P8.1 Inquiries, complaints, disputes and compliance monitoring

A process receives, handles, resolves and reports back on questions, complaints and disputes raised by individuals and others, compliance is monitored periodically, and corrections for identified deficiencies are made promptly. Points of focus: data subjects know how to contact the organisation; a process addresses inquiries, complaints and disputes; each complaint's resolution is documented and communicated; compliance with privacy objectives is reviewed, documented and reported to management with remediation plans for problems; instances of non-compliance are documented, reported and corrected or disciplined promptly; and ongoing monitoring checks the how well controls protecting personal information are working.

Source: SOC 2 (2017 Trust Services Criteria), P8.1. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open SOC 2 (2017 Trust Services Criteria) in the compliance library.

These are criteria, not controls: you design controls that meet them, and which criteria are in scope follows the categories your report covers (Security always; Availability, Confidentiality, Processing Integrity and Privacy only if chosen). A Type 2 report tests that the controls operated across the period, so the evidence asked for is samples across that period, not one copy.