Confidentiality / Privacy
Choices, consent, and disclosure requirements for personal information are communicated, obtained where required, recorded, and reflected in approved data processing workflows.
Use this guide to put the control into operation, decide what records to retain, and check that an auditor can trace the evidence back to the work your team performed.
Maintained by GreenHat Security · Reviewed August 21, 2026
When a choice, consent, or authorized disclosure is applicable, the company communicates it clearly, records the person’s or customer’s decision, enforces that state throughout processing, and logs disclosures with an approved purpose and recipient.
First SOC 2 program
Map the few product choices and disclosures that matter most, such as marketing preferences, optional analytics, customer-directed sharing, or release to a third party. Store the decision with time, notice version, scope, and account, and make withdrawal as operable as the original choice.
As the company scales
Use a central preference service or governed consent state with version history and downstream propagation. Connect disclosure approval to support, legal, privacy, and data systems, and reconcile whether revoked choices actually stop processing in analytics, messaging, and integrations.
Document processing that requires or offers a choice, consent, customer instruction, or disclosure authorization based on the company’s commitments and applicable advice.
You should end up with: A register of governed activities with owner, audience, and decision rule.
Explain the purpose, data, recipient, consequence, and available choice at the point where the person or customer can act, using suitable granularity.
You should end up with: Approved user-flow copy and product behavior linked to each activity.
Store the account or person, decision, scope, time, channel, notice or statement version, and any expiry without relying only on a current-state flag.
You should end up with: Versioned consent, choice, or customer-instruction records.
Apply the decision to product features, messaging, analytics, exports, and integrations, and propagate withdrawal or changed instructions to downstream systems.
You should end up with: Configuration and event logs showing state applied across systems.
Before releasing personal information, verify the recipient, purpose, scope, and authority; record what was disclosed, by whom, when, and through which secure method.
You should end up with: An approved disclosure record with recipient, purpose, scope, and transmission evidence.
Exercise preference change or withdrawal and compare source decisions with downstream systems and disclosure records, resolving failures.
You should end up with: A dated end-to-end test and reconciliation report.
Build the evidence set in three layers: what defines the control, who approved or reviewed it, and what proves it operated. Collect operating records when the work happens so they remain dated, attributable, correctly scoped, and traceable to the underlying activity.
Before sharing, remove unrelated personal or customer data, never expose passwords, tokens, or secret values, preserve enough source context to authenticate the record, and use the secure exchange approved for the engagement.
Documents that define the control, its scope, ownership, and expected way of working.
Confirm what the record proves
Shows what an authorized customer asked the company to collect, use, restrict, share, return, or delete and how that instruction was translated into system action.
Include this context
customer and authorized requestor
Include this context
instruction and data scope
Include this context
received timestamp
Include this context
validation and approval
Include this context
systems affected
Include this context
execution status
Weak evidence to avoid
A salesperson’s summary of what the customer wanted without the original instruction, authority check, data scope, or fulfillment status.
Dated proof that the control actually ran, such as tickets, logs, settings, exports, reports, and test results.
Confirm what the record proves
Shows the person’s or customer’s recorded choice or the authorization for a disclosure, including the exact scope, statement, recipient where relevant, and time of decision.
Include this context
person or account identifier
Include this context
decision or disclosure type
Include this context
scope and purpose
Include this context
statement version or authorization source
Include this context
recipient where applicable
Include this context
decision or disclosure timestamp
Weak evidence to avoid
A current consent flag with no history, scope, statement version, channel, timestamp, or connection to a disclosure recipient.
Confirm what the record proves
Shows the explanation and choice presented at the actual decision point and how the user interface records acceptance, refusal, or an optional preference.
Include this context
product and audience
Include this context
flow step and displayed text
Include this context
data use or disclosure described
Include this context
available choices
Include this context
statement version
Include this context
release or capture date
Weak evidence to avoid
A design mockup that was never released and does not show the complete text, optional choices, version, or resulting system state.
Confirm what the record proves
Shows each release of personal information to a verified recipient, including the approved purpose, exact data scope, sender, method, and completion time.
Include this context
disclosure identifier
Include this context
person, customer, or data set
Include this context
recipient and verified authority
Include this context
purpose and approval
Include this context
data disclosed and transfer method
Include this context
sender and timestamp
Weak evidence to avoid
An email sent entry with no verified recipient authority, approved purpose, data scope, secure-transfer method, or linked case.
Type 1
Current consent and choice state by governed activity, the live decision-point language and version, all open customer instructions, and disclosures pending approval or delivery on the examination date.
Type 2
Every consent or choice creation, refusal, change, withdrawal, expiry, or administrative override; every authorized customer instruction affecting personal-information handling; and every personal-information disclosure executed during the review period.
Reconcile all preference events and customer instructions to current source and downstream states in product, messaging, analytics, and integrations, and reconcile disclosures from support, legal, and transfer systems to approved log entries; investigate unmatched overrides, stale downstream states, and unlogged releases.
Use this checklist to prepare for procedures an auditor may perform. The exact steps and sample selection depend on your engagement scope and the service auditor's professional judgment.
Determine whether the control is designed to achieve this result: When a choice, consent, or authorized disclosure is applicable, the company communicates it clearly, records the person’s or customer’s decision, enforces that state throughout processing, and logs disclosures with an approved purpose and recipient.
Compare the documented owner with the intended role (Privacy Owner / CISO / Data Owners), then compare dated records with the stated cadence: Ongoing; periodic review by privacy/data owner.
Reconcile all preference events and customer instructions to current source and downstream states in product, messaging, analytics, and integrations, and reconcile disclosures from support, legal, and transfer systems to approved log entries; investigate unmatched overrides, stale downstream states, and unlogged releases.
Current consent and choice state by governed activity, the live decision-point language and version, all open customer instructions, and disclosures pending approval or delivery on the examination date.
Every consent or choice creation, refusal, change, withdrawal, expiry, or administrative override; every authorized customer instruction affecting personal-information handling; and every personal-information disclosure executed during the review period.
Documents that define the control, its scope, ownership, and expected way of working.
For each selected record, confirm it demonstrates Shows what an authorized customer asked the company to collect, use, restrict, share, return, or delete and how that instruction was translated into system action.
Dated proof that the control actually ran, such as tickets, logs, settings, exports, reports, and test results.
For each selected record, confirm it demonstrates Shows the person’s or customer’s recorded choice or the authorization for a disclosure, including the exact scope, statement, recipient where relevant, and time of decision.
For each selected record, confirm it demonstrates Shows the explanation and choice presented at the actual decision point and how the user interface records acceptance, refusal, or an optional preference.
For each selected record, confirm it demonstrates Shows each release of personal information to a verified recipient, including the approved purpose, exact data scope, sender, method, and completion time.
Use the categories that apply to this control: connect any policy or design artifact to its approval or review record, then trace a selected operating record through execution, result, and any exception or remediation.
These identifiers help you navigate related Trust Services Criteria. They do not reproduce the criteria or prove that this control fully addresses them in your environment.
Confirm final scope, mappings, and testing expectations with your service auditor. SOC 2® is an AICPA trademark; GreenHat Security is not affiliated with or endorsed by AICPA.