SOC 2 P6.1: Disclosure with Consent

What this means

Disclosure with Consent means you cannot share personal information with external parties without first obtaining clear, documented permission from the data subject. This consent must be voluntary, informed, and specific to the intended use. Your disclosure practices must remain consistent with the privacy commitments you've made to customers and stakeholders.

How to comply

1. 1.Document all third-party recipients of personal data and their intended purposes
2. 2.Create clear consent mechanisms (opt-in forms, checkboxes, or signed agreements) for each disclosure scenario
3. 3.Maintain records of explicit consent from data subjects before any third-party sharing occurs
4. 4.Train employees on consent requirements and prohibit unauthorized disclosures
5. 5.Establish a process to honor data subject requests to withdraw consent
6. 6.Review and update consent language annually to reflect current privacy practices and regulatory changes

Evidence auditors look for

• Consent forms with specific disclosure purposes signed or electronically accepted by data subjects
• Email confirmations of opt-in consent for third-party data sharing
• Privacy policy sections clearly listing authorized recipients and their uses
• System logs showing consent timestamps and data disclosure dates
• Data Processing Agreements with third parties referencing valid consent
• Training records documenting employee awareness of consent requirements

Frequently asked questions

GRCWatch automates consent tracking and disclosure logging, so you maintain a complete audit trail of which data subjects approved which third-party shares—eliminating manual spreadsheets and consent gaps.

See how GRCWatch handles this control automatically

Related controls