P4.2 P · Privacy · Privacy

P4.2 — Retention of personal information

Personal information is retained consistent with the entity's privacy objectives.

Also written as P 4.2, TSC P4.2, SOC2 P4.2, SOC 2 Type 2 P4.2.

Written by Jett N. · Last reviewed

What SOC 2 P4.2 requires

Retention of personal information is one of 18 criteria in the Privacy (P) series of the Privacy category. Personal information is retained consistent with the entity's privacy objectives. Because this sits outside the Common Criteria, it is only tested when Privacy is in the scope of your engagement — check your report scope before building evidence for it.

Audit evidence assessors look for

When preparing for a SOC 2 audit against P4.2, gather artefacts such as:

  • PI retention schedule
  • Automated retention / deletion job configuration
  • Retention exception approvals (legal hold)
  • Evidence of deletion at end of retention period

ISO 27001 mapping

P4.2 corresponds to the following ISO 27001:2022 Annex A control(s): A.5.33. If you already run an ISO 27001 ISMS, map your existing evidence for these controls to P4.2 rather than duplicating work.

Map P4.2 to ISO 27001 & NIST CSF →
Crosswalk this criterion in the Control Mapper & Gap Assessment.
Document the risk →
Record treatment for gaps against P4.2 in the Risk Register.

Other Privacy criteria

P1.1 Privacy notice P2.1 Choice and consent P3.1 Collection limited to identified purposes P3.2 Explicit consent for sensitive information P4.1 Use limited to identified purposes P4.3 Secure disposal of personal information P5.1 Access to personal information P5.2 Correction of personal information P6.1 Disclosure with consent P6.2 Recording authorized disclosures P6.3 Recording unauthorized disclosures P6.4 Third-party privacy commitments P6.5 Third-party breach notification obligations P6.6 Breach notification to data subjects P6.7 Accounting of disclosures P7.1 Data quality P8.1 Privacy inquiries, complaints and disputes

All P Privacy criteria →

Frequently asked questions

Is P4.2 required for a SOC 2 report?

Only if the Privacy category is in scope. The Common Criteria (CC1–CC9) are mandatory for every SOC 2, but P criteria are tested only when you elect to include Privacy in the engagement. Scope is your choice, usually driven by customer contracts.

How does an auditor test P4.2?

In a Type 1 report the auditor assesses design only — does a control exist at a point in time that would meet P4.2 if it operated. In a Type 2 report they also test operating effectiveness by sampling evidence from across the review period, typically 3 to 12 months. That difference is why Type 2 evidence has to be continuous rather than assembled the week before fieldwork.

What happens if P4.2 fails testing?

A control that fails becomes an exception, which the auditor describes in the report along with management's response. Exceptions do not automatically make a report "failed" — a SOC 2 report is an opinion, not a pass/fail certificate — but a qualified opinion is what customers notice, so remediate and re-test before fieldwork closes where you can.

Does SOC 2 P4.2 map to ISO 27001?

Yes — P4.2 aligns with ISO 27001:2022 Annex A control(s) A.5.33. If you already run a certified ISMS, re-point that evidence rather than building a parallel set; the underlying control is the same and only the reporting format differs.