SOC 2® privacy: access requests and complaints in plain English
Unofficial plain-English guide. Not affiliated with or endorsed by the AICPA. Read the AICPA’s own criteria
An unofficial plain-English look at SOC 2 privacy criteria P5.1, P5.2, P6.7, and P8.1: people asking to see or correct their data, and handling privacy complaints.
OrderFive custom security policies, $85 flat. Markdown, Word, and PDF.
Order the five policies
What do you do when someone asks what you hold about them?
Four criteria deal with what people can ask of you: to see their data, to fix it, to learn who else has received it, and to raise a complaint. They are about having a procedure and being able to show it ran.
A small company can go a long time without one of these requests, which is how a procedure goes stale. Then the first real request arrives, and nobody remembers who answers it or how to confirm the person asking is who they say.
Where a small team starts
Write the request procedure on one page: where requests arrive, who owns them, how you confirm identity, where the answer comes from, and the deadline you hold yourself to. Then run one sample request from start to finish and keep the result.
Put a privacy contact address in your notice, and route it to a person, not a shared inbox that nobody opens.
The criteria, P5.1, P5.2, P6.7, P8.1
Below are our short labels, what the criteria are about, and examples of what a small team might do or keep. The examples are our own views, not requirements of the standard.
P5.1: Letting people see their data
People can ask what the company holds about them and get access within reasonable limits. The company confirms who is asking and answers consistently.
In practice
- A published way to make a request, with an identity check.
- A response template and a tracker with deadlines.
- A data export feature in the product.
- A log of requests received and how each was handled.
P5.2: Correcting data when asked
A person who spots a mistake in their own data needs a route to get it fixed. A reviewer looks for a working request path and a record showing the requests were actually handled.
In practice
- Self-service profile editing.
- A log of correction requests and what was changed.
- A step that notifies downstream recipients of a fix.
- A reply template for requests the company can’t grant.
P6.7: What you hold, who got it
A person can ask what the company knows about them and where it has sent it, and the company can answer.
In practice
- A report built from the disclosure register.
- A written procedure for answering these requests.
- A yearly test run with one sample request, start to finish.
P8.1: Handling privacy questions and self-checks
People can raise privacy questions or complaints and get answers, and the company checks that it follows its own privacy commitments.
In practice
- An address for privacy questions, named in the notice.
- A tag and tracker for privacy complaints in the support system.
- A periodic internal privacy review that produces corrective actions.
- A log of resolved disputes.
Questions worth being able to answer
These are ours, not a list of what an examiner will ask. If you can answer each in a sentence, and show where the proof lives, you are in good shape for the conversation.
- How would someone ask to see their data, and who answers?
- How do you confirm the person asking is the person in the record?
- Show me the last correction you made, and who else was told.
- Where do privacy complaints go, and what happened to the last one?
More topics in this guide
This page is one part of our unofficial guide to the SOC 2 Trust Services Criteria. Here are the others.
- Ownership and communication (CC1.1 to CC2.3)
- Risk, monitoring, and policies (CC3.1 to CC5.3)
- Access control (CC6.1 to CC6.3)
- Networks, devices, and places (CC6.4 to CC6.8)
- Detection and incident response (CC7.1 to CC7.5)
- Change management (CC8.1)
- Vendors and business disruption (CC9.1 to CC9.2)
- Availability (A1.1 to A1.3)
- Confidentiality (C1.1 to C1.2)
- Processing integrity (PI1.1 to PI1.5)
- Privacy: notice and consent (P1.1 to P3.2)
- Privacy: use, retention, quality (P4.1, P4.2, P4.3, P7.1)
- Privacy: sharing and breaches (P6.1 to P6.6)
Related guides
About this guide and the study tool
Who we are, and aren’t
Blank Slate Creative, LLC is not affiliated with, endorsed by, or sponsored by the AICPA, CIMA, or the Association of International Certified Professional Accountants. We are not a CPA firm. Only a licensed CPA firm can perform a SOC 2 examination and issue a report.
What this is, and isn’t
This is an unofficial, plain-English explanation written by Blank Slate Creative, LLC. It is not the Trust Services Criteria, and it does not reproduce or replace them.
It is not legal, audit, or attestation advice.
Using this guide or the study tool does not mean you will pass an audit or satisfy any customer or auditor.
The “in practice” notes and examples are our own views, not requirements of the standard.
Written about the 2017 criteria with the 2022 revised points of focus. The AICPA may revise them.
Read the AICPA’s own publication for the authoritative wording. The PDF download asks for a free AICPA account.
Trademarks
AICPA and American Institute of CPAs are trademarks of the American Institute of Certified Public Accountants and are registered in the US, the EU and other countries.
SOC 1®, SOC 2® and SOC 3® trademarks are registered trademarks of the AICPA.