SOC 2 + Privacy Attestation
A SOC 2 examination whose opinion covers the Privacy trust services category (P1 to P8), with your GDPR and CCPA mapping presented as management’s other information, for SaaS handling EU personal data or in-scope CCPA data.
- Criteria
- Public AICPA Privacy criteria (P1 to P8)
- Report
- SOC 2 Type I or II with Privacy category
- Engagement
- Additional criteria in your SOC 2 examination
Timeline: Same period as your SOC 2 when the added controls have operated for that period; otherwise we tell you on the scope call.
Who needs SOC 2 + Privacy?
Processors under GDPR data processing agreements
Your Article 28 DPA promises technical and organizational measures. Controllers want evidence that you operate them.
Service providers under CCPA
California customers need to show that their vendors honor deletion, access and opt-out requests downstream.
B2B SaaS facing privacy questionnaires
Questions about notice, consent, retention and subject requests sit outside Security, and a plain SOC 2 leaves them blank.
What is in the report
- Your full SOC 2 opinion, now covering the Privacy category: notice, choice and consent, collection, use and retention, access, disclosure, quality and monitoring (P1 to P8)
- Your mapping of each privacy control to the GDPR articles and CCPA sections it supports, presented as other information prepared by management and not covered by the opinion
- Test results for privacy operations such as data subject request handling, retention and disposal, and subprocessor management
- A plain statement that the report is not an opinion on legal compliance
What it is not
Not a legal opinion that you comply with GDPR or CCPA, not a certification under GDPR Article 42, and not an ISO/IEC 27701 certificate. The opinion covers the Privacy trust services category; the GDPR and CCPA mapping is management’s other information.
We do not design, implement, or operate the controls we examine.
How it works
The framework is addressed as additional criteria in the same SOC 2 examination: one report, one fieldwork window.
- 1
Scope call
Confirm what personal data you process, in which role, and which laws your customers cite.
- 2
Mapping
You map your privacy controls to the Privacy criteria, and separately to GDPR and CCPA provisions as other information. We evaluate the criteria mapping; both mappings are management’s.
- 3
Examination
Privacy controls are tested in the same fieldwork as your SOC 2.
- 4
One report
Signed SOC 2+ report with the Privacy category and management’s legal mapping.
Scope, timing and fees
The add-on is scoped together with your SOC 2 during the preliminary scope discussion. Formal scope, timing, and fees are established only after the firm completes its required acceptance and quality gates.
We do not design, implement, or operate the controls we examine.
Frequently asked questions
Privacy questionnaires slowing deals?
Schedule a free 30-minute preliminary scope discussion. We will tell you whether adding Privacy to your SOC 2 answers what your EU and California customers are asking.