P2.1 Choice and consent

Data subjects are told what choices they have over how personal information is collected, used, kept, shared and disposed of and the consequences of each; explicit consent is obtained where required and only for the intended purpose; and the basis for relying on implicit consent is documented. Points of focus: data subjects learn their choices and that consent is needed unless law provides otherwise; they learn the consequences of refusing or withdrawing consent; consent, implied or express, is obtained at or before collection or soon after and their preferences are honoured; new purposes are documented, notified and consented before use; explicit consent is obtained directly for sensitive information unless law says otherwise; and consent is obtained before information moves onto or off a person's device.

Source: SOC 2 (2017 Trust Services Criteria), P2.1. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open SOC 2 (2017 Trust Services Criteria) in the compliance library.

These are criteria, not controls: you design controls that meet them, and which criteria are in scope follows the categories your report covers (Security always; Availability, Confidentiality, Processing Integrity and Privacy only if chosen). A Type 2 report tests that the controls operated across the period, so the evidence asked for is samples across that period, not one copy.