P2.1 - Choices for Collection and Use of Personal Information

P2.1 requires an organization to define and communicate clear options for individuals about how their personal information is collected and used, obtaining consent where required and documenting the purposes for data gathering. This supports compliance with applicable privacy laws and the SOC 2 criteria for security, availability, processing integrity, confidentiality and privacy.