Confidentiality / Privacy
Privacy responsibilities, data handling expectations, customer commitments, notices, processing purposes, and authorized uses are defined, reviewed, and communicated to data subjects/customers as applicable.
Use this guide to put the control into operation, decide what records to retain, and check that an auditor can trace the evidence back to the work your team performed.
Maintained by GreenHat Security · Reviewed August 21, 2026
Privacy ownership, processing purposes, authorized uses, customer commitments, and public notices are clear, current, and consistent with what the product and teams actually do.
First SOC 2 program
Name a privacy owner, map the product’s major personal-information flows, and write a plain-language notice that reflects actual collection, use, sharing, retention, and individual choices. Review it before launch and when the product, vendor set, or data use materially changes.
As the company scales
Establish cross-functional review among privacy, security, product, engineering, support, and legal stakeholders. Maintain versioned notices and processing purposes by product or audience, and make privacy impact review a gate for material data-use changes.
Name who owns the notice, processing inventory, requests, incident review, product consultation, customer commitments, and approval, with backups for time-sensitive duties.
You should end up with: An approved privacy responsibility matrix with primary and backup roles.
For each major product and business process, record the personal information, source, purpose, use, recipient, retention, audience, and responsible owner.
You should end up with: A processing inventory linked to systems and data flows.
Compare notice statements with product forms, telemetry, support practices, integrations, vendors, account settings, and customer agreements.
You should end up with: A notice review record with identified gaps and resolutions.
Obtain appropriate privacy, business, and legal review, publish the approved version, and retain its effective date and prior public version.
You should end up with: Approval history, dated published notice, and version archive.
Route new collection, uses, sharing, model processing, audiences, or geographic expansion through a privacy review before release.
You should end up with: Change reviews documenting notice and processing-inventory impact.
Periodically ask product and data owners to confirm processing purposes and compare current systems and vendors with the published statements.
You should end up with: A dated owner attestation and remediation record.
Build the evidence set in three layers: what defines the control, who approved or reviewed it, and what proves it operated. Collect operating records when the work happens so they remain dated, attributable, correctly scoped, and traceable to the underlying activity.
Before sharing, remove unrelated personal or customer data, never expose passwords, tokens, or secret values, preserve enough source context to authenticate the record, and use the secure exchange approved for the engagement.
Documents that define the control, its scope, ownership, and expected way of working.
Confirm what the record proves
Shows what the company told the relevant audience about personal-information collection, purposes, use, sharing, retention, choices, and contact paths at a specific effective date.
Include this context
notice version and effective date
Include this context
audience and product scope
Include this context
data categories and purposes
Include this context
recipient or sharing categories
Include this context
retention and choices
Include this context
privacy contact path
Weak evidence to avoid
A live webpage printout with no version or effective date and statements that do not identify the product’s actual telemetry, vendors, or uses.
Confirm what the record proves
Shows who owns notices, product consultation, requests, incidents, commitments, and approvals, including backup coverage and escalation paths.
Include this context
privacy responsibility
Include this context
primary owner
Include this context
backup owner
Include this context
approval or escalation role
Include this context
effective and review dates
Weak evidence to avoid
A statement that privacy is everyone’s responsibility without named owners for notices, requests, incidents, or product decisions.
Confirm what the record proves
Shows the approved reason for each material processing activity and connects the personal information, source, use, recipient, retention, system, and accountable owner.
Include this context
processing activity and purpose
Include this context
data categories and source
Include this context
systems and recipients
Include this context
retention reference
Include this context
owner
Include this context
approval or review date
Weak evidence to avoid
A list of systems whose purpose is simply operations, with no data categories, users, recipients, owner, or notice connection.
Records showing that an accountable person reviewed, approved, challenged, or accepted the work.
Confirm what the record proves
Shows that reviewers compared the notice with current product collection, telemetry, support practices, vendors, data uses, and customer commitments before approving it.
Include this context
notice version reviewed
Include this context
systems, uses, and audiences reviewed
Include this context
reviewers and roles
Include this context
gaps and resolutions
Include this context
decision
Include this context
review date
Weak evidence to avoid
An approval reaction in chat with no identified notice version, operating comparison, reviewer role, or resolved discrepancies.
Type 1
The live notice and archived version effective on the examination date, current privacy responsibility assignments, current processing-purpose inventory, and unresolved notice-to-operation discrepancies.
Type 2
Every notice publication or revision, processing-purpose addition or material change, privacy-role reassignment, and product, telemetry, vendor, model, audience, or customer-commitment change submitted for privacy and notice review during the review period, plus each scheduled periodic review.
Compare CMS notice versions, material product releases, new telemetry schemas, activated integrations, vendor changes, and amended data commitments with the privacy review queue and processing inventory; investigate every change without a notice-impact decision or updated purpose record.
Use this checklist to prepare for procedures an auditor may perform. The exact steps and sample selection depend on your engagement scope and the service auditor's professional judgment.
Determine whether the control is designed to achieve this result: Privacy ownership, processing purposes, authorized uses, customer commitments, and public notices are clear, current, and consistent with what the product and teams actually do.
Compare the documented owner with the intended role (Privacy Owner / CISO / Data Owners), then compare dated records with the stated cadence: Ongoing; periodic review by privacy/data owner.
Compare CMS notice versions, material product releases, new telemetry schemas, activated integrations, vendor changes, and amended data commitments with the privacy review queue and processing inventory; investigate every change without a notice-impact decision or updated purpose record.
The live notice and archived version effective on the examination date, current privacy responsibility assignments, current processing-purpose inventory, and unresolved notice-to-operation discrepancies.
Every notice publication or revision, processing-purpose addition or material change, privacy-role reassignment, and product, telemetry, vendor, model, audience, or customer-commitment change submitted for privacy and notice review during the review period, plus each scheduled periodic review.
Documents that define the control, its scope, ownership, and expected way of working.
For each selected record, confirm it demonstrates Shows what the company told the relevant audience about personal-information collection, purposes, use, sharing, retention, choices, and contact paths at a specific effective date.
For each selected record, confirm it demonstrates Shows who owns notices, product consultation, requests, incidents, commitments, and approvals, including backup coverage and escalation paths.
For each selected record, confirm it demonstrates Shows the approved reason for each material processing activity and connects the personal information, source, use, recipient, retention, system, and accountable owner.
Records showing that an accountable person reviewed, approved, challenged, or accepted the work.
For each selected record, confirm it demonstrates Shows that reviewers compared the notice with current product collection, telemetry, support practices, vendors, data uses, and customer commitments before approving it.
Use the categories that apply to this control: connect any policy or design artifact to its approval or review record, then trace a selected operating record through execution, result, and any exception or remediation.
These identifiers help you navigate related Trust Services Criteria. They do not reproduce the criteria or prove that this control fully addresses them in your environment.
Confirm final scope, mappings, and testing expectations with your service auditor. SOC 2® is an AICPA trademark; GreenHat Security is not affiliated with or endorsed by AICPA.