answers what they ask. Add Privacy when you collect personal information for your own purposes or a customer specifically asks for it.