# SOC 2 Privacy Audit Standards Reference

## Primary Standards

### AICPA TSP Section 100 (2017 Trust Services Criteria)
- **Title**: Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy
- **Publisher**: American Institute of Certified Public Accountants (AICPA)
- **Status**: Active (2017 revision, effective for examinations on or after December 15, 2018)
- **Scope**: Defines the criteria for evaluating an entity's controls relevant to the five Trust Services Categories
- **Privacy Criteria**: P1.0 (Notice), P1.2 (Choice/Consent), P2.1 (Collection), P3.1 (Use/Retention/Disposal), P4.1 (Access), P5.1 (Disclosure), P6.1 (Security for Privacy), P7.1 (Quality), P8.1 (Monitoring/Enforcement)

### SSAE 18 (Statement on Standards for Attestation Engagements No. 18)
- **Title**: Attestation Standards: Clarification and Recodification
- **Publisher**: AICPA Auditing Standards Board
- **Effective**: May 1, 2017
- **Scope**: Governs the attestation standards under which SOC 2 examinations are performed
- **Key Section**: AT-C Section 205 (Examination Engagements)

### SOC 2 Reporting Guide
- **Title**: SOC 2 Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy
- **Publisher**: AICPA
- **Purpose**: Provides guidance on performing and reporting on SOC 2 examinations

## Supporting Standards

### AICPA Generally Accepted Privacy Principles (GAPP)
- **Published**: 2009 (updated 2011)
- **Relationship**: The Privacy TSC (P1-P8) is derived from the GAPP framework
- **Key Content**: Ten privacy principles: Management, Notice, Choice and Consent, Collection, Use/Retention/Disposal, Access, Disclosure to Third Parties, Security for Privacy, Quality, Monitoring and Enforcement

### AU-C Section 530 — Audit Sampling
- **Publisher**: AICPA
- **Application**: Governs sampling methodologies used in SOC 2 examinations
- **Key Guidance**: Statistical and non-statistical sampling approaches, sample size determination, evaluation of results

### AICPA Code of Professional Conduct
- **Scope**: Ethical standards governing CPA firms performing SOC 2 examinations
- **Key Provisions**: Independence, objectivity, competence, due professional care

## Regulatory and Framework Alignment

### GDPR (Regulation (EU) 2016/679)
- SOC 2 Privacy TSC addresses several GDPR requirements but does not provide full GDPR coverage
- Key gaps: SOC 2 does not address all six lawful bases (Art. 6), data protection by design (Art. 25), DPIA requirements (Art. 35), cross-border transfer mechanisms (Art. 44-49)
- SOC 2 can serve as supporting evidence for GDPR Art. 28 processor compliance

### CCPA/CPRA (California Consumer Privacy Act / California Privacy Rights Act)
- SOC 2 Privacy criteria align with several CCPA/CPRA requirements
- P1.0 (Notice) aligns with CCPA Section 1798.100(b) notice requirements
- P4.1 (Access) aligns with CCPA Section 1798.110 right to know
- P3.1 (Disposal) aligns with CCPA Section 1798.105 right to delete

### NIST Privacy Framework
- SOC 2 Privacy criteria map to NIST Privacy Framework functions
- P1.0 (Notice) maps to Communicate-P function
- P6.1 (Security) maps to Protect-P function
- P8.1 (Monitoring) maps to Govern-P function

## Key Publications

- AICPA SOC 2 Reporting Guide (AICPA, current edition)
- AICPA Trust Services Criteria (TSP Section 100, 2017)
- AICPA Guide: Reporting on Controls at a Service Organization (SOC 2)
- ISACA SOC 2 Type II Compliance Handbook
- Deloitte SOC 2 Privacy Criteria Implementation Guide