P3.1 Collecting personal information consistent with objectives

Personal information is collected in line with the organisation's privacy objectives. Points of focus: collection is limited to what the objectives need; collection methods are reviewed by management before use to confirm information is gathered fairly, without deception or intimidation, and lawfully; third-party sources are confirmed to be reliable and to collect fairly and lawfully; and data subjects are told when additional information about them is developed or acquired.

Source: SOC 2 (2017 Trust Services Criteria), P3.1. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open SOC 2 (2017 Trust Services Criteria) in the compliance library.

These are criteria, not controls: you design controls that meet them, and which criteria are in scope follows the categories your report covers (Security always; Availability, Confidentiality, Processing Integrity and Privacy only if chosen). A Type 2 report tests that the controls operated across the period, so the evidence asked for is samples across that period, not one copy.