FAQ: We have a SOC 2. How much effort is GDPR?

Estimate the extra effort by mapping the personal-data activities and GDPR obligations that apply, then comparing them with your existing controls and evidence. Sort the gaps into three groups: already supported, needs adapting, and missing. For example, access-control evidence may be reusable, but it does not establish a lawful basis for processing or show that you can handle individuals’ rights requests. Assign owners and estimate the remaining tasks with a qualified privacy adviser. Your SOC 2 report is an input to that assessment, not proof of GDPR compliance.

Additional FAQs

How should we review an AI vendor beyond its SOC 2 report?

Read the report's actual scope, then evaluate the AI service you plan to use. Ask about the data path, model providers, retention controls, training use, important configuration choices, and changes

What should an AI inventory include?

Start with the AI services people actually use, including features inside existing software. For each use case, record the owner, provider, purpose, users, data involved, connected systems, and whether the

What belongs in a simple SOC 2 control register?

Use one row per control with a stable identifier, a plain-language description, an owner, a frequency or trigger, and an evidence location. Add the relevant criteria mapping, the systems covered,

When are we ready to start a SOC 2 Type 2 reporting period?

Discuss the start date with the auditor after the in-scope controls are implemented and evidence collection is working. Check actual operation: can you retrieve an access approval, a completed review,

Can I fail a SOC 2 audit?

SOC 2 is not a simple pass-or-fail certification. The report may contain an unmodified, qualified, or adverse opinion, or a disclaimer of opinion. A control exception does not automatically mean

How should we organize SOC 2 evidence folders?

Choose a structure the whole team can explain, such as reporting period, control identifier, and activity date. Keep an index linking each requested item to its location and owner. Separate

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide