SOC2-P2.1 P2.1 Choice and consent
SOC2-P2.1 in SOC 2 (the AICPA 2017 Trust Services Criteria with the revised points of focus). All SOC 2 controls held. Open SOC 2 on the standards site.
The control as we hold it
P2.1 Choice and consent. Data subjects are told what choices they have over how personal information is collected, used, kept, shared and disposed of and the consequences of each; explicit consent is obtained where required and only for the intended purpose; and the basis for relying on implicit consent is documented. Points of focus: data subjects learn their choices and that consent is needed unless law provides otherwise; they learn the consequences of refusing or withdrawing consent; consent, implied or express, is obtained at or before collection or soon after and their preferences are honoured; new purposes are documented, notified and consented before use; explicit consent is.
Reviewed and closest counterparts in the other frameworks
Reviewed rows come from a released pair; a closest match is the nearest held text and is not a reviewed row.
NIST SP 800-53 Rev 5
- NIST800-PM-21 PM-21 Accounting of Disclosures (closest match)
- NIST800-PT-2 PT-2 Authority to Process Personally Identifiable Information (closest match)
- NIST800-PT-3 PT-3 Personally Identifiable Information Processing Purposes (closest match)
- NIST800-PT-4 PT-4 Consent (closest match)
- NIST800-PT-5 PT-5 Privacy Notice (closest match)
- NIST800-RA-8 RA-8 Privacy Impact Assessments (closest match)
- NIST800-SC-42 SC-42 Sensor Capability and Data (closest match)
What an auditor commonly asks for
General guidance for this control area (domain: P - Privacy), in our words, not a statement of the standard and not binding on an assessor.
- the privacy notice and its change log
- the consent and preference records
- the data-subject request log with resolution
- the retention and disposal records