SOC 2 · P - Privacy
SOC 2 SOC2-P6.6: P6.6 Notifying breaches and incidents
SOC 2 SOC2-P6.6 covers P6.6 Notifying breaches and incidents. The held text names 3 evidence records for it, the first being Breach notification procedure mapping legal deadlines, methods and recipients by jurisdiction. The common gap an assessor flags is No documented decision on whether to notify.
Affected individuals, regulators and others are told of breaches and incidents as privacy objectives require. Points of focus: a process determines whether a privacy breach must be notified, by what method, by when and to whom (added in 2022); and notice of breaches and incidents is given to affected individuals, regulators and others.
What evidence supports SOC2-P6.6?
- Breach notificationBreach notification procedure mapping legal deadlines, methods and recipients by jurisdiction
- Breach notificationRecords of notification decisions and notices sent
- Breach notificationContract terms setting how the organisation, as processor, informs controller customers
Where this requirement comes from
This is our own statement of SOC 2 SOC2-P6.6, read from the copy we hold (issuer free complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- No documented decision on whether to notify
- Notification deadlines missed
- Customers (as controllers) not informed by the processor
How it maps to ISO 27001:2022
- 5.5 medium Breach notification to regulators evidences part of authority contact, not the full requirement.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.