Confidentiality adds two criteria, C1.1 and C1.2, about identifying and disposing of confidential information. Privacy adds eight groups, P1 through P8, about personal information from notice to monitoring. Add Confidentiality when customers send you their sensitive business data. Add Privacy when you handle personal information as a core service.
What is the baseline?
Every SOC 2 report includes the Security category, the common criteria CC1 to CC9. Availability, Confidentiality, Processing Integrity and Privacy are optional. You and the auditor choose which to include in scope, and the report says so.
What does Confidentiality add?
Just two criteria, but they are specific.
C1.1 is about identifying and maintaining confidential information. That means a data classification scheme, an inventory of where confidential data lives, and a retention period for each class. C1.2 is about disposal: when the retention period ends or a customer leaves, you delete the data and can show that you did.
Most of the access, encryption and transmission controls you already built for CC6 support this. The new work is the inventory and the deletion process.
Evidence the auditor will ask for: the classification policy, a data inventory, a sample of customer offboarding tickets with deletion confirmation, and the contractual confidentiality terms with vendors who see the data.
What does Privacy add?
Privacy is much larger. The criteria are grouped by what they cover:
- P1: notice about your privacy practices.
- P2 and P3: choice, consent and collection.
- P4: use, retention and disposal.
- P5: access and correction by individuals.
- P6: disclosure to third parties, records of disclosures, breach notification and vendor commitments.
- P7: data quality.
- P8: a process for complaints and monitoring.
Privacy criteria apply to personal information, and the entity's role matters. A company that decides why data is collected carries the notice and consent criteria. A pure service provider processing customer data may carry fewer, and the auditor and management agree on which apply. Check scoping with your auditor early.
Which should you pick?
Ask what customers are requesting in security questionnaires. If buyers worry about their proprietary data, such as source code, contracts, models or financial files, pick Confidentiality. If you hold consumer or employee personal information and customers must answer to regulators about it, think about Privacy.
Do not add a category because it looks impressive. Each one extends the period of evidence you must sustain and adds exceptions risk. Many first reports are Security alone, with Confidentiality added later.
How does this change the audit?
More categories mean more criteria in the control matrix and more samples. Confidentiality usually adds a handful of tests, such as a sample of deletion tickets and a review of the data inventory. Privacy adds many more, because the auditor will test notices, consent records, request handling and disclosure logs. Budget internal time for the extra evidence before you agree the scope, and ask the auditor how they plan to sample each new area.
Mistakes to avoid
- Writing a classification policy with five levels nobody uses. Three is enough: public, internal, confidential.
- Promising deletion in the privacy notice that backups or logs defeat. Describe the real backup retention.
- Treating Privacy as a duplicate of GDPR. The overlap is partial, and SOC 2 tests your own stated commitments.
- Skipping vendor commitments. P6.4 and P6.5 expect privacy commitments from vendors that touch personal information.
What to do
- List the data types you handle and tag each public, internal or confidential.
- Map where each confidential type is stored, including backups, logs and analytics tools.
- Set retention and a deletion method per class, then test one deletion end to end.
- Add confidentiality terms to vendor contracts where data is shared.
- For Privacy, publish a notice that matches what you do, and build a request intake for access and correction.
- Record disclosures to third parties and any detected unauthorized disclosures.
- Confirm scoping in writing with the auditor before fieldwork.
Quick check
Can I add Confidentiality only for the second year?
Yes. Categories are chosen per report. Adding one later means a new period of evidence for those criteria.
Is Privacy the same as being GDPR compliant?
No. SOC 2 Privacy tests your controls against the criteria and your own commitments. GDPR is a law with its own requirements.
How Safeguard helps automate this
Safeguard's compliance suite covers frameworks, controls, evidence and continuous monitoring, so the confidentiality and privacy controls you add sit next to your Security controls with evidence collected from connected systems rather than screenshots. Automated tests and questionnaires help answer what a buyer asks about data handling. Technical evidence, including scans and SBOMs, comes from your actual code and dependencies, which shows where sensitive data libraries and secrets live. Safeguard does not make you compliant, and it does not replace the auditor, who forms the independent opinion. It helps prepare and keep evidence ready. Explore the framework mapping demo or book a call.
Sources
- AICPA, Trust Services Criteria (2017, with 2022 points of focus): C1.1, C1.2 and P1.0 to P8.1, paraphrased.
Last reviewed: 18 October 2026.
