Skip to content

SOC 2® privacy: use, retention, and accuracy in plain English

Unofficial plain-English guide. Not affiliated with or endorsed by the AICPA. Read the AICPA’s own criteria

An unofficial plain-English look at SOC 2 privacy criteria P4.1 to P4.3 and P7.1: using data as promised, holding it no longer than it is useful, and keeping it accurate.

By Blank Slate Creative.

OrderFive custom security policies, $85 flat. Markdown, Word, and PDF.

Order the five policies

Are you using, keeping, and deleting personal data the way you said you would?

Once personal data is in, three habits matter: use it only for what you said, keep it no longer than you need, and keep it accurate while you hold it. These criteria cover those habits, plus the secure disposal at the end.

The first is the easiest to break. A new analytics tool, a support integration, or an experiment with an AI service can quietly change what happens to personal data, and nobody asks whether the notice still fits.

Where a small team starts

Add one step to how you adopt new tools: before personal data flows to a new service, someone checks the purpose against the notice and records the answer. A line in the ticket is enough.

Then set retention periods for personal data and turn them into scheduled jobs. Without a scheduled job, a retention period is only a wish.

The criteria, P4.1, P4.2, P4.3, P7.1

Below are our short labels, what the criteria are about, and examples of what a small team might do or keep. The examples are our own views, not requirements of the standard.

P4.1: Using data only as promised

Personal data gets used for the reasons people were given and nothing else, and a new use needs new notice or consent.

In practice

  • A purpose column in the data inventory.
  • A review step before personal data goes into a new analytics or AI tool.
  • Access to production personal data limited to support and engineering tasks that need it.

P4.2: Retention limits for personal data

Personal information is retained only as long as its purposes require, and it is protected while the company holds it.

In practice

  • A retention schedule that names personal data types and periods.
  • Automatic removal of long-inactive accounts.
  • Test and staging copies of production data deleted on a schedule.

P4.3: Disposing of personal data securely

When personal information is no longer needed, it is destroyed so that recovery isn’t practical.

In practice

  • Deletion jobs that log what they removed.
  • Backups that expire on a cycle matching the retention schedule.
  • Deletion confirmations from vendors that processed the data.

P7.1: Keeping personal data accurate

The company works to keep the personal information it holds correct and up to date, and relevant to what it is used for.

In practice

  • Validation of emails and addresses at entry.
  • A periodic prompt asking users to confirm their details.
  • A deduplication job and a correction workflow.

Questions worth being able to answer

These are ours, not a list of what an examiner will ask. If you can answer each in a sentence, and show where the proof lives, you are in good shape for the conversation.

  • What is each kind of personal data used for?
  • How do you know a new tool isn’t using data beyond that?
  • How long do you keep an inactive user’s data?
  • Show me a deletion that actually ran.
  • How do you keep contact details current?

More topics in this guide

This page is one part of our unofficial guide to the SOC 2 Trust Services Criteria. Here are the others.

Related guides

About this guide and the study tool

Who we are, and aren’t

Blank Slate Creative, LLC is not affiliated with, endorsed by, or sponsored by the AICPA, CIMA, or the Association of International Certified Professional Accountants. We are not a CPA firm. Only a licensed CPA firm can perform a SOC 2 examination and issue a report.

What this is, and isn’t

This is an unofficial, plain-English explanation written by Blank Slate Creative, LLC. It is not the Trust Services Criteria, and it does not reproduce or replace them.

It is not legal, audit, or attestation advice.

Using this guide or the study tool does not mean you will pass an audit or satisfy any customer or auditor.

The “in practice” notes and examples are our own views, not requirements of the standard.

Written about the 2017 criteria with the 2022 revised points of focus. The AICPA may revise them.

Read the AICPA’s own publication for the authoritative wording. The PDF download asks for a free AICPA account.

Trademarks

AICPA and American Institute of CPAs are trademarks of the American Institute of Certified Public Accountants and are registered in the US, the EU and other countries.

SOC 1®, SOC 2® and SOC 3® trademarks are registered trademarks of the AICPA.

← All guides