SOC 2 · P - Privacy

SOC 2 SOC2-P6.1: P6.1 Disclosure to third parties with consent

SOC 2 SOC2-P6.1 covers P6.1 Disclosure to third parties with consent. The held text names 3 evidence records for it, the first being Register of third parties receiving personal information and the basis for each. The common gap an assessor flags is Sub-processors not listed or disclosed.

Third parties receive personal information only with the data subject's explicit consent obtained beforehand. Points of focus: privacy policies or handling instructions are communicated to recipients; disclosure happens only for the collection purposes and with implicit or explicit consent unless law requires otherwise; only to third parties with agreements to protect the information consistently with the notice, whose controls are evaluated; and disclosure for new purposes requires prior consent.