SOC2-P5.1 P5.1 Data subject access
SOC2-P5.1 in SOC 2 (the AICPA 2017 Trust Services Criteria with the revised points of focus). All SOC 2 controls held. Open SOC 2 on the standards site.
The control as we hold it
P5.1 Data subject access. Identified and authenticated data subjects can see their stored personal information and, on request, receive physical or electronic copies; if access is denied they are told why, as objectives require. Points of focus: identity is authenticated before access is given; people can find out whether information about them is held and obtain it; it is provided in an understandable form, in reasonable time and at reasonable cost; and denials are explained promptly unless law prohibits it. The 2022 revision adds, for data processors, a process to act on data subject requests passed on by data controllers under the service agreement, including authenticating them, giving.
Reviewed and closest counterparts in the other frameworks
Reviewed rows come from a released pair; a closest match is the nearest held text and is not a reviewed row.
HIPAA Security Rule
- 164.308(a)(3)(i) Workforce Security (Standard) (closest match)
- 164.308(a)(4)(i) Information Access Management (Standard) (closest match)
- 164.308(a)(4)(ii)(B) Access Authorization (Addressable) (closest match)
- 164.312(a)(1) Access Control (Standard) (closest match)
NIST SP 800-53 Rev 5
- NIST800-AC-3 AC-3 Access Enforcement (closest match)
- NIST800-AC-6 AC-6 Least Privilege (closest match)
- NIST800-AC-16 AC-16 Security and Privacy Attributes (closest match)
- NIST800-AC-21 AC-21 Information Sharing (closest match)
- NIST800-CA-6 CA-6 Authorization (closest match)
- NIST800-CM-12 CM-12 Information Location (closest match)
- NIST800-IA-2 IA-2 Identification and Authentication (Organizational Users) (closest match)
- NIST800-PT-7 PT-7 Specific Categories of Personally Identifiable Information (closest match)
What an auditor commonly asks for
General guidance for this control area (domain: P - Privacy), in our words, not a statement of the standard and not binding on an assessor.
- the privacy notice and its change log
- the consent and preference records
- the data-subject request log with resolution
- the retention and disposal records