Frameworks / SOC 2 / SOC2-P3.1 SOC 2 SOC2-P3.1: P3.1 Collecting personal information consistent with objectives Personal information is collected in line with the organisation's privacy objectives. Points of focus: collection is limited to what the objectives need; collection methods are reviewed by management before use to confirm information is gathered fairly, without deception or intimidation, and lawfully; third-party sources are confirmed to be reliable and to collect fairly and lawfully; and data subjects are told when additional information about them is developed or acquired.
Maintained by Gerard Blokdyk · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 221 controls across 62 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
6.5.2 Information classification 7.2 Conditions for collection and processing 7.2.1 Identify and document purpose 7.2.2 Identify lawful basis 7.2.4 Obtain and record consent 7.3.3 Providing information to PII principals 7.4 Privacy by design and privacy by default 7.4.1 Limit collection 7.4.4 PII minimization objectives 8.1 General 8.2 Conditions for collection and processing 8.4 Privacy by design and privacy by default GDPR-Art.10 Processing of personal data relating to criminal convictions GDPR-Art.11 Processing which does not require identification GDPR-Art.14 Information where personal data have not been obtained from the data subject GDPR-Art.15 Right of access by the data subject GDPR-Art.19 Notification obligation regarding rectification, erasure or restriction GDPR-Art.25 Data protection by design and by default GDPR-Art.5 Principles relating to processing of personal data GDPR-Art.6 Lawfulness of processing GDPR-Art.9 Processing of special categories of personal data APPI-A17 Specification of the Purpose of Use APPI-A20 Proper Acquisition and Special Care Required Personal Information APPI-A23 Security Control Measures APPI-A24 Supervision of Employees APPI-A33 Request for Disclosure of Retained Personal Data 8.4 AI system impact assessment A.4.3 Data resources A.5.4 Assessing AI system impact on individuals or groups of individuals A.7 Data for AI systems A.7.3 Acquisition of data TANZANIA-1 Scope, Registration, Lawful Basis TANZANIA-3 Data Subject Rights TANZANIA-4 Security and Cross-Border TANZANIA-5 DPO, Governance, Breach TRINIDAD-1 Scope, Definitions, Commission TRINIDAD-3 Data Subject Rights TRINIDAD-4 Security, Accuracy TRINIDAD-5 Enforcement and Sanctions Standard 13 Nudge Techniques Standard 14 Connected Toys and Devices Standard 5 Detrimental Use of Data Standard 8 Data Minimisation APP-1 APP 1 - Open and transparent management of personal information APP-3 APP 3 - Collection of solicited personal information APP-5 APP 5 - Notification of the collection of personal information AT-DSG-11 Sections 42-45 - Data subject rights (law enforcement) AT-DSG-13 Section 36 - Scope of law enforcement processing AT-DSG-14 Section 38 - Lawfulness of law enforcement processing AZ-DPA-12 Article 13 - Cross-border transfer AZ-DPA-14 Article 16 - Liability for violations AZ-DPA-15 Article 17 - Dispute resolution BB-DPA-14 Section 15 - Right to Data Portability BB-DPA-16 Section 22 - General Principle for Transfers BB-DPA-21 Sections 61-69 - Data Privacy Officer CIS-3.13 Deploy a Data Loss Prevention Solution CIS-3.2 Establish and Maintain a Data Inventory CIS-3.7 Establish and Maintain a Data Classification Scheme UAE-PDPL-Art.10 Data Protection Officer (DPO) (UAE PDPL Article 10) UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21) UAE-PDPL-Art.4_5 Lawful basis and principles for processing personal data (UAE PDPL Articles 4-5) 29100-6.10 Information security 29100-6.5 Use, retention and disclosure limitation 29100-6.9 Accountability 29134-1 Scope 29134-3 Terms and definitions 29134-9.1 PIA report structure SA-PDPL-13 Encryption of personal data SA-PDPL-15 Access control for personal data SA-PDPL-22 Privacy by design and default ISMSP-PI-01 Personal Information Collection ISMSP-PI-04 Cross-Border Transfer ISMSP-SYS-02 Encryption Implementation SWE-1 Scope and Purpose SWE-11 Integritetsskyddsmyndigheten (IMY) SWE-2 Relationship to GDPR UK-DPA18-GEN-04 UK-Specific Exemptions UK-DPA18-LE-02 Data Subject Rights (Law Enforcement) UK-DPA18-LE-03 International Transfers (Law Enforcement) MYHR-CUD-1 Authorised collection, use and disclosure only MYHR-SBD-1 Share by default for prescribed key health information §1798.100 General Duties of Businesses that Collect Personal Information §1798.130(a)(3) Privacy Policy Content Requirements CM-12(1) Information Location | Automated Tools to Support Information Location (CM-12(1)) SA-8 Security and Privacy Engineering Principles CM-12(1) Information Location | Automated Tools to Support Information Location (CM-12(1)) SA-8 Security and Privacy Engineering Principles FDBR-ControllerObligations-DPA-Notice Controller + Processor Obligations + Data Protection Assessments (Fla. Stat. 501.707, 501.708, 501.71, 501.711) FDBR-Scope-Defs Scope, Applicability Thresholds and Definitions (Fla. Stat. 501.701, 501.702, 501.703, 501.704) 5.12 Classification of information 5.34 Privacy and protection of personal identifiable information (PII) 5.12 Classification of information 5.34 Privacy and protection of PII 27400-5.4 Data and privacy risks 27400-7.3 Data minimization and purpose limitation 27557-3 Terms and definitions 27557-4.3 Individual impact consideration SASB-SC-1 Customer Privacy and Data Security SASB-SOC-2 Customer Privacy SSAE18-P1.1 P1.1 - Privacy Notice SSAE18-P1.2 P1.2 - Choice and Consent TAIWAN-2 Consent, Notice, Sensitive Data TAIWAN-3 Data Subject Rights UKGDPRREG-2 Data Subject Rights (Articles 12-22) UKGDPRREG-3 Controller and Processor (Articles 24-43) UGA-13 Unlawful Obtaining or Disclosure UGA-15 Unauthorized Sale of Data URUGUAY-1 Scope, Lawful Basis, Consent URUGUAY-5 Database Registration with AGESIC URCDP AL-DPA-12 International Data Transfers AUCDR-PS-3 Privacy Safeguard 3 - Seeking to collect CDR data from CDR participants DS-2 Ensure software supply chain security CA-10 Selects and Develops Control Activities CCM-DSP-12 Limitation of Purpose in Personal Data Processing EUAI-Art.59 Further processing of personal data for developing certain AI systems in the public interest in the AI regulatory sandbox FTC-Safeguards-Scope-Defs Scope, Definitions and Financial Institution Applicability (16 CFR 314.1, 314.2) ISO23894-A.5 Privacy and Data Protection in AI RIDTPPA-11 Data Minimisation and Purpose Limitation SOC-CY-DC2 Nature of Sensitive Information STUDPRV-2 Data Subject Rights for Students and Parents TISAXASS-3 Prototype Protection and Confidentiality TEXASTDPSA-3 Sensitive Data, Children, Sale Notice UKAI-2 Sector-Specific Regulator Engagement OB-CX.2 Granular Consent Management VIRGINIAVCDPA-1 Scope, Applicability, Definitions SO3.2 Regulatory frameworks for digital health Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in P - Privacy You are reading one control. How much of SOC 2 have you already done? SOC 2 SOC2-P3.1 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of SOC 2 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 49 of 61 SOC 2 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 193 were rejected on the NIST SP 800-53 Rev 5 pair alone.
Query this from an agent The graph holds this control, the 221 it maps to, and the evidence behind each claim, over MCP and REST.