Frameworks / SOC 2 / SOC2-P6.1 SOC 2 SOC2-P6.1: P6.1 Disclosure to third parties with consent Third parties receive personal information only with the data subject's explicit consent obtained beforehand. Points of focus: privacy policies or handling instructions are communicated to recipients; disclosure happens only for the collection purposes and with implicit or explicit consent unless law requires otherwise; only to third parties with agreements to protect the information consistently with the notice, whose controls are evaluated; and disclosure for new purposes requires prior consent.
Maintained by Gerard Blokdyk · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 208 controls across 57 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
7.2.3 Determine when and how consent is to be obtained 7.2.4 Obtain and record consent 7.5 PII sharing, transfer, and disclosure 7.5.1 Identify basis for PII transfer between jurisdictions 7.5.2 Countries and international organizations to which PII can be transferred 7.5.4 Records of PII disclosure to third parties 8.5 PII sharing, transfer, and disclosure 8.5.3 Records of PII disclosure to third parties GDPR-Art.10 Processing of personal data relating to criminal convictions GDPR-Art.11 Processing which does not require identification GDPR-Art.13 Information to be provided where personal data are collected GDPR-Art.15 Right of access by the data subject GDPR-Art.19 Notification obligation regarding rectification, erasure or restriction GDPR-Art.6 Lawfulness of processing GDPR-Art.9 Processing of special categories of personal data APPI-A23 Security Control Measures APPI-A24 Supervision of Employees APPI-A27 Restriction on Provision to Third Parties APPI-A28 Provision to Third Parties in Foreign Countries APPI-A31 Provision of Personally Referable Information APPI-A33 Request for Disclosure of Retained Personal Data 5.14 Information transfer 5.19 Information security in supplier relationships 5.20 Addressing information security within supplier agreements 5.31 Legal, statutory, regulatory and contractual requirements 5.34 Privacy and protection of PII 5.19 Information security in supplier relationships 5.20 Addressing information security within supplier agreements 5.31 Legal, statutory, regulatory and contractual requirements 5.34 Privacy and protection of personal identifiable information (PII) TANZANIA-1 Scope, Registration, Lawful Basis TANZANIA-3 Data Subject Rights TANZANIA-4 Security and Cross-Border TANZANIA-5 DPO, Governance, Breach TRINIDAD-1 Scope, Definitions, Commission TRINIDAD-3 Data Subject Rights TRINIDAD-4 Security, Accuracy TRINIDAD-5 Enforcement and Sanctions Standard 13 Nudge Techniques Standard 14 Connected Toys and Devices Standard 5 Detrimental Use of Data Standard 8 Data Minimisation MYHR-CUD-1 Authorised collection, use and disclosure only MYHR-CUD-4 Records not held or taken outside Australia MYHR-CUD-5 Interaction with the Privacy Act 1988 APP-1 APP 1 - Open and transparent management of personal information APP-3 APP 3 - Collection of solicited personal information APP-5 APP 5 - Notification of the collection of personal information AT-DSG-11 Sections 42-45 - Data subject rights (law enforcement) AT-DSG-13 Section 36 - Scope of law enforcement processing AT-DSG-14 Section 38 - Lawfulness of law enforcement processing AZ-DPA-12 Article 13 - Cross-border transfer AZ-DPA-14 Article 16 - Liability for violations AZ-DPA-15 Article 17 - Dispute resolution BB-DPA-14 Section 15 - Right to Data Portability BB-DPA-16 Section 22 - General Principle for Transfers BB-DPA-21 Sections 61-69 - Data Privacy Officer C5-INQ-01 Legal Assessment of Investigative Inquiries C5-INQ-03 Conditions for Access to or Disclosure of Data in Investigation Requests C5-INQ-04 Limiting Access to or Disclosure of Data in Investigation Requests UAE-PDPL-Art.10 Data Protection Officer (DPO) (UAE PDPL Article 10) UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21) UAE-PDPL-Art.4_5 Lawful basis and principles for processing personal data (UAE PDPL Articles 4-5) 29100-6.10 Information security 29100-6.5 Use, retention and disclosure limitation 29100-6.9 Accountability 29134-1 Scope 29134-3 Terms and definitions 29134-9.1 PIA report structure SA-PDPL-13 Encryption of personal data SA-PDPL-15 Access control for personal data SA-PDPL-22 Privacy by design and default ISMSP-PI-01 Personal Information Collection ISMSP-PI-04 Cross-Border Transfer ISMSP-SYS-02 Encryption Implementation SWE-1 Scope and Purpose SWE-11 Integritetsskyddsmyndigheten (IMY) SWE-2 Relationship to GDPR UK-DPA18-GEN-04 UK-Specific Exemptions UK-DPA18-LE-02 Data Subject Rights (Law Enforcement) UK-DPA18-LE-03 International Transfers (Law Enforcement) AUCDR-PS-6 Privacy Safeguard 6 - Use or disclosure of CDR data AUCDR-PS-8 Privacy Safeguard 8 - Overseas disclosure of CDR data FDBR-ControllerObligations-DPA-Notice Controller + Processor Obligations + Data Protection Assessments (Fla. Stat. 501.707, 501.708, 501.71, 501.711) FDBR-Scope-Defs Scope, Applicability Thresholds and Definitions (Fla. Stat. 501.701, 501.702, 501.703, 501.704) 27400-5.4 Data and privacy risks 27400-7.3 Data minimization and purpose limitation 27557-3 Terms and definitions 27557-4.3 Individual impact consideration SASB-SC-1 Customer Privacy and Data Security SASB-SOC-2 Customer Privacy SSAE18-P1.1 P1.1 - Privacy Notice SSAE18-P1.2 P1.2 - Choice and Consent TAIWAN-2 Consent, Notice, Sensitive Data TAIWAN-3 Data Subject Rights UKGDPRREG-2 Data Subject Rights (Articles 12-22) UKGDPRREG-3 Controller and Processor (Articles 24-43) UGA-13 Unlawful Obtaining or Disclosure UGA-15 Unauthorized Sale of Data URUGUAY-1 Scope, Lawful Basis, Consent URUGUAY-5 Database Registration with AGESIC URCDP AL-DPA-12 International Data Transfers DS-2 Ensure software supply chain security §1798.120 Right to Opt Out of Sale or Sharing of Personal Information CA-10 Selects and Develops Control Activities EUAI-Art.59 Further processing of personal data for developing certain AI systems in the public interest in the AI regulatory sandbox FTC-Safeguards-Scope-Defs Scope, Definitions and Financial Institution Applicability (16 CFR 314.1, 314.2) ISO23894-A.5 Privacy and Data Protection in AI RIDTPPA-11 Data Minimisation and Purpose Limitation SOC-CY-DC2 Nature of Sensitive Information STUDPRV-2 Data Subject Rights for Students and Parents TISAXASS-3 Prototype Protection and Confidentiality TEXASTDPSA-3 Sensitive Data, Children, Sale Notice UKAI-2 Sector-Specific Regulator Engagement OB-CX.2 Granular Consent Management VIRGINIAVCDPA-1 Scope, Applicability, Definitions SO3.2 Regulatory frameworks for digital health Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in P - Privacy You are reading one control. How much of SOC 2 have you already done? SOC 2 SOC2-P6.1 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of SOC 2 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 49 of 61 SOC 2 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 193 were rejected on the NIST SP 800-53 Rev 5 pair alone.
Query this from an agent The graph holds this control, the 208 it maps to, and the evidence behind each claim, over MCP and REST.