SOC 2 · P - Privacy
SOC 2 P6.2: P6.2 Record of authorised disclosures
SOC 2 P6.2 covers P6.2 Record of authorised disclosures. The held text names 2 evidence records for it, the first being Disclosure log with recipient, data, date and basis. The common gap an assessor flags is Disclosures made through integrations not logged.
A full, correct and up-to-date log of authorised disclosures of personal information is created and kept. Point of focus: the record of authorised disclosures is maintained completely, accurately and promptly.
What evidence supports P6.2?
- Disclosure recordsDisclosure log with recipient, data, date and basis
- Disclosure recordsEvidence the log is complete (for example reconciled to transfer jobs)
Where this requirement comes from
This is our own statement of SOC 2 P6.2, read from the copy we hold (issuer free complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Disclosures made through integrations not logged
- Log lacks the legal basis or data categories
How it maps to ISO 27001:2022
No reviewed link is held for this control.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.