SOC 2 and the law
One SOC 2 report, three privacy laws: a duty-by-duty ledger.
A SOC 2 report answers one question well: were the security controls designed and operating as described? GDPR, the US HIPAA rules and India's Digital Personal Data Protection Act, 2023 (DPDP Act) ask that question and many more. Laying the duties side by side shows exactly where the report earns its keep and where your legal work has to carry the load.
Back to SOC 2 services01 · Your role
Start with the role each law gives you
One company can be a controller in one relationship and a processor in the next.
- GDPR: controller or processor
- The controller chooses the purpose and the means; the processor only acts on the controller's written instructions.
- HIPAA: covered entity or business associate
- Health plans, clearinghouses and most providers that bill electronically are covered entities; a vendor handling protected health information for them is a business associate.
- DPDP Act: Data Fiduciary or Data Processor
- The Data Fiduciary sets purpose and means; a Data Processor acts on its behalf. Most statutory duties rest with the fiduciary.
A typical SaaS vendor is a processor or business associate for the data its customers load, and a controller or fiduciary for its own staff records and marketing lists. Nothing in a SOC 2 report states which role you hold. Your contracts and your data maps do, and every row below depends on that answer.
02 · Duty ledger
The duty ledger
Eight duties, three laws, and one column for what the report can show.
| Duty | GDPR | HIPAA | DPDP Act | Can SOC 2 evidence it? |
|---|---|---|---|---|
| Securing personal data | Article 32 | Security Rule, 45 CFR 164.302 to 164.318 | Section 8(5) | Yes, for controls inside the boundary and period |
| Formal risk assessment | Article 32 risk basis; impact assessments under Article 35 | Risk analysis, 164.308(a)(1) | Periodic impact assessment for Significant Data Fiduciaries, section 10 | Partly: CC3 tests your risk process, not each law's format |
| Breach notification | Articles 33 and 34 | 45 CFR 164.400 to 164.414 | Section 8(6) and the DPDP Rules | Only that an incident process exists and ran |
| Contracts with service providers | Article 28 | Business associate agreements, 164.504(e) | Section 8(2) | Partly: CC9.2 tests supplier management |
| Legal ground for using data | Article 6 | Permitted uses and disclosures under the Privacy Rule | Consent or legitimate uses, sections 6 and 7 | No |
| Individuals' rights | Articles 15 to 22 | Access and amendment, 164.524 and 164.526 | Sections 11 to 14 | Only with the Privacy category, and then against your own notice |
| Named privacy officer | Data protection officer where Article 37 requires one | Privacy official and security official | Data Protection Officer for Significant Data Fiduciaries | No |
| Cross-border transfers | Chapter V | No transfer-specific rule | Section 16 | No |
Read the last column as a ceiling. Even a Yes reaches only the systems and the period the report describes.
03 · Breach clocks
One incident, several deadlines
Illustrative: a leaked support export holding EU, US patient and Indian customer records.
Picture one misconfigured export (illustrative). Your SOC 2 incident-response control shows the team detected and contained it. Who must hear about it next, and how quickly, is set by each law and by your role, and the answers differ.
| Who must be told | Under | By when |
|---|---|---|
| The supervisory authority, by the controller | GDPR Article 33(1) | Within 72 hours of becoming aware where feasible, otherwise with reasons for the delay |
| The controller, by you as processor | GDPR Article 33(2) | Without undue delay |
| The people affected, by the controller | GDPR Article 34 | Without undue delay, when the risk to them is high |
| The covered entity, by you as business associate | 45 CFR 164.410 | Without unreasonable delay, and within 60 days of discovery at the latest |
| Patients, HHS and, for larger breaches, the media, by the covered entity | 45 CFR 164.404 to 164.408 | Patients within the same 60-day outer limit; HHS timing depends on how many people are affected |
| The Board and each affected Data Principal, by the fiduciary | DPDP Act section 8(6) and the DPDP Rules, 2025 | Without delay, followed by a fuller report to the Board within 72 hours |
The report sets no deadline
The Trust Services Criteria ask that security incidents be evaluated, responded to and recovered from (CC7.3 to CC7.5). The timing of any notice comes from your commitments and from the law, never from the criteria.
04 · Privacy category
What adding the Privacy category changes
It tests your promises, not a statute.
The criteria include an optional Privacy category, P1 to P8, spanning notice, choice and consent, collection, use and retention, access, disclosure, data quality, and monitoring. With it in scope, the CPA firm tests whether you kept the privacy commitments you made in your notices and contracts. You may have written those commitments to match GDPR, yet the examination still reaches no conclusion on GDPR.
Confidentiality (C1) is a separate promise. It is about protecting information you have agreed to treat as confidential, personal or not, and disposing of it when its time is up.
05 · Safe wording
Wording that holds up with customers and regulators
Claim the evidence, not the legal outcome.
Holds up
- “Our SOC 2 Type 2 covers the security controls we rely on for GDPR Article 32.”
- “Our incident process is tested in our SOC 2; notice times to you are set in our DPA.”
- “We act as your business associate and sign a BAA; our SOC 2 covers the hosting platform.”
Overclaims
- “SOC 2 certified, so GDPR compliant.”
- “HIPAA certified.” HHS certifies no one.
- “DPDP compliant,” based on an audit that never tested consent or rights.
Sources: AICPA TSP section 100, 2017 Trust Services Criteria with revised points of focus (2022); Regulation (EU) 2016/679 (GDPR), Articles 6, 15 to 22, 28, 32 to 35, 37 and Chapter V; 45 CFR Parts 160 and 164, Subparts C, D and E; Digital Personal Data Protection Act, 2023, sections 6 to 16; Digital Personal Data Protection Rules, 2025.
Privacy law and your SOC 2
A customer's DPA asks for appropriate technical and organisational measures. Will our report do?
It is strong evidence for that clause, not for the rest of the DPA.
The security clause is where a SOC 2 helps most: it shows an independent firm tested your access, change, monitoring and incident controls. The same DPA usually covers instructions, subprocessors, deletion, audits and transfers, and each of those needs its own answer.
Will HHS accept a SOC 2 during an investigation?
It can support your case; it does not replace a HIPAA risk analysis.
HHS expects an accurate and thorough risk analysis of electronic protected health information and safeguards that follow from it. A SOC 2 shows controls operated, but it is not organised around that data or the Security Rule's specifications, so keep your own HIPAA risk analysis alongside it.
Does the DPDP Act require any audit?
Only for fiduciaries notified as significant.
A Significant Data Fiduciary under section 10 also has to bring in an outside data auditor and run impact assessments on a cycle. The auditor's question is whether the company obeys the Act, which a SOC 2 never tests, although the security controls inside a SOC 2 are useful input for it.
Should we add the Privacy category to show GDPR readiness?
Only if you want your own privacy promises tested.
The category tests whatever your notices commit you to. It can be useful when customers ask for independent evidence of privacy practice, but it adds scope and evidence, and it still does not produce a finding on GDPR.
Map one control set to every obligation.
We map your SOC 2 controls to GDPR, HIPAA and DPDP, and show the gaps only the law can fill.