SOC 2® privacy notice and consent in plain English
Unofficial plain-English guide. Not affiliated with or endorsed by the AICPA. Read the AICPA’s own criteria
An unofficial plain-English look at SOC 2 privacy criteria P1.1, P2.1, P3.1, and P3.2: what you tell people, what you ask first, and what you collect.
OrderFive custom security policies, $85 flat. Markdown, Word, and PDF.
Order the five policies
What do you tell people, and what do you ask before you take their data?
Privacy is the largest of the optional categories, and it is about personal information, not confidential business information. It fits companies that collect data about individuals, whether those people are customers or the customers’ own users.
The first group follows the moment of collection: the notice people see, the choices they get, how much you gather, and when you must ask first. This guide covers engineering and record-keeping habits only. It is not legal advice and doesn’t say what any privacy law requires.
Where a small team starts
Build a table of every personal data field you collect, with the purpose it serves and where it goes. It is a few hours of work, and it answers the questions in this group and the next three.
Compare the table with your privacy notice. Wherever the two disagree, fix the one that is wrong.
The criteria, P1.1 to P3.2
Below are our short labels, what the criteria are about, and examples of what a small team might do or keep. The examples are our own views, not requirements of the standard.
P1.1: Explaining your data practices
People get a privacy notice that says what is collected, why, and who receives it, and they hear when it changes.
In practice
- A privacy notice linked from the site and from sign-up screens.
- A dated version history of the notice.
- An email to users before a material change takes effect.
- A periodic check that the notice still matches what the product does.
P2.1: Offering choices, getting consent
Where a choice exists, people get to make it, and the company can show what they chose.
In practice
- An opt-in checkbox whose timestamp is stored with the account.
- An unsubscribe link in every marketing email.
- A short memo recording why implied consent is reasonable for a given flow.
P3.1: Collecting only what you need
The company collects personal information that serves its stated purposes, and gathers it by means people would consider fair and lawful.
In practice
- A review of form fields that removes the ones nobody uses.
- A table of each personal data field and the purpose it serves.
- A privacy question at the design stage of new features.
P3.2: Asking first for sensitive data
Where explicit consent is called for, such as for sensitive categories of data, it is requested before collection begins and the record is kept.
In practice
- A separate consent screen ahead of any sensitive field.
- A consent log tied to the account.
- A way for people to withdraw consent that actually changes what is collected.
Questions worth being able to answer
These are ours, not a list of what an examiner will ask. If you can answer each in a sentence, and show where the proof lives, you are in good shape for the conversation.
- Where is your privacy notice, and when did it last change?
- How do people opt in or out, and where is that choice recorded?
- Why do you collect this field?
- Which data would need consent before you collected it?
More topics in this guide
This page is one part of our unofficial guide to the SOC 2 Trust Services Criteria. Here are the others.
- Ownership and communication (CC1.1 to CC2.3)
- Risk, monitoring, and policies (CC3.1 to CC5.3)
- Access control (CC6.1 to CC6.3)
- Networks, devices, and places (CC6.4 to CC6.8)
- Detection and incident response (CC7.1 to CC7.5)
- Change management (CC8.1)
- Vendors and business disruption (CC9.1 to CC9.2)
- Availability (A1.1 to A1.3)
- Confidentiality (C1.1 to C1.2)
- Processing integrity (PI1.1 to PI1.5)
- Privacy: use, retention, quality (P4.1, P4.2, P4.3, P7.1)
- Privacy: requests and complaints (P5.1, P5.2, P6.7, P8.1)
- Privacy: sharing and breaches (P6.1 to P6.6)
Related guides
About this guide and the study tool
Who we are, and aren’t
Blank Slate Creative, LLC is not affiliated with, endorsed by, or sponsored by the AICPA, CIMA, or the Association of International Certified Professional Accountants. We are not a CPA firm. Only a licensed CPA firm can perform a SOC 2 examination and issue a report.
What this is, and isn’t
This is an unofficial, plain-English explanation written by Blank Slate Creative, LLC. It is not the Trust Services Criteria, and it does not reproduce or replace them.
It is not legal, audit, or attestation advice.
Using this guide or the study tool does not mean you will pass an audit or satisfy any customer or auditor.
The “in practice” notes and examples are our own views, not requirements of the standard.
Written about the 2017 criteria with the 2022 revised points of focus. The AICPA may revise them.
Read the AICPA’s own publication for the authoritative wording. The PDF download asks for a free AICPA account.
Trademarks
AICPA and American Institute of CPAs are trademarks of the American Institute of Certified Public Accountants and are registered in the US, the EU and other countries.
SOC 1®, SOC 2® and SOC 3® trademarks are registered trademarks of the AICPA.