SOC 2 · P - Privacy
SOC 2 P2.1: P2.1 Choice and consent
SOC 2 P2.1 covers P2.1 Choice and consent. The held text names 4 evidence records for it, the first being Consent capture records and preference management system. The common gap an assessor flags is Consent not recorded or not retrievable.
Data subjects are told what choices they have over how personal information is collected, used, kept, shared and disposed of and the consequences of each; explicit consent is obtained where required and only for the intended purpose; and the basis for relying on implicit consent is documented. Points of focus: data subjects learn their choices and that consent is needed unless law provides otherwise; they learn the consequences of refusing or withdrawing consent; consent, implied or express, is obtained at or before collection or soon after and their preferences are honoured; new purposes are documented, notified and consented before use; explicit consent is obtained directly for sensitive information unless law says otherwise; and consent is obtained before information moves onto or off a person's device.
What evidence supports P2.1?
- Consent managementConsent capture records and preference management system
- Consent managementDocumented basis for implicit consent
- Consent managementCookie consent configuration and logs
- Consent managementRecords of consent obtained for new purposes
Where this requirement comes from
This is our own statement of SOC 2 P2.1, read from the copy we hold (issuer free complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Consent not recorded or not retrievable
- Withdrawal of consent not honoured in downstream systems
- Sensitive information processed without explicit consent
How it maps to ISO 27001:2022
No reviewed link is held for this control.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.