P5.1 Data subject access

Identified and authenticated data subjects can see their stored personal information and, on request, receive physical or electronic copies; if access is denied they are told why, as objectives require. Points of focus: identity is authenticated before access is given; people can find out whether information about them is held and obtain it; it is provided in an understandable form, in reasonable time and at reasonable cost; and denials are explained promptly unless law prohibits it. The 2022 revision adds, for data processors, a process to act on data subject requests passed on by data controllers under the service agreement, including authenticating them, giving access where appropriate, answering in reasonable time and notifying any denial.

Source: SOC 2 (2017 Trust Services Criteria), P5.1. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open SOC 2 (2017 Trust Services Criteria) in the compliance library.

These are criteria, not controls: you design controls that meet them, and which criteria are in scope follows the categories your report covers (Security always; Availability, Confidentiality, Processing Integrity and Privacy only if chosen). A Type 2 report tests that the controls operated across the period, so the evidence asked for is samples across that period, not one copy.