P - Privacy

The SOC 2 Privacy criterion (code cc_privacy) evaluates how an organization collects, uses, retains, discloses, and destroys personal information in accordance with its privacy commitments and applicable regulations. It requires documented policies, controls, and processes that limit data handling to authorized purposes, provide notice to individuals, and ensure appropriate safeguards throughout the data lifecycle. Compliance demonstrates that the entity respects individuals' privacy rights and mitigates risks of unauthorized exposure.