SOC 2 · P - Privacy
SOC 2 SOC2-P3.1: P3.1 Collecting personal information consistent with objectives
SOC 2 SOC2-P3.1 covers P3.1 Collecting personal information consistent with objectives. The held text names 3 evidence records for it, the first being Data inventory showing purpose for each personal data field. The common gap an assessor flags is Fields collected with no documented purpose.
Personal information is collected in line with the organisation's privacy objectives. Points of focus: collection is limited to what the objectives need; collection methods are reviewed by management before use to confirm information is gathered fairly, without deception or intimidation, and lawfully; third-party sources are confirmed to be reliable and to collect fairly and lawfully; and data subjects are told when additional information about them is developed or acquired.
What evidence supports SOC2-P3.1?
- Data minimisationData inventory showing purpose for each personal data field
- Data minimisationPrivacy review of new collection forms or features
- Data minimisationDue diligence on third-party data sources
Where this requirement comes from
This is our own statement of SOC 2 SOC2-P3.1, read from the copy we hold (issuer free complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Fields collected with no documented purpose
- New data sources purchased with no lawfulness review
- Enrichment of profiles without informing individuals
How it maps to ISO 27001:2022
No reviewed link is held for this control.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.