What it is
The privacy criteria are an optional category in a SOC 2 report. They sit in the AICPA Trust Services Criteria next to Security, Availability, Processing Integrity and Confidentiality. Most SOC 2 reports cover Security only. Add privacy and the auditor also tests controls over personal information: what you collect, why, who you share it with and how long you keep it.
The criteria run from P1 to P8. P1 covers notice. P2 covers choice and consent. P3 covers collection. P4 covers use, retention and disposal. P5 covers access. P6 covers disclosure and notification. P7 covers quality. P8 covers monitoring and enforcement. Those names matter in your control matrix, because each needs an owner, a control and evidence.
Privacy here means personal information, not every secret your business holds. A customer list can be confidential and still not be privacy data. Privacy data is information about an identifiable person, such as a name, email, account ID, IP address, support ticket or HR record. The criteria ask you to define that boundary in the system description. They do not replace GDPR, CCPA or a contract.
How it works
A privacy report starts with scope. You name the system, the legal entity, the report period and the report type. You also say which personal information is in scope and which is out. If you leave employee data out, say so. If your app shares data with a payment processor, include that flow or explain the boundary.
Next comes a gap assessment against P1 through P8 and the common criteria. For each criterion, write the control, the owner, the frequency and the evidence. P1 might be a privacy notice with version history. P2 might be consent checkboxes with timestamps and the exact text shown. P4 might be a retention schedule and a deletion job with logs. P5 might be an access request ticket and the export you sent.
A Type I report covers design at a point in time. A Type II report covers design and operating effectiveness over a period. Privacy controls often run on a schedule, so evidence has to show the schedule held. A consent log needs every change. A deletion job needs a monthly run and a review. The auditor samples those records.
The report has two parts. Management writes a system description and an assertion. The CPA firm gives an opinion on design and, for Type II, operating effectiveness. Privacy adds tests, interviews and sample requests, so budget more evidence time.
Why it matters for a business
Privacy criteria show up when a customer asks about data access, deletion, consent and onward transfer. A Security only report may not answer those questions. A privacy report gives the customer a third-party opinion on those controls and cuts down on custom replies.
It also forces a data map you probably need anyway. You find out which systems hold personal data, which vendors receive it, which teams can read it and which records have no retention rule. That map helps with GDPR or CCPA requests, product changes and vendor reviews. It does not certify compliance with any law.
The trade-off is scope. Adding privacy means more controls, more evidence and a longer audit. It can pull in HR, marketing and support, not engineering alone. If customers only ask about uptime and security, a Security report may be enough. If you process consumer profiles, health data, location data or large sets of employee records, privacy criteria deserve a serious look.
Common mistakes
The first mistake is treating privacy as a policy exercise. A privacy notice on the website is not a control. The auditor will ask how you approved the notice, how you published a change, how you recorded consent and how you handled a request last month. If the notice says you delete data after 30 days, the deletion logs need to match.
The second is over-scoping. Teams add every system and data type, then drown in evidence. Start with the service in the report and the personal information that service touches. Leave out systems you cannot explain or support. Write the boundary in the system description.
The third is missing vendors and downstream disclosure. Privacy criteria ask who you share personal information with and why. A vendor list without owners, contract terms and review dates is weak. So is a subprocessor page that does not match the actual data flows. Check the flow from signup to support to billing to analytics.
The fourth is assuming security controls cover privacy. Encryption and access reviews help, but they do not show notice, choice, retention or access requests. The fifth is weak evidence for access and deletion requests. A screenshot of a ticket is not enough if it has no date, requester, action taken and reviewer. Build a simple log before the audit starts.
How to get started
Decide first whether you need privacy criteria at all. Read the customer requests and the contracts that trigger the ask. If the request is only about security, keep the scope tight. If customers ask how you handle consent, deletion, access or sharing, add privacy.
Then build a data inventory for the service in scope. List each system, the personal information it holds, the source, the purpose, the vendors that receive it and the retention rule. Map each item to P1 through P8. Assign owners for notice, consent, access requests, deletion, vendor review and monitoring. Gather the records you already have: notice versions, consent screens, tickets, logs and policies.
Run a gap review before you call an auditor. Fix controls that have no evidence, then run them for a few weeks so the Type II sample has something to test. One option is the SOC 2 readiness assessment from Cloudverg, a fixed-scope package at $7,500/month. It runs three weeks and covers scoping, a gap assessment, a policy and evidence inventory, a remediation roadmap and a shortlist of CPA firms. Compare that with doing the work in house or with another adviser.
Frequently asked questions
Is the SOC 2 privacy criteria the same as GDPR?
No. The SOC 2 privacy criteria are control criteria from the AICPA. GDPR is a law with its own rules and enforcement. A privacy report can support GDPR work, but it is not a compliance certificate.
Do I need privacy criteria in my SOC 2 report?
Not always. Privacy is an optional category. Add it when customers ask about consent, access, deletion or sharing of personal information, or when your service handles personal data in ways Security does not cover.
What is the difference between SOC 2 privacy and confidentiality?
Confidentiality protects information your business treats as secret, including contracts, source code and financial data. Privacy focuses on personal information about people, such as customers or employees. The controls overlap, but privacy adds notice, choice, access and retention requirements.