SOC 2 · P - Privacy
SOC 2 SOC2-P3.2: P3.2 Explicit consent before collecting information that requires it
SOC 2 SOC2-P3.2 covers P3.2 Explicit consent before collecting information that requires it. The held text names 3 evidence records for it, the first being Explicit consent wording and capture mechanism for sensitive data. The common gap an assessor flags is Sensitive data collected before consent is captured.
Where information requires explicit consent, the need for consent and the consequences of withholding it are explained, and consent is obtained before collection. Points of focus: explicit consent is obtained directly for sensitive personal information unless law says otherwise; and documentation of that consent is retained in line with privacy objectives.
What evidence supports SOC2-P3.2?
- Consent managementExplicit consent wording and capture mechanism for sensitive data
- Consent managementRetained consent records linked to data subjects
- Consent managementInventory of sensitive personal information categories
Where this requirement comes from
This is our own statement of SOC 2 SOC2-P3.2, read from the copy we hold (issuer free complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Sensitive data collected before consent is captured
- Consent records not retained
- Sensitive categories not identified
How it maps to ISO 27001:2022
No reviewed link is held for this control.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.