Privacy: eight groups of promises to people.

1. 1You deal with people directlyYou collect personal information from the individuals themselves, through sign-up, an app or a form.
2. 2Your privacy notice is a selling pointBuyers want independent comfort that what the notice says is what happens.
3. 3Customers pass you their users' dataAnd they want assurance about access, correction and disclosure, not only security.
4. 4Requests from individuals are routineAccess and correction requests are part of how your service runs.

Some criteria may not apply to a given service. The criteria document itself gives the example of a service organization that never collects personal information from individuals directly, for which the collection criterion P3.1 would not apply.

1. P1
   Notice and communicationP1.1. Tell people what you do with their data, and tell them again when it changes.
2. P2
   Choice and consentP2.1. Explain their choices and what each one means; get explicit consent where it is required.
3. P3
   CollectionP3.1–P3.2. Collect only what your stated purposes need; get explicit consent first where that applies.
4. P4
   Use, retention and disposalP4.1–P4.3. Use data only for the stated purposes, keep it only as long as stated, and dispose of it securely.
5. P5
   AccessP5.1–P5.2. Let verified people see and copy their data, correct it, and hear the reason if you refuse.
6. P6
   Disclosure and notificationP6.1–P6.7. Share only with consent, log disclosures and breaches, bind vendors, notify those affected, account for disclosures on request.
7. P7
   QualityP7.1. Keep personal information accurate, current, complete and relevant.
8. P8
   Monitoring and enforcementP8.1. Handle questions, complaints and disputes, monitor compliance and fix what you find.

P6 is the heaviest group, with seven criteria. Vendor commitments (P6.4, P6.5) overlap with vendor risk under CC9.2, so one vendor review process can serve both if it covers privacy terms.

The criteria document is explicit that the Trust Services Criteria are generally not used to report on compliance with laws or regulations. A SOC 2 Privacy opinion says your controls met your stated privacy objectives. It does not say you comply with any law.

• A notice written by one team, a product built by another. The notice describes uses or limits the product never implemented.
• Consent with no record. A checkbox that stores nothing can't be sampled.
• Requests handled in someone's inbox. No log means no population, and no proof of response times.
• Vendors with no privacy terms. P6.4 and P6.5 need commitments in writing, then a check that vendors keep them.
• Choosing Privacy for prestige. Eighteen extra criteria, every year. Choose it when your promises call for it.

• OverviewTrust Services CriteriaThe five categories, with CC1 to CC9 read as questions your controls answer.
• SecurityThe Security category, criterion by criterionCC1 to CC9 in plain words, with the evidence each invites.
• AvailabilityThe Availability categoryA1.1 to A1.3: capacity, protection and tested recovery.
• ConfidentialityThe Confidentiality categoryC1.1 and C1.2: identifying, protecting and disposing of confidential data.
• Processing IntegrityThe Processing Integrity categoryPI1.1 to PI1.5: complete, valid, accurate and timely processing.

Sources: AICPA, TSP section 100, 2017 Trust Services Criteria (revised points of focus), privacy category definition, criteria P1.1 to P8.1 and paragraph .12 on compliance reporting. Examples are illustrative; nothing here is legal advice.