SOC 2 P6.7: disclosure reports, explained for startups

What usually proves it

An auditor wants records from the period being examined, pulled from the systems that hold them rather than written up afterwards. Dates matter. A record with a date and a named owner carries more weight than a screenshot with neither. For P6.7, the usual records are these.

• Responses to data subject requests
• A personal data inventory
• A disclosure log

What Polara asks about it

The free readiness assessment asks one question that bear on P6.7. A yes becomes a task to show the proof. A no becomes a task to fix the gap, with the steps written out.

• Do you keep an inventory of the personal information you hold: what it is, where it is stored, why you hold it and who can access it? If yes, show it: personal information inventory or data map listing each kind of data, its system, its purpose and who can access it. If no, the fix: build an inventory of each kind of personal information, the system that stores it, its purpose and who can access it, and review it when systems change.

Policies, templates and connected evidence

A policy states the rule, a template gives you the record to keep, and a connected system pulls the proof from the source. An auditor checks that the three agree: the cadence in the policy, the dates in the record and what the system shows.

In the policy pack, the Privacy Program Policy covers P6.7.

Is it in your scope?

Only if you add Privacy. How you handle personal information across its life: notice, consent, collection, use, retention, access requests, disclosure and complaints. It is the heaviest category and assumes a privacy program already runs.

The scoping tool decides it with one question: Add it when you collect personal information about individuals and run a privacy program with a notice, consent and requests from the people it describes. When personal information is incidental to your service, Confidentiality is often the closer fit. Privacy notice, consent, collection and use limits, retention and deletion, access and correction requests, disclosures, breach notification and complaints.

Security is the default and always in scope. Adding Privacy in the assessment puts its 18 criteria into the report and the examination, and adds 14 questions to the assessment.

Polara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.

Disclosure and notification: the criteria around it

P6.7 is one of 7 criteria in disclosure and notification, P6.1 to P6.7. Reading a group together shows how its outcomes fit, and one record often serves more than one of them.

• P6.1, third party disclosures
• P6.2, disclosure records
• P6.3, unauthorized disclosures
• P6.4, processor commitments
• P6.5, processor breach notice
• P6.6, breach notification
• P6.7, this page

Before it: P6.6, breach notification. After it: P7.1, data quality. All the criteria, Security first, are on the Trust Services Criteria page, grouped by category.