P5.2 Correction of personal information

Personal information is corrected, amended or supplemented on information from data subjects, and passed to third parties where committed or legally required; denied correction requests are explained. Points of focus: denials of access are explained in writing with any legal basis and the right to challenge where law allows; data subjects can update or correct their information and corrections reach third parties that received it; and denials of correction are explained in writing with how to appeal. The 2022 revision adds, for data processors, handling data controllers' update and correction requests under the service agreement, and passing on updates, corrections and deletion requests to recipients.

Source: SOC 2 (2017 Trust Services Criteria), P5.2. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open SOC 2 (2017 Trust Services Criteria) in the compliance library.

These are criteria, not controls: you design controls that meet them, and which criteria are in scope follows the categories your report covers (Security always; Availability, Confidentiality, Processing Integrity and Privacy only if chosen). A Type 2 report tests that the controls operated across the period, so the evidence asked for is samples across that period, not one copy.