P1.1 Privacy notice to data subjects

Data subjects receive notice of the organisation's privacy practices, updated and communicated promptly when practices, including uses of personal information, change. Points of focus: notice covers purpose of collection, choice and consent, types of information collected, collection methods such as cookies and tracking, how information is used, kept and disposed of, how individuals can see it, sharing with third parties, security, quality and the data subject's part in it, and monitoring and enforcement, and names other sources where information is not collected from the individual; notice is given at or before collection or soon after, before a notice change takes effect, and before new uses; the entities and activities covered are described objectively; and the notice is conspicuous and plainly written. The 2022 revision marks privacy points of focus as typical for data controllers, data processors or both, and adds for controllers that the notice is current, dated and easy to find, is reviewed periodically and updated, that data subjects are told of changes and their nature, and that earlier versions are retained as a record of what was communicated.

Source: SOC 2 (2017 Trust Services Criteria), P1.1. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open SOC 2 (2017 Trust Services Criteria) in the compliance library.

These are criteria, not controls: you design controls that meet them, and which criteria are in scope follows the categories your report covers (Security always; Availability, Confidentiality, Processing Integrity and Privacy only if chosen). A Type 2 report tests that the controls operated across the period, so the evidence asked for is samples across that period, not one copy.