SOC 2 · P - Privacy
SOC 2 SOC2-P6.4: P6.4 Privacy commitments from vendors and third parties
SOC 2 SOC2-P6.4 covers P6.4 Privacy commitments from vendors and third parties. The held text names 3 evidence records for it, the first being Data processing agreements with privacy clauses. The common gap an assessor flags is Vendors with personal data access lack a processing agreement.
Privacy commitments are obtained from vendors and others outside the organisation that can reach personal information, their compliance is assessed periodically and as needed, and corrective action is taken where necessary. Points of focus: information goes only to third parties with agreements to protect it consistently with the notice, whose controls are evaluated; and misuse by a third party that received information triggers remedial action. As revised in 2022, the organisation also has procedures to evaluate whether third parties meet their privacy commitments.
What evidence supports SOC2-P6.4?
- Vendor privacyData processing agreements with privacy clauses
- Vendor privacyPeriodic assessments of vendors' privacy compliance
- Vendor privacyRecords of remediation after vendor misuse
Where this requirement comes from
This is our own statement of SOC 2 SOC2-P6.4, read from the copy we hold (issuer free complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Vendors with personal data access lack a processing agreement
- No periodic check on vendor compliance
- Vendor misuse handled informally
How it maps to ISO 27001:2022
No reviewed link is held for this control.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.