SOC2-P5.2 P5.2 Correction of personal information
SOC2-P5.2 in SOC 2 (the AICPA 2017 Trust Services Criteria with the revised points of focus). All SOC 2 controls held. Open SOC 2 on the standards site.
The control as we hold it
P5.2 Correction of personal information. Personal information is corrected, amended or supplemented on information from data subjects, and passed to third parties where committed or legally required; denied correction requests are explained. Points of focus: denials of access are explained in writing with any legal basis and the right to challenge where law allows; data subjects can update or correct their information and corrections reach third parties that received it; and denials of correction are explained in writing with how to appeal. The 2022 revision adds, for data processors, handling data controllers' update and correction requests under the service agreement, and passing on.
Reviewed and closest counterparts in the other frameworks
Reviewed rows come from a released pair; a closest match is the nearest held text and is not a reviewed row.
NIST SP 800-53 Rev 5
- NIST800-PM-22 PM-22 Personally Identifiable Information Quality Management (closest match)
- NIST800-SI-18 SI-18 Personally Identifiable Information Quality Operations (closest match)
What an auditor commonly asks for
General guidance for this control area (domain: P - Privacy), in our words, not a statement of the standard and not binding on an assessor.
- the privacy notice and its change log
- the consent and preference records
- the data-subject request log with resolution
- the retention and disposal records