SOC 2 Disclosure and Notification

• P6.1 Disclosure With Consent

  The entity discloses personal information to third parties with the explicit consent of data subjects and such consent is obtained prior to disclosure to meet the entity’s objectives related to privacy.

• P6.2 Record of Authorized Disclosures

  The entity creates and retains a complete, accurate, and timely record of authorized disclosures of personal information to meet the entity’s objectives related to privacy.

• P6.3 Record of Unauthorized Disclosures

  The entity creates and retains a complete, accurate, and timely record of detected or reported unauthorized disclosures (including breaches) of personal information to meet the entity’s objectives related to privacy.

• P6.4 Third-Party Privacy Commitments

  The entity obtains privacy commitments from vendors and other third parties who have access to personal information to meet the entity’s objectives related to privacy. The entity assesses those parties’ compliance on a periodic and as-needed basis and takes corrective action, if necessary.

• P6.5 Third-Party Notification of Unauthorized Disclosures

  The entity obtains commitments from vendors and other third parties with access to personal information to notify the entity in the event of actual or suspected unauthorized disclosures of personal information. Such notifications are reported to appropriate personnel and acted on in accordance with established incident-response procedures to meet the entity’s objectives related to privacy.

• P6.6 Breach Notification to Data Subjects and Regulators

  The entity provides notification of breaches and incidents to affected data subjects, regulators, and others to meet the entity’s objectives related to privacy.

• P6.7 Accounting of Personal Information Held and Disclosed

  The entity provides data subjects with an accounting of the personal information held and disclosure of the data subjects’ personal information, upon the data subjects’ request, to meet the entity’s objectives related to privacy.

Need help putting this into practice? See our SOC 2 compliance services.