P1.1 P · Privacy · Privacy

P1.1 — Privacy notice

Notice is provided to data subjects about the entity's privacy practices and objectives.

Also written as P 1.1, TSC P1.1, SOC2 P1.1, SOC 2 Type 2 P1.1.

Written by Jett N. · Last reviewed

What SOC 2 P1.1 requires

Privacy notice is one of 18 criteria in the Privacy (P) series of the Privacy category. Notice is provided to data subjects about the entity's privacy practices and objectives. Because this sits outside the Common Criteria, it is only tested when Privacy is in the scope of your engagement — check your report scope before building evidence for it.

Audit evidence assessors look for

When preparing for a SOC 2 audit against P1.1, gather artefacts such as:

  • Published privacy notice covering collection, use, retention, disclosure, disposal
  • Notice review and update records
  • Evidence notice is provided at or before collection
  • Version history of privacy notice changes

ISO 27001 mapping

P1.1 corresponds to the following ISO 27001:2022 Annex A control(s): A.5.34. If you already run an ISO 27001 ISMS, map your existing evidence for these controls to P1.1 rather than duplicating work.

Map P1.1 to ISO 27001 & NIST CSF →
Crosswalk this criterion in the Control Mapper & Gap Assessment.
Document the risk →
Record treatment for gaps against P1.1 in the Risk Register.

Other Privacy criteria

P2.1 Choice and consent P3.1 Collection limited to identified purposes P3.2 Explicit consent for sensitive information P4.1 Use limited to identified purposes P4.2 Retention of personal information P4.3 Secure disposal of personal information P5.1 Access to personal information P5.2 Correction of personal information P6.1 Disclosure with consent P6.2 Recording authorized disclosures P6.3 Recording unauthorized disclosures P6.4 Third-party privacy commitments P6.5 Third-party breach notification obligations P6.6 Breach notification to data subjects P6.7 Accounting of disclosures P7.1 Data quality P8.1 Privacy inquiries, complaints and disputes

All P Privacy criteria →

Frequently asked questions

Is P1.1 required for a SOC 2 report?

Only if the Privacy category is in scope. The Common Criteria (CC1–CC9) are mandatory for every SOC 2, but P criteria are tested only when you elect to include Privacy in the engagement. Scope is your choice, usually driven by customer contracts.

How does an auditor test P1.1?

In a Type 1 report the auditor assesses design only — does a control exist at a point in time that would meet P1.1 if it operated. In a Type 2 report they also test operating effectiveness by sampling evidence from across the review period, typically 3 to 12 months. That difference is why Type 2 evidence has to be continuous rather than assembled the week before fieldwork.

What happens if P1.1 fails testing?

A control that fails becomes an exception, which the auditor describes in the report along with management's response. Exceptions do not automatically make a report "failed" — a SOC 2 report is an opinion, not a pass/fail certificate — but a qualified opinion is what customers notice, so remediate and re-test before fieldwork closes where you can.

Does SOC 2 P1.1 map to ISO 27001?

Yes — P1.1 aligns with ISO 27001:2022 Annex A control(s) A.5.34. If you already run a certified ISMS, re-point that evidence rather than building a parallel set; the underlying control is the same and only the reporting format differs.