# SOC 2 Privacy TSC Readiness Assessment Template

## Organization Information

| Field | Value |
|-------|-------|
| Organization Name | [Organization Name] |
| Assessment Date | [YYYY-MM-DD] |
| Examination Period | [Start Date] to [End Date] |
| TSC Categories | [ ] Security [ ] Availability [ ] Processing Integrity [ ] Confidentiality [ ] Privacy |
| CPA Firm | [Auditor Name] |
| Prior SOC 2 Report | [ ] Yes (Type: ___) [ ] No |

## Privacy Criteria Assessment

### P1.1 — Notice

| # | Control | Implemented | Evidence Available | Evidence Type | Owner |
|---|---------|------------|-------------------|---------------|-------|
| 1 | Privacy notice on all collection points | [ ] Yes [ ] No | [ ] Yes [ ] No | | |
| 2 | Notice describes types, purposes, recipients, rights, retention | [ ] Yes [ ] No | [ ] Yes [ ] No | | |
| 3 | Notice reviewed/updated annually and on change | [ ] Yes [ ] No | [ ] Yes [ ] No | | |
| 4 | Material changes communicated to data subjects | [ ] Yes [ ] No | [ ] Yes [ ] No | | |
| 5 | Notice available in relevant languages | [ ] Yes [ ] No | [ ] Yes [ ] No | | |

**Status**: [ ] Ready [ ] Partial [ ] Not Ready
**Gaps**: [Description]
**Remediation**: [Action items]

### P1.2 — Choice and Consent

| # | Control | Implemented | Evidence Available | Evidence Type | Owner |
|---|---------|------------|-------------------|---------------|-------|
| 1 | Consent obtained prior to/at collection | [ ] Yes [ ] No | [ ] Yes [ ] No | | |
| 2 | Consequences of refusal communicated | [ ] Yes [ ] No | [ ] Yes [ ] No | | |
| 3 | Opt-out mechanisms for marketing | [ ] Yes [ ] No | [ ] Yes [ ] No | | |
| 4 | Explicit consent for sensitive PI | [ ] Yes [ ] No | [ ] Yes [ ] No | | |
| 5 | Consent withdrawal mechanisms | [ ] Yes [ ] No | [ ] Yes [ ] No | | |

**Status**: [ ] Ready [ ] Partial [ ] Not Ready
**Gaps**: [Description]
**Remediation**: [Action items]

### P2.1 — Collection

| # | Control | Implemented | Evidence Available | Evidence Type | Owner |
|---|---------|------------|-------------------|---------------|-------|
| 1 | Collection limited to privacy notice scope | [ ] Yes [ ] No | [ ] Yes [ ] No | | |
| 2 | Collection points inventoried quarterly | [ ] Yes [ ] No | [ ] Yes [ ] No | | |
| 3 | Third-party sources documented | [ ] Yes [ ] No | [ ] Yes [ ] No | | |
| 4 | Implicit collection disclosed | [ ] Yes [ ] No | [ ] Yes [ ] No | | |

**Status**: [ ] Ready [ ] Partial [ ] Not Ready

### P3.1 — Use, Retention, and Disposal

| # | Control | Implemented | Evidence Available | Evidence Type | Owner |
|---|---------|------------|-------------------|---------------|-------|
| 1 | Use limited to stated purposes | [ ] Yes [ ] No | [ ] Yes [ ] No | | |
| 2 | Retention schedules defined | [ ] Yes [ ] No | [ ] Yes [ ] No | | |
| 3 | Automated deletion on expiry | [ ] Yes [ ] No | [ ] Yes [ ] No | | |
| 4 | Secure disposal (NIST 800-88) | [ ] Yes [ ] No | [ ] Yes [ ] No | | |
| 5 | Retention exceptions documented | [ ] Yes [ ] No | [ ] Yes [ ] No | | |

**Status**: [ ] Ready [ ] Partial [ ] Not Ready

### P4.1 — Access

| # | Control | Implemented | Evidence Available | Evidence Type | Owner |
|---|---------|------------|-------------------|---------------|-------|
| 1 | DSAR intake mechanism | [ ] Yes [ ] No | [ ] Yes [ ] No | | |
| 2 | Identity verification | [ ] Yes [ ] No | [ ] Yes [ ] No | | |
| 3 | Timely fulfillment | [ ] Yes [ ] No | [ ] Yes [ ] No | | |
| 4 | Correction mechanism | [ ] Yes [ ] No | [ ] Yes [ ] No | | |
| 5 | Denial documentation | [ ] Yes [ ] No | [ ] Yes [ ] No | | |

**Status**: [ ] Ready [ ] Partial [ ] Not Ready

### P5.1 — Disclosure to Third Parties

| # | Control | Implemented | Evidence Available | Evidence Type | Owner |
|---|---------|------------|-------------------|---------------|-------|
| 1 | Third-party recipients documented | [ ] Yes [ ] No | [ ] Yes [ ] No | | |
| 2 | DPAs with all third parties | [ ] Yes [ ] No | [ ] Yes [ ] No | | |
| 3 | Disclosures match privacy notice | [ ] Yes [ ] No | [ ] Yes [ ] No | | |
| 4 | Third-party assessments conducted | [ ] Yes [ ] No | [ ] Yes [ ] No | | |
| 5 | Unauthorized disclosures investigated | [ ] Yes [ ] No | [ ] Yes [ ] No | | |

**Status**: [ ] Ready [ ] Partial [ ] Not Ready

### P6.1 — Security for Privacy

| # | Control | Implemented | Evidence Available | Evidence Type | Owner |
|---|---------|------------|-------------------|---------------|-------|
| 1 | Encryption at rest | [ ] Yes [ ] No | [ ] Yes [ ] No | | |
| 2 | Encryption in transit | [ ] Yes [ ] No | [ ] Yes [ ] No | | |
| 3 | Role-based access controls | [ ] Yes [ ] No | [ ] Yes [ ] No | | |
| 4 | Access logging with retention | [ ] Yes [ ] No | [ ] Yes [ ] No | | |
| 5 | Breach notification trigger | [ ] Yes [ ] No | [ ] Yes [ ] No | | |

**Status**: [ ] Ready [ ] Partial [ ] Not Ready

### P7.1 — Quality

| # | Control | Implemented | Evidence Available | Evidence Type | Owner |
|---|---------|------------|-------------------|---------------|-------|
| 1 | Data quality validation at collection | [ ] Yes [ ] No | [ ] Yes [ ] No | | |
| 2 | Correction mechanism | [ ] Yes [ ] No | [ ] Yes [ ] No | | |
| 3 | Periodic accuracy reviews | [ ] Yes [ ] No | [ ] Yes [ ] No | | |

**Status**: [ ] Ready [ ] Partial [ ] Not Ready

### P8.1 — Monitoring and Enforcement

| # | Control | Implemented | Evidence Available | Evidence Type | Owner |
|---|---------|------------|-------------------|---------------|-------|
| 1 | Quarterly compliance monitoring | [ ] Yes [ ] No | [ ] Yes [ ] No | | |
| 2 | Complaint intake mechanism | [ ] Yes [ ] No | [ ] Yes [ ] No | | |
| 3 | Complaint tracking and resolution | [ ] Yes [ ] No | [ ] Yes [ ] No | | |
| 4 | Annual privacy training | [ ] Yes [ ] No | [ ] Yes [ ] No | | |
| 5 | Disciplinary process for violations | [ ] Yes [ ] No | [ ] Yes [ ] No | | |

**Status**: [ ] Ready [ ] Partial [ ] Not Ready

## Summary

| Criterion | Status | Score |
|-----------|--------|-------|
| P1.1 Notice | | /100 |
| P1.2 Choice/Consent | | /100 |
| P2.1 Collection | | /100 |
| P3.1 Use/Retention/Disposal | | /100 |
| P4.1 Access | | /100 |
| P5.1 Disclosure | | /100 |
| P6.1 Security | | /100 |
| P7.1 Quality | | /100 |
| P8.1 Monitoring | | /100 |
| **Overall** | | **/100** |

**Readiness Assessment**: [ ] Ready [ ] Near-Ready [ ] Not Ready

**Target Examination Period Start**: [Date]
**Key Remediation Items Before Start**: [List]