SOC2 Privacy (P) - Privacy Procedures

Control: Privacy Trust Service Criteria Status: Procedure template Last Updated: 2025-12-16 Owner: Privacy Officer / Data Protection Officer

Overview

This document defines privacy procedures for organizations using CloudForge CI that have elected to include the Privacy category in their SOC2 examination. These procedures address the collection, use, retention, disclosure, and disposal of personal information. These procedures are a template for addressing SOC2 Privacy (P) requirements.

P1 - Notice and Communication of Objectives

P1.1 - Privacy Notice

Privacy Notice Requirements

Organizations must provide privacy notices that include:

Element	Description	Location
Data Collected	Types of personal information collected	Privacy Policy
Collection Methods	How data is collected (forms, cookies, APIs)	Privacy Policy
Purpose	Why data is collected and how it's used	Privacy Policy
Third Parties	Disclosure to third parties	Privacy Policy
Retention	How long data is retained	Privacy Policy
Rights	Individual rights (access, correction, deletion)	Privacy Policy
Contact	How to contact for privacy inquiries	Privacy Policy

Privacy Notice Template

PRIVACY NOTICE
==============

INFORMATION WE COLLECT
----------------------
We collect the following types of personal information:
- Contact information (name, email, phone)
- Account credentials
- Usage data and analytics
- [Additional categories specific to application]

HOW WE USE YOUR INFORMATION
---------------------------
We use your information to:
- Provide and improve our services
- Communicate with you
- Comply with legal obligations
- [Additional purposes]

DATA SHARING
------------
We may share your information with:
- Service providers who assist our operations
- Legal authorities when required by law
- [Additional sharing scenarios]

DATA RETENTION
--------------
We retain your personal information for:
- Active accounts: Duration of account plus [X] years
- Inactive accounts: [X] years after last activity
- Legal requirements: As required by applicable law

YOUR RIGHTS
-----------
You have the right to:
- Access your personal information
- Correct inaccurate information
- Request deletion of your information
- Opt-out of marketing communications
- Data portability

CONTACT US
----------
Privacy inquiries: privacy@[company].com
Data Protection Officer: dpo@[company].com

Data Type	Consent Type	Mechanism
Essential Data	Implied (contractual necessity)	Terms of Service
Marketing	Explicit opt-in	Checkbox (unchecked by default)
Analytics	Opt-out available	Cookie banner
Sensitive Data	Explicit opt-in	Separate consent form
Third-Party Sharing	Explicit opt-in	Checkbox with disclosure

# Example: Cognito user pool with consent attributes
# Note: Cognito custom attributes only support String, Number, DateTime (not Boolean)
UserPool:
  Type: AWS::Cognito::UserPool
  Properties:
    Schema:
      - Name: marketing_consent
        AttributeDataType: String
        Mutable: true
        StringAttributeConstraints:
          MinLength: "4"
          MaxLength: "5"
      - Name: analytics_consent
        AttributeDataType: String
        Mutable: true
        StringAttributeConstraints:
          MinLength: "4"
          MaxLength: "5"
      - Name: consent_timestamp
        AttributeDataType: String
        Mutable: true
# Values stored as "true" or "false" strings

Field	Description	Retention
User ID	Unique identifier	Duration of consent
Consent Type	What was consented to	Duration of consent
Consent Status	Granted/Withdrawn	Duration of consent
Timestamp	When consent was given/withdrawn	Duration of consent
Method	How consent was obtained	Duration of consent
Version	Privacy policy version at consent time	Duration of consent

P3 - Collection

P3.1 - Data Collection Principles

Data Minimization

Principle	Implementation
Collect only what's needed	Review data fields annually
Purpose limitation	Document purpose for each field
Storage limitation	Implement retention policies
Accuracy	Provide user correction mechanisms

Personal Data Inventory

Data Category	Examples	Purpose	Legal Basis	Retention
Identity	Name, DOB, ID numbers	Account management	Contract	Account lifetime
Contact	Email, phone, address	Communication	Contract	Account lifetime
Financial	Payment card, bank account	Billing	Contract	7 years
Technical	IP address, device ID	Security, analytics	Legitimate interest	90 days
Usage	Activity logs, preferences	Service improvement	Legitimate interest	1 year

P4 - Use, Retention, and Disposal

P4.1 - Data Use Limitations

Permitted Uses

Use Category	Description	Requires Additional Consent
Primary Purpose	Service delivery	No
Security	Fraud prevention, threat detection	No
Legal Compliance	Regulatory requirements	No
Marketing	Promotional communications	Yes
Analytics	Product improvement	Depends on jurisdiction
Third-Party Sharing	Partner integrations	Yes

P4.2 - Data Retention Schedule

Data Type	Active Retention	Archive Retention	Disposal Method
User Accounts	Account lifetime	3 years post-closure	Secure deletion
Transaction Records	1 year	7 years	Secure deletion
Support Tickets	2 years	5 years	Secure deletion
Audit Logs	1 year	7 years	Secure deletion
Marketing Data	Consent duration	None	Immediate deletion
Analytics	90 days	1 year (aggregated)	Secure deletion

P4.3 - CloudForge CI Retention Implementation

# S3 Bucket with Lifecycle Policy for PII
PIIBucket:
  Type: AWS::S3::Bucket
  Properties:
    BucketName: !Sub "${AWS::StackName}-pii-data"
    BucketEncryption:
      ServerSideEncryptionConfiguration:
        - ServerSideEncryptionByDefault:
            SSEAlgorithm: aws:kms
            KMSMasterKeyID: !Ref DataEncryptionKey
    LifecycleConfiguration:
      Rules:
        - Id: PIIRetention
          Status: Enabled
          Transitions:
            - StorageClass: GLACIER
              TransitionInDays: 365
          ExpirationInDays: 2555  # 7 years
          NoncurrentVersionExpiration:
            NoncurrentDays: 90

# RDS with Backup Retention
Database:
  Type: AWS::RDS::DBInstance
  Properties:
    DBInstanceClass: db.t3.medium
    Engine: postgres
    BackupRetentionPeriod: 35
    DeleteAutomatedBackups: true
    StorageEncrypted: true
    KmsKeyId: !Ref DataEncryptionKey

P4.4 - Data Disposal Procedures

See SOC2_C1.2_DATA_DISPOSAL_PROCEDURES.md for detailed disposal procedures.

P5 - Access

P5.1 - Individual Access Rights

Access Request Process

┌─────────────────┐     ┌─────────────────┐     ┌─────────────────┐
│  Request        │────>│  Identity       │────>│  Data           │
│  Received       │     │  Verification   │     │  Compilation    │
└─────────────────┘     └─────────────────┘     └─────────────────┘
                                                        │
┌─────────────────┐     ┌─────────────────┐            │
│  Request        │<────│  Response       │<───────────┘
│  Closed         │     │  Delivery       │
└─────────────────┘     └─────────────────┘

Response Timelines

Jurisdiction	Response Deadline	Extension Available
GDPR (EU)	30 days	+60 days with notification
CCPA (California)	45 days	+45 days with notification
Default	30 days	Case-by-case

Data Subject Request Template

DATA SUBJECT ACCESS REQUEST RESPONSE
====================================
Request ID: [ID]
Date Received: [Date]
Response Date: [Date]
Requestor: [Name/Email]

IDENTITY VERIFICATION
---------------------
Method: [Email verification / ID document / Account login]
Verified: [Yes/No]
Verified By: [Name]

DATA PROVIDED
-------------
Category: [Identity Data]
- Name: [Value]
- Email: [Value]
- [Additional fields]

Category: [Usage Data]
- Last login: [Value]
- [Additional fields]

PROCESSING ACTIVITIES
---------------------
Your data is processed for:
1. [Purpose]
2. [Purpose]

THIRD-PARTY DISCLOSURES
-----------------------
Your data has been shared with:
- [Third party] for [purpose]

If you have questions about this response, contact: privacy@[company].com

P6 - Disclosure and Notification

P6.1 - Third-Party Disclosure

Third Party	Data Shared	Purpose	Safeguards	Agreement
AWS	All infrastructure data	Hosting	BAA, DPA	In place
[Payment Processor]	Payment data	Billing	PCI-DSS	In place
[Analytics Provider]	Usage data	Analytics	DPA	In place
[Support Tool]	Support tickets	Customer support	DPA	In place

Due Diligence Requirements

Requirement	Verification
Security Assessment	SOC2 report or security questionnaire
Data Processing Agreement	Signed DPA with privacy clauses
Sub-processor List	Documented and reviewed
Breach Notification	Contractual obligation to notify
Audit Rights	Right to audit security controls

P6.2 - Breach Notification

Notification Requirements by Jurisdiction

Jurisdiction	Authority Notification	Individual Notification	Timeline
GDPR	Required (supervisory authority)	If high risk to individuals	72 hours
CCPA	Not required	Required if unencrypted PI	Without unreasonable delay
HIPAA	Required (HHS)	Required	60 days
Default	As required	If risk of harm	72 hours

P7 - Quality

P7.1 - Data Accuracy

Data Quality Controls

Control	Implementation	Frequency
User Self-Service	Profile update capability	Continuous
Validation Rules	Input validation on forms	Real-time
Duplicate Detection	Automated matching	Daily
Decay Management	Email verification, re-confirmation	Annual

Correction Request Process

User submits correction request
Verify user identity
Validate correction request
Update records
Notify user of completion
Update downstream systems

P8 - Monitoring and Enforcement

P8.1 - Privacy Compliance Monitoring

Monitoring Activities

Activity	Frequency	Owner
Privacy Impact Assessment	Per new project	Privacy Officer
Data Inventory Review	Quarterly	Privacy Officer
Consent Audit	Quarterly	Privacy Officer
Third-Party Review	Annual	Procurement/Privacy
Policy Review	Annual	Privacy Officer
Training Completion	Annual	HR/Privacy

P8.2 - Privacy Training

Training Requirements

Audience	Training	Frequency
All Staff	Privacy awareness	Annual
Development	Privacy by design	Annual
Customer Support	Data subject requests	Annual
Marketing	Consent and preferences	Annual
Leadership	Privacy governance	Annual

CloudForge CI Privacy Controls

Control	Implementation	SOC2 Privacy Mapping
Encryption at Rest	KMS encryption for all data stores	P4.3
Encryption in Transit	TLS 1.2+ enforced	P4.3
Access Logging	CloudTrail for all API access	P5.2
Data Isolation	VPC isolation, security groups	P4.1
Backup Encryption	Encrypted backups with KMS	P4.3
Retention Policies	S3 lifecycle, RDS retention	P4.2

Overview​

P1 - Notice and Communication of Objectives​

P1.1 - Privacy Notice​

Privacy Notice Requirements​

Privacy Notice Template​

P2 - Choice and Consent​

P2.1 - Consent Management​

Consent Requirements​

CloudForge CI Consent Implementation​

Consent Record Requirements​

P3 - Collection​

P3.1 - Data Collection Principles​

Data Minimization​

Personal Data Inventory​

P4 - Use, Retention, and Disposal​

P4.1 - Data Use Limitations​

Permitted Uses​

P4.2 - Data Retention Schedule​

P4.3 - CloudForge CI Retention Implementation​

P4.4 - Data Disposal Procedures​

P5 - Access​

P5.1 - Individual Access Rights​

Access Request Process​

Response Timelines​

Data Subject Request Template​

P6 - Disclosure and Notification​

P6.1 - Third-Party Disclosure​

Third-Party Data Sharing Registry​

Due Diligence Requirements​

P6.2 - Breach Notification​

Notification Requirements by Jurisdiction​

P7 - Quality​

P7.1 - Data Accuracy​

Data Quality Controls​

Correction Request Process​

P8 - Monitoring and Enforcement​

P8.1 - Privacy Compliance Monitoring​

Monitoring Activities​

P8.2 - Privacy Training​

Training Requirements​

CloudForge CI Privacy Controls​

Audit Checklist​