A European prospect asks how you comply with GDPR. Someone suggests adding the privacy category to your SOC 2, so the report can answer the question for you. It is a reasonable instinct, and it rests on a misunderstanding.
The SOC 2 privacy criteria and GDPR cover much of the same ground, in different words, for different purposes. One is a set of criteria a CPA firm reports against. The other is a law. Where they overlap, work done for one helps the other. Where they differ, a clean SOC 2 privacy opinion says nothing about whether you meet the law.
This article lines the two up, criterion series against article, and covers what each one asks that the other does not. It is not legal advice: confirm how GDPR applies to you with counsel.
Two different kinds of obligation
SOC 2 privacy is one of the five categories in the AICPA's trust services criteria. You choose to include it. Its criteria, grouped as P1 to P8, are evaluated against your own privacy commitments and system requirements. A CPA firm examines your controls and gives an opinion. Nothing happens to you if you leave the category out.
GDPR is a regulation that applies to you if you fall within its territorial scope under Article 3. It sets its own requirements regardless of what you have promised. Supervisory authorities enforce it. You do not choose whether it applies.
Two consequences follow. First, SOC 2 privacy is shaped by your commitments, so a report can be clean while your commitments fall short of what the law requires. Second, a SOC 2 report is not a GDPR certification. GDPR Article 42 provides for certification mechanisms, and a SOC 2 examination is not one of them.
Series by series: where the two line up
The privacy criteria follow personal information through its life. This table sets each series against the closest part of GDPR. "Closest" is doing real work here: the GDPR provisions are often broader or stricter.
| SOC 2 series | What it covers | Closest GDPR provisions | Where GDPR goes further |
|---|---|---|---|
| P1 Notice | Telling individuals about your privacy practices | Articles 12 to 14, transparency and information to data subjects | Specifies the content of the notice, including lawful basis and retention |
| P2 Choice and consent | Communicating choices and obtaining consent | Article 6 lawful bases, Article 7 conditions for consent | Consent is one of six lawful bases, with strict conditions when relied on |
| P3 Collection | Collecting personal information consistent with objectives | Article 5(1)(b) and (c), purpose limitation and data minimization | Minimization is a legal principle, not a design choice |
| P4 Use, retention, and disposal | Limiting use, retaining and disposing securely | Article 5(1)(b) and (e), purpose and storage limitation | Retention must be justified by the purpose |
| P5 Access | Individuals' access to, and correction of, their information | Articles 15 and 16, access and rectification | Adds erasure, restriction, portability, and objection |
| P6 Disclosure and notification | Disclosure to third parties, breach notification | Article 28 processors, Articles 33 and 34 breach notification | Sets a 72-hour clock for notifying the supervisory authority |
| P7 Quality | Keeping personal information accurate and complete | Article 5(1)(d), accuracy | Inaccurate data must be erased or rectified without delay |
| P8 Monitoring and enforcement | Handling inquiries, complaints, and disputes | Article 5(2) accountability, Article 77 right to lodge a complaint | Individuals can complain to a supervisory authority directly |
The overlap is substantial. A team that has built notice, consent, retention, access requests, vendor agreements, and breach notification for GDPR has built much of what P1 to P8 test. The reverse is less true, because of what GDPR adds.
What GDPR requires that SOC 2 privacy does not test
Several GDPR obligations have no direct counterpart in the privacy criteria. None of them will appear in your SOC 2 unless you have written them into your own commitments:
A record of processing activities under Article 30. How to build an Article 30 record of processing covers it.
Data protection impact assessments under Article 35, for processing likely to result in a high risk. When a DPIA is required under GDPR covers the triggers.
A data protection officer, where Article 37 requires one.
Rules on international transfers in Chapter V, including standard contractual clauses and transfer impact assessments.
Specific processor contract terms under Article 28. P6 asks you to obtain privacy commitments from vendors. Article 28 lists what a processor contract must contain.
The full set of data subject rights. P5 covers access and correction. GDPR adds erasure, restriction, portability, objection, and rights related to automated decision-making.
Fixed response times. GDPR Article 12 generally requires you to respond to a rights request within one month, extendable in some cases. The SOC 2 criteria set no deadline. Your commitments do.
What SOC 2 privacy gives you that GDPR does not
The traffic is not all one way. A SOC 2 privacy examination offers something GDPR compliance on its own does not: independent testing.
GDPR's accountability principle in Article 5(2) requires you to be able to demonstrate compliance. It does not require anyone outside your organization to check. A Type II report with privacy in scope shows that a CPA firm tested your privacy controls across a period and found them operating, or found specific exceptions. For a buyer assessing you as a processor, that is evidence they can use in their own due diligence.
It also tests operation, not intent. A GDPR program can be documented well and operated poorly. An auditor sampling access requests and checking response dates finds that out.
Controller or processor: why it changes the scope
The privacy criteria assume you have a relationship with the individuals whose information you handle: you give them notice, offer them choices, and respond to their requests. That fits a controller well.
Many SaaS companies are processors for most of their customer data. Their customers collect the information and decide what happens to it. In that case, several privacy criteria are carried out mostly by your customers, not by you. Notice and consent are examples. Your report would need to say which responsibilities sit with customers, typically through complementary user entity controls.
That is workable, but it changes what the report is worth. If your privacy commitments as a processor are mostly about following instructions, securing data, and notifying customers of breaches, the security and confidentiality categories may already cover what your buyers need. Agree with your auditor how the privacy criteria would apply to your role before you commit to the category.
Should you include privacy to answer GDPR questions?
Include it when you collect personal information directly from individuals, make privacy commitments to them, and have buyers who ask for privacy in scope. In that case the overlap with GDPR means much of the work is shared.
Do not include it as a substitute for GDPR compliance. A European buyer asking about GDPR wants to know about your processor terms, transfers, subprocessors, and breach notification. Answer those directly, with your data processing agreement and records, and treat the SOC 2 as supporting evidence about your security. The GDPR framework page and the SOC 2 framework page cover each in more depth.
How TrustLynce helps
TrustLynce runs record of processing, DPIA, and transfer impact assessment workflows, and tracks data subject requests, through data privacy. Compliance automation maps those controls to the SOC 2 privacy criteria where they overlap, so the shared work is evidenced once.