FAQ Category: FAQs • SOC 2

Estimate the extra effort by mapping the personal-data activities and GDPR obligations that apply, then comparing them with your existing controls and evidence. Sort the gaps into three groups: already supported, needs adapting, and missing. For example, access-control evidence may be reusable, but it does not establish a lawful basis for processing or show that you can handle individuals’ rights requests. Assign owners and estimate the remaining tasks with a qualified privacy adviser. Your SOC 2 report is an input to that assessment, not proof of GDPR compliance.

SOC 2 is an independent CPA examination of a service organization’s described system and controls against the applicable Trust Services Criteria. SOC stands for System and Organization Controls. A Type 1 report addresses the system description and suitability of control design as of a date. A Type 2 report also addresses operating effectiveness over a period. Read the report’s scope and categories to understand what was examined; it is not a general certification of the entire company. See our more detailed SOC 2 Report page for more information.