P6.1 Disclosure to third parties with consent

Third parties receive personal information only with the data subject's explicit consent obtained beforehand. Points of focus: privacy policies or handling instructions are communicated to recipients; disclosure happens only for the collection purposes and with implicit or explicit consent unless law requires otherwise; only to third parties with agreements to protect the information consistently with the notice, whose controls are evaluated; and disclosure for new purposes requires prior consent.

Source: SOC 2 (2017 Trust Services Criteria), P6.1. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open SOC 2 (2017 Trust Services Criteria) in the compliance library.

These are criteria, not controls: you design controls that meet them, and which criteria are in scope follows the categories your report covers (Security always; Availability, Confidentiality, Processing Integrity and Privacy only if chosen). A Type 2 report tests that the controls operated across the period, so the evidence asked for is samples across that period, not one copy.