P6.7 Accounting of personal information held and disclosed

On request, data subjects receive a report of what personal information is held about them and its disclosures. Points of focus: the types of personal and sensitive personal information, and the processes, systems and third parties that handle them, are identified; and requests for an accounting are captured and answered. The 2022 revision adds, for data processors, answering data controllers when they ask what personal information the processor holds, in line with service agreements.

Source: SOC 2 (2017 Trust Services Criteria), P6.7. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open SOC 2 (2017 Trust Services Criteria) in the compliance library.

These are criteria, not controls: you design controls that meet them, and which criteria are in scope follows the categories your report covers (Security always; Availability, Confidentiality, Processing Integrity and Privacy only if chosen). A Type 2 report tests that the controls operated across the period, so the evidence asked for is samples across that period, not one copy.