Two categories, two subjects
Confidentiality and Privacy are about different things.
Both sound like “keep data safe”. In the Trust Services Criteria they protect different subjects. Confidentiality covers information you have agreed to keep confidential, often a customer's business data. Privacy covers personal information and the commitments you make to the individuals it describes.
Back to SOC 2 services01 · The difference
The difference in one view
Confidentiality asks who may see it. Privacy asks what you may do with it and what the person can ask for.
Confidentiality
Information designated confidential
- Subject: information designated confidential by contract, law or policy
- Often business data: designs, pricing, deal files, source code, financials
- Concern: restricting access and disposing of it when due
- Criteria: C1.1 and C1.2
Privacy
Personal information
- Subject: information about an identified or identifiable person
- Customer users, patients, employees, consumers
- Concern: notice, choice, use, retention, access, disclosure
- Criteria: P1 to P8
Personal information can also be confidential. The categories overlap on the data, not on the questions they ask.
A simple way to keep them apart: Confidentiality is a promise you make to whoever designated the information, usually your business customer. Privacy is a set of promises you make to the person the information is about, usually stated in a privacy notice. If no individual has been told anything by you, and no individual can ask you for anything, Privacy may have little to test even when personal data flows through the system.
02 · Examples
Examples that sort themselves
Illustrative data, and which category speaks to it.
| Illustrative information | Confidentiality | Privacy |
|---|---|---|
| A customer's unreleased product roadmap in your project tool | Yes | No |
| Merger documents in a virtual data room | Yes | Only for personal details inside them |
| End users' names and emails in your consumer app | If contracts designate them | Yes |
| Patient records processed for a clinic | Yes, by contract | Yes, if you make privacy commitments |
| Aggregated, de-identified usage statistics | Possibly | Usually not |
03 · Controls each invites
The controls each category invites
Different evidence for different promises.
Confidentiality
- An inventory or classification that identifies which information is confidential.
- Access restricted to people and systems that need it, beyond the Security baseline.
- Retention periods, and disposal on schedule with a record (deletion logs, destruction certificates from a vendor).
- Confidentiality terms in contracts with staff and vendors who touch the data.
Privacy
- A privacy notice that matches what the system actually does.
- Choice and consent records where you rely on consent.
- Collection limited to stated purposes, and use matching the notice.
- A process for individuals to access and correct their information.
- Rules and records for disclosure to third parties, including breach notification.
- Monitoring of privacy complaints and compliance with the commitments.
04 · Privacy laws
How each relates to GDPR, DPDP and HIPAA
Helpful overlap. Not compliance.
The Privacy category's themes (notice, purpose, access, disclosure) echo many privacy laws, including the EU GDPR, India's Digital Personal Data Protection Act, 2023 (DPDP) and the US HIPAA Privacy Rule. Confidentiality's disposal and access themes support security and retention duties in the same laws. Neither category tests whether you comply with a law. A SOC 2 opinion measures controls against the Trust Services Criteria and your stated commitments, nothing more.
What you can honestly say
“Our SOC 2 report includes the Privacy category, which examined controls over notice, consent, access and disclosure.” Not: “Our SOC 2 shows we are GDPR compliant.”
05 · When you need both
When to include one, the other, or both
Follow the data and the promises.
- Confidentiality onlyYou hold customers' business information under confidentiality terms, and personal data is incidental or handled only on their instructions.
- Privacy onlyYou collect personal information directly from people and publish privacy commitments to them, but hold little designated business data.
- BothYou hold confidential business data and make direct privacy commitments, for example a platform serving both enterprise clients and their end users.
- Neither, yetSecurity alone covers your contracts today. Revisit when a contract or new product changes that.
Sources: AICPA Trust Services Criteria TSP section 100 (Confidentiality C1.1–C1.2; Privacy P1.0–P8.0); AICPA Guide, SOC 2 Reporting on an Examination of Controls at a Service Organization; Regulation (EU) 2016/679; Digital Personal Data Protection Act, 2023 (India); HIPAA Privacy Rule, 45 CFR Part 164 Subpart E.
Questions about the two categories
Isn't Privacy just Confidentiality for personal data?
No. It adds the individual's rights.
Confidentiality limits who sees information. Privacy also covers notice, consent, purpose, access requests and disclosure to third parties, which are obligations owed to the person.
Does the Security category already protect confidential data?
Partly.
Security covers protection against unauthorized access generally. Confidentiality adds identifying the specific information, honouring its restrictions and disposing of it when due.
We are a processor under GDPR. Do we need the Privacy category?
Often not, but it depends on your commitments.
If you act only on your customers' instructions and make no direct promises to individuals, Confidentiality plus Security may fit better. Decide from your contracts, not the label.
Can our privacy notice create audit problems?
Yes, if it promises more than you do.
Under the Privacy category, the notice is a commitment. Claims about deletion times or sharing that the system does not deliver become exceptions.
Match the category to the data and the promise.
We map your data flows and commitments and recommend Confidentiality, Privacy, both or neither.