SOC 2 · P - Privacy
SOC 2 P4.1: P4.1 Limiting use to identified purposes
SOC 2 P4.1 covers P4.1 Limiting use to identified purposes. The held text names 3 evidence records for it, the first being Records of processing mapping data to purposes. The common gap an assessor flags is Personal data reused for analytics or AI training outside stated purposes.
The privacy objectives name purposes, and personal information is put to no use beyond them. Points of focus: personal information serves only the purposes it was collected for and only with implicit or explicit consent, unless law requires otherwise.
What evidence supports P4.1?
- Purpose limitationRecords of processing mapping data to purposes
- Purpose limitationPrivacy review or impact assessment before new uses
- Purpose limitationAccess controls restricting use to authorised purposes
Where this requirement comes from
This is our own statement of SOC 2 P4.1, read from the copy we hold (issuer free complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Personal data reused for analytics or AI training outside stated purposes
- No review before repurposing data
- Purposes documented only in the notice, not in operations
How it maps to ISO 27001:2022
- 5.34 high Limiting use of personal information to stated purposes is core PII protection practice.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.