Confidentiality / Privacy
Requests involving access, correction, deletion, export, restriction, accounting, or customer-directed handling are logged, validated, fulfilled or escalated, and retained.
Use this guide to put the control into operation, decide what records to retain, and check that an auditor can trace the evidence back to the work your team performed.
Maintained by GreenHat Security · Reviewed August 21, 2026
Access, correction, deletion, export, restriction, accounting, and customer-directed requests are captured, securely validated, assigned, fulfilled or escalated, and closed with enough history to explain the decision and work performed.
First SOC 2 program
Use a dedicated privacy inbox or case type, appoint one coordinator and backup, define safe identity validation, and maintain a current search path across the product, support tools, analytics, and vendors. Escalate jurisdictional, contractual, or denial questions to qualified counsel when needed.
As the company scales
Use case management with request type, role, jurisdiction or contract context, due-date logic, system tasks, quality review, and customer communication. Integrate repeatable export and deletion jobs while retaining human review for identity, scope, exceptions, and final response.
Log receipt time, requester, request type, applicable customer relationship, assigned coordinator, and the initial due date or escalation need.
You should end up with: A timestamped case with type, owner, status, and tracked due date.
Use proportionate information and existing account channels to confirm identity and, for agents or customer administrators, authority to direct the request.
You should end up with: A restricted validation record that avoids retaining unnecessary identity data.
Use data maps and stable identifiers to search product stores, logs, analytics, support tools, exports, vendors, and other in-scope locations.
You should end up with: A completed system search record with findings and responsible owners.
Determine what action is appropriate for the request and company role, document any restriction or denial rationale, and obtain legal or privacy review when interpretation is needed.
You should end up with: An approved fulfillment decision with scope and rationale.
Perform the approved correction, access, export, deletion, restriction, or accounting work and have a second person verify identity matching, completeness, and secure delivery.
You should end up with: System results, a quality-review record, and secure delivery confirmation.
Send the approved response, retain the communication and completion time, and close only after all system tasks and escalations are resolved.
You should end up with: A closed case with response, timestamps, decisions, and linked work records.
Build the evidence set in three layers: what defines the control, who approved or reviewed it, and what proves it operated. Collect operating records when the work happens so they remain dated, attributable, correctly scoped, and traceable to the underlying activity.
Before sharing, remove unrelated personal or customer data, never expose passwords, tokens, or secret values, preserve enough source context to authenticate the record, and use the secure exchange approved for the engagement.
Records showing that an accountable person reviewed, approved, challenged, or accepted the work.
Confirm what the record proves
Shows why a request was denied, limited, delayed, redirected to a customer, or otherwise handled differently, who approved the decision, and what was communicated.
Include this context
case and requested action
Include this context
relevant facts and scope
Include this context
decision and rationale
Include this context
privacy or legal reviewer
Include this context
decision date
Include this context
response or next action
Weak evidence to avoid
A closed case labeled not applicable with no factual basis, reviewer, decision date, or response to the requester.
Dated proof that the control actually ran, such as tickets, logs, settings, exports, reports, and test results.
Confirm what the record proves
Shows when and through which monitored channel each privacy or customer-directed data request arrived and that it was assigned to a traceable case without losing the original message.
Include this context
source channel and message identifier
Include this context
received timestamp
Include this context
requester and customer relationship
Include this context
request type
Include this context
linked case identifier
Include this context
routing or acknowledgment status
Weak evidence to avoid
A manually maintained case list that omits the original inbox message, receipt time, support-channel requests, and withdrawn or duplicate submissions.
Confirm what the record proves
Shows that the requester’s identity and, where relevant, authority to act for another person or customer were verified by a proportionate method before data was released or changed.
Include this context
case and requester identifier
Include this context
claimed relationship or authority
Include this context
validation method
Include this context
validation result
Include this context
reviewer
Include this context
validation timestamp
Weak evidence to avoid
A note saying identity verified with no method, result, reviewer, authority check, or connection to the account concerned.
Confirm what the record proves
Shows the systems searched and the access, correction, deletion, export, restriction, accounting, or customer-directed actions completed and quality-checked for the case.
Include this context
case identifier
Include this context
systems and data categories
Include this context
action and execution time
Include this context
result or output location
Include this context
performer
Include this context
quality reviewer and completion date
Weak evidence to avoid
A case marked fulfilled without a system search list, job or query results, delivery record, or second-person review.
Type 1
All open requests and their current identity-validation, search, decision, fulfillment, due-date, escalation, and response status on the examination date, plus configuration showing every accepted intake channel and routing owner.
Type 2
Every privacy or customer-directed access, correction, deletion, export, restriction, accounting, or handling request received during the review period through the privacy inbox, web form or portal, support queue, account-management or sales escalation, or another accepted channel, including duplicates, withdrawals, invalid submissions, denials, and redirected requests.
Export every message or submission from each accepted inbox, form, portal, support, CRM, and escalation queue; deduplicate using source identifiers while retaining all dispositions, reconcile each item to a case and final status, and investigate every unmatched message, missing receipt timestamp, or case created without a source record.
Use this checklist to prepare for procedures an auditor may perform. The exact steps and sample selection depend on your engagement scope and the service auditor's professional judgment.
Determine whether the control is designed to achieve this result: Access, correction, deletion, export, restriction, accounting, and customer-directed requests are captured, securely validated, assigned, fulfilled or escalated, and closed with enough history to explain the decision and work performed.
Compare the documented owner with the intended role (Privacy Owner / CISO / Data Owners), then compare dated records with the stated cadence: Ongoing; periodic review by privacy/data owner.
Export every message or submission from each accepted inbox, form, portal, support, CRM, and escalation queue; deduplicate using source identifiers while retaining all dispositions, reconcile each item to a case and final status, and investigate every unmatched message, missing receipt timestamp, or case created without a source record.
All open requests and their current identity-validation, search, decision, fulfillment, due-date, escalation, and response status on the examination date, plus configuration showing every accepted intake channel and routing owner.
Every privacy or customer-directed access, correction, deletion, export, restriction, accounting, or handling request received during the review period through the privacy inbox, web form or portal, support queue, account-management or sales escalation, or another accepted channel, including duplicates, withdrawals, invalid submissions, denials, and redirected requests.
Records showing that an accountable person reviewed, approved, challenged, or accepted the work.
For each selected record, confirm it demonstrates Shows why a request was denied, limited, delayed, redirected to a customer, or otherwise handled differently, who approved the decision, and what was communicated.
Dated proof that the control actually ran, such as tickets, logs, settings, exports, reports, and test results.
For each selected record, confirm it demonstrates Shows when and through which monitored channel each privacy or customer-directed data request arrived and that it was assigned to a traceable case without losing the original message.
For each selected record, confirm it demonstrates Shows that the requester’s identity and, where relevant, authority to act for another person or customer were verified by a proportionate method before data was released or changed.
For each selected record, confirm it demonstrates Shows the systems searched and the access, correction, deletion, export, restriction, accounting, or customer-directed actions completed and quality-checked for the case.
Use the categories that apply to this control: connect any policy or design artifact to its approval or review record, then trace a selected operating record through execution, result, and any exception or remediation.
These identifiers help you navigate related Trust Services Criteria. They do not reproduce the criteria or prove that this control fully addresses them in your environment.
Confirm final scope, mappings, and testing expectations with your service auditor. SOC 2® is an AICPA trademark; GreenHat Security is not affiliated with or endorsed by AICPA.