The SOC 2 Privacy category addresses the collection, use, retention, disclosure, and disposal of personal information in accordance with the organization's privacy commitments and recognized privacy criteria.
Standards and scope
Privacy extends the Security Common Criteria and evaluates the full personal-information lifecycle. It is broader than keeping information confidential because it also considers notice, choice, consent, purpose, access, correction, quality, disclosure, complaints, and monitoring.
- Notice communicates privacy practices and the purposes for collecting and using personal information.
- Choice and consent controls should reflect the commitments and lawful operating context.
- Collection, use, retention, and disposal should be limited and consistent with stated purposes.
- Access, correction, disclosure, data quality, complaints, and monitoring require defined processes and evidence.
- Privacy criteria should be assessed with the Security controls that protect the same information and systems.
Who this is for
- Privacy students, educators, analysts, and early-career governance professionals.
- Privacy, legal, security, compliance, data-governance, product, and customer-support teams.
- Organizations processing customer, employee, student, patient, or citizen information.
- Advisors, public agencies, schools, and regulated organizations preparing assurance evidence.
What voiqq provides
- Canonical Privacy criteria with consistent mapping to gaps, evidence requests, and remediation.
- Project records for policies, notices, requests, complaints, populations, samples, tests, and exceptions.
- Controlled assignments and review history across multidisciplinary owners.
- Status, validation, evidence, and management response kept with the applicable criterion.
- Combined Security and Privacy readiness snapshots for reviewed project data.
A practical workflow
- Document privacy commitments, data categories, purposes, systems, jurisdictions, and owners in scope.
- Map policies and operational processes to the relevant criteria.
- Test representative notices, choices, requests, disclosures, retention actions, or complaints.
- Record exceptions with minimized or redacted personal information.
- Validate remediation and review conclusions with qualified privacy and assurance stakeholders.
Put the framework into practice
The Privacy library gives legal, product, technical, and assurance teams one structured place to coordinate personal-information controls while preserving a clear review trail.