SOC 2 | P2.1 | Communication of choices about personal information to data subjects

Requirement description

The entity communicates choices available regarding the collection, use, retention, disclosure, and disposal of personal information to the data subjects and the consequences, if any, of each choice. Explicit consent for the collection, use, retention, disclosure, and disposal of personal information is obtained from data subjects or other authorized persons, if required. Such consent is obtained only for the intended purpose of the information to meet the entity’s objectives related to privacy. The entity’s basis for determining implicit consent for the collection, use, retention, disclosure, and disposal of personal information is documented.

Points of focus:

- Communicates to Data Subjects
- Communicates Consequences of Denying or Withdrawing Consent
- Obtains Implicit or Explicit Consent
- Documents and Obtains Consent for New Purposes and Uses
- Obtains Explicit Consent for Sensitive Information
- Obtains Consent for Data Transfers

How to fill the requirement

SOC 2 (Systems and Organization Controls)

P2.1: Communication of choices about personal information to data subjects

Task name

Priority

Status

Theme

Policy

Other requirements

Process for data subjects to edit or cancel a consent

Critical

High

Normal

Low

Fully done

Mostly done

Partly done

Not done

Privacy

Informing and data subject requests

requirements

Examples of other requirements this task affects

A.7.3.4: Providing mechanism to modify or withdraw consent

ISO 27701

P2.1: Communication of choices about personal information to data subjects

SOC 2

See all related requirements and other information from tasks own page.

Go to >

Process for data subjects to edit or cancel a consent

1. Task description

When personal data is processed on the basis of the data subject's consent, the organization should provide data subjects with a clear process for editing or withdrawing their consent. Editing may also mean limiting the processing of personal data, which may affect the controller's right to delete the data in question.

The process should include recording requests for editing in a way similar to recording consent. Changes to consent must be communicated to all relevant data systems, authorized users and third parties. The process should also define the response time in which the requests should be processed.

N.b.! Different jurisdictions may have restrictions on how and when the data subject can modify their consent.

Consent condition review

Critical

High

Normal

Low

Fully done

Mostly done

Partly done

Not done

Privacy

Processing principles and accountability

requirements

Examples of other requirements this task affects

A.7.2.4: Obtain and record consent

ISO 27701

P2.1: Communication of choices about personal information to data subjects

SOC 2

See all related requirements and other information from tasks own page.

Go to >

Consent condition review

1. Task description

The organization must regularly review its way of collecting consent from data subjects to ensure that the consent is unambiguous and precise.

Documentation of conditions of consent for relevant processing purposes

Critical

High

Normal

Low

Fully done

Mostly done

Partly done

Not done

Privacy

Processing principles and accountability

requirements

Examples of other requirements this task affects

7. Conditions for consent

GDPR

17. Right to erasure (‘right to be forgotten’)

GDPR

A.7.2.3: Determine when and how consent is to be obtained

ISO 27701

A.7.2.4: Obtain and record consent

ISO 27701

A.7.3.4: Providing mechanism to modify or withdraw consent

ISO 27701

See all related requirements and other information from tasks own page.

Go to >

Documentation of conditions of consent for relevant processing purposes

1. Task description

If our organization processes personal data based on the consent of the data subject, we must ensure that the conditions for consent are met. The conditions for lawful consent are:

The controller must be able to demonstrate that the data subject has consented to the processing of his or her personal data
The request for consent must be clearly separated from other matters in an easily comprehensible form
The data subject may withdraw her consent at any time and has been instructed to do so before giving her consent
Withdrawal of consent must be as easy as giving it

The Data Protection Officer may be responsible for assessing the conditions of consent. It is also important to consider, whether consent is generally appropriate as a legal basis for the corresponding processing.

Clear communication about the effects of consent

Critical

High

Normal

Low

Fully done

Mostly done

Partly done

Not done

Privacy

Informing and data subject requests

requirements

Examples of other requirements this task affects

P2.1: Communication of choices about personal information to data subjects

SOC 2

See all related requirements and other information from tasks own page.

Go to >

Clear communication about the effects of consent

1. Task description

The organization has defined the ways in which the data subject's understanding of the effects of his consent is ensured.

At least the following points of view are clearly communicated to the data subject:

What are the effects of his consent?
What are the effects of refusing consent or its subsequent withdrawal?

Tasks included in the policy

Task name

Priority

Status

Theme

Policy

Other requirements

No items found.

1.1 (MIL2): Manage IT and OT Asset Inventory

C2M2: MIL1

1.1 (MIL3): Manage IT and OT Asset Inventory

C2M2: MIL1

1.1.1: Availability of information security policies

TISAX

1.1.1: Identify the organisation’s strategy and priorities

NSM ICT-SP

1.1.2: Identify the organisation’s structures and processes for security management

NSM ICT-SP

1.1.3: Identify the organisation’s processes for ICT risk management

NSM ICT-SP

1.1.4: Identify the organisation’s tolerances for ICT risk

NSM ICT-SP

1.1.5: Identify the organisation’s deliverables, information systems and supporting ICT functions

NSM ICT-SP

1.1.6: Identify information processing and data flow

NSM ICT-SP

1.2 (MIL2): Manage Information Asset Inventory

C2M2: MIL1

1.2 (MIL3): Manage Information Asset Inventory

C2M2: MIL1

1.2.1: Establish a process to identify devices and software in use at the organisation

NSM ICT-SP

1.2.1: Scope of Information Security management

TISAX

1.2.2: Establish organisational guidelines for approved devices and software

NSM ICT-SP

1.2.2: Information Security Responsibilities

TISAX

1.2.3: Identify devices in use at the organisation

NSM ICT-SP

1.2.3: Information Security requirements in projects

TISAX

1.2.4: Definition of responsibilities with service providers

TISAX

1.2.4: Identify the software in use at the organisation

NSM ICT-SP

1.2: Manage Information Asset Inventory

C2M2: MIL1

1.3 (MIL2): Manage IT and OT Asset Configuration

C2M2: MIL1

1.3 (MIL3): Manage IT and OT Asset Configuration

C2M2: MIL1

1.3.1: Identification of information assets

TISAX

1.3.1: Identify the users of the information systems

NSM ICT-SP

1.3.2: Classification of information assets

TISAX

1.3.2: Identify and define the different user categories

NSM ICT-SP

1.3.3: Identify roles and responsibilities linked especially to ICT security

NSM ICT-SP

1.3.3: Use of approved external IT services

TISAX

1.3.4: Use of approved software

TISAX

1.3: Manage IT and OT Asset Configuration

C2M2: MIL1

1.4 (MIL2): Manage Changes to IT and OT Assets

C2M2: MIL1

1.4 (MIL3): Manage Changes to IT and OT Assets

C2M2: MIL1

1.4.1: Management of Information Security Risks

TISAX

1.4: Manage Changes to IT and OT Assets

C2M2: MIL1

1.5 (MIL1): Management Activities for the ASSET domain

C2M2: MIL1

1.5 (MIL2): Management Activities for the ASSET domain

C2M2: MIL1

1.5 (MIL3): Management Activities for the ASSET domain

C2M2: MIL1

1.5.1: Assessment of policies and requirements

TISAX

1.5.2: External review of ISMS

TISAX

1.5: Management Activities for the ASSET domain

C2M2: MIL1

1.6.1: Reporting of security events

TISAX

1.6.2: Management of reported events

TISAX

1.6.3: Crisis preparedness

TISAX

10 §: Johdon vastuu

KyberTL

10. Processing of personal data relating to criminal convictions and offences

GDPR

10.1 (MIL2): Establish Cybersecurity Program Strategy

C2M2: MIL1

10.1 (MIL3): Establish Cybersecurity Program Strategy

C2M2: MIL1

10.1.1: Policy on the use of cryptographic controls

ISO27 Full

10.1.2: Key management

ISO27 Full

10.1.2: Key management

ISO 27017

10.1: Continuous improvement

ISO27k1 Full

10.1: Cryptographic controls

ISO27 Full

10.1: Cryptographic controls

ISO 27017

10.1: Establish Cybersecurity Program Strategy

C2M2: MIL1

10.2 (MIL2): Establish and Maintain Cybersecurity Program

C2M2: MIL1

10.2 (MIL3): Establish and Maintain Cybersecurity Program

C2M2: MIL1

10.2: Establish and Maintain Cybersecurity Program

C2M2: MIL1

10.2: Non-conformity and corrective action

ISO27k1 Full

10.3 (MIL1): Management Activities for the PROGRAM domain

C2M2: MIL1

10.3 (MIL2): Management Activities for the PROGRAM domain

C2M2: MIL1

10.3 (MIL3): Management Activities for the PROGRAM domain

C2M2: MIL1

10.3: Management Activities for the PROGRAM domain

C2M2: MIL1

10: Cryptography

ISO27 Full

10: Cryptography

ISO 27017

10: Cybersecurity Program Management (PROGRAM)

C2M2: MIL1

10: Prosessi väärinkäytöksiin reagoimiseksi

Sec overview

11 §: Poikkeamailmoitukset viranomaiselle

KyberTL

11. Processing which does not require identification

GDPR

11.1.1: Physical security perimeter

ISO27 Full

11.1.2: Physical entry controls

ISO27 Full

11.1.3: Securing offices, rooms and facilities

ISO27 Full

11.1.4: Protecting against external and environmental threats

ISO27 Full

11.1.5: Working in secure areas

ISO27 Full

11.1.6: Delivery and loading areas

ISO27 Full

11.1: Secure areas

ISO27 Full

11.2.1: Equipment siting and protection

ISO27 Full

11.2.2: Supporting utilities

ISO27 Full

11.2.3: Cabling security

ISO27 Full

11.2.4: Equipment maintenance

ISO27 Full

11.2.5: Removal of assets

ISO27 Full

11.2.6: Security of equipment and assets off-premises

ISO27 Full

11.2.7: Secure disposal or re-use of equipment

ISO27 Full

11.2.7: Secure disposal or re-use of equipment

ISO 27017

11.2.8: Unattended user equipment

ISO27 Full

11.2.9: Clear desk and clear screen policy

ISO27 Full

11.2: Equipment

ISO27 Full

11.2: Equipment

ISO 27017

11: Digiturvan mittarien määrittäminen

Sec overview

11: Physical and environmental security

ISO27 Full

11: Physical and environmental security

ISO 27017

12 §: Luotettavuutta edellyttävien tehtävien tunnistaminen ja luotettavuudesta varmistuminen

TiHL

12 §: Poikkeamaa koskeva väliraportti

KyberTL

12. Transparent information, communication and modalities for the exercise of the rights of the data subject

GDPR

12.1.1: Documented operating procedures

ISO27 Full

12.1.2: Change management

ISO27 Full

12.1.3: Capacity management

ISO27 Full

12.1.4: Separation of development, testing and operational environments

ISO27 Full

12.1: Operational procedures and responsibilities

ISO27 Full

12.2.1: Controls against malware

ISO27 Full

12.2: Protection from malware

ISO27 Full

Requirement description

How to fill the requirement

SOC 2 (Systems and Organization Controls)

P2.1: Communication of choices about personal information to data subjects

Examples of other requirements this task affects

Examples of other requirements this task affects

Examples of other requirements this task affects

Examples of other requirements this task affects

Tasks included in the policy

Universal cyber compliance language model: Comply with confidence and least effort

Subscribe to Academy today

Webinars

Videos

Helps

Blogs

Content library