SOC 2 · P - Privacy

SOC 2 SOC2-P1.1: P1.1 Privacy notice to data subjects

SOC 2 SOC2-P1.1 covers P1.1 Privacy notice to data subjects. The held text names 4 evidence records for it, the first being Published privacy notice with effective date and version history. The common gap an assessor flags is Privacy notice omits cookies or tracking technologies.

Data subjects receive notice of the organisation's privacy practices, updated and communicated promptly when practices, including uses of personal information, change. Points of focus: notice covers purpose of collection, choice and consent, types of information collected, collection methods such as cookies and tracking, how information is used, kept and disposed of, how individuals can see it, sharing with third parties, security, quality and the data subject's part in it, and monitoring and enforcement, and names other sources where information is not collected from the individual; notice is given at or before collection or soon after, before a notice change takes effect, and before new uses; the entities and activities covered are described objectively; and the notice is conspicuous and plainly written. The 2022 revision marks privacy points of focus as typical for data controllers, data processors or both, and adds for controllers that the notice is current, dated and easy to find, is reviewed periodically and updated, that data subjects are told of changes and their nature, and that earlier versions are retained as a record of what was communicated.