SOC 2 and GDPR: Managing Both for Global SaaS Companies
SOC 2 and GDPR answer different questions for a global SaaS company: independent assurance about a described system and legal obligations for personal-data processing. Reuse relevant security evidence while checking privacy responsibilities separately. Identify roles, processing purposes, contracts, rights handling, and transfers before claiming that an assurance report establishes GDPR compliance.
Key Takeaways
- •We consistently advise clients that a unified compliance program is significantly more efficient than maintaining parallel SOC 2 and GDPR programs
- •SOC 2 provides strong evidence for GDPR Article 32 (security of processing) — a Type II report demonstrates ongoing effectiveness of technical and organizational measures
- •GDPR goes beyond SOC 2 in data subject rights, lawful basis documentation, DPIAs, records of processing, data transfer mechanisms, and DPO requirements
- •We recommend including Security, Confidentiality, and Privacy criteria for the strongest GDPR alignment in your SOC 2 report
- •SOC 2 reports can serve as evidence of supplementary measures for Standard Contractual Clauses following Schrems II
For the next operating decision, compare data processing agreement definition with data protection impact assessment definition. Confirm the work included, the evidence you need, and who will own implementation before committing to a provider.
What are the fundamental differences?
Framework Comparison
| Dimension | SOC 2 | GDPR |
|---|---|---|
| Type | Voluntary attestation framework | EU regulation (legally binding) |
| Governing body | AICPA | European Commission; enforced by EU/EEA data protection authorities |
| Geographic scope | Primarily US; growing international recognition | EU/EEA; applies globally to any organization processing EU personal data |
| Who it applies to | Service organizations that choose to undergo the attestation | Any organization processing personal data of EU/EEA residents |
| Assessment method | CPA firm attestation engagement | Self-assessment, data protection impact assessments, supervisory authority audits |
| Output | SOC 2 report with auditor opinion | No standard report; compliance demonstrated through documentation, DPIAs, records of processing |
| Focus | Security controls for service organizations | Data protection rights of individuals |
| Control framework | Trust Service Criteria (CC1-CC9 + optional criteria) | Articles 5, 6, 12-22, 24-39 (principles, rights, obligations) |
The Key Philosophical Difference
SOC 2 evaluates whether an organization's controls are suitably designed and operating effectively to protect data and systems. GDPR evaluates whether an organization processes personal data lawfully, fairly, and transparently — with specific rights granted to data subjects. What we always explain to clients is that SOC 2 is controls-focused while GDPR is rights-focused.
A SOC 2 program without GDPR alignment may have excellent security controls but lack the data subject rights mechanisms, lawful basis documentation, and data processing transparency that GDPR requires.
Where SOC 2 and GDPR Overlap?
Control Overlap Map
| Control Domain | SOC 2 Requirement | GDPR Requirement | Overlap Level |
|---|---|---|---|
| Access management | CC6 — logical access controls, authentication, authorization, deprovisioning | Article 32 — security of processing; appropriate technical measures | High |
| Encryption | CC6 — data protection at rest and in transit | Article 32 — pseudonymization and encryption of personal data | High |
| Risk assessment | CC3 — formal risk assessment and management | Article 35 — data protection impact assessment (DPIA); Article 32 — risk-appropriate security | High |
| Incident response | CC7 — incident detection, response, communication | Depends on scope and readiness | High |
| Monitoring and logging | CC7 — security event logging and monitoring | Article 32 — ability to detect, respond to, and recover from incidents | Medium-High |
| Change management | CC8 — change authorization, testing, deployment | Article 32 — process for regularly testing effectiveness of technical measures | Medium |
| Vendor management | CC9 — vendor risk assessment and contractual requirements | Articles 28-29 — data processor agreements; sub-processor requirements | High |
| Employee training | CC1 — security awareness and training | Article 39(1)(b) — DPO responsibilities include awareness-raising and training | Medium |
| Data classification | CC6, C1 — data handling and confidentiality | Article 5(1)(c) — data minimization; processing only what is necessary | Medium |
| Business continuity | CC9, A1 — business continuity and disaster recovery | Article 32(1)(c) — ability to restore availability and access to personal data in a timely manner | Medium |
Some security evidence may be relevant to both programs, but GDPR obligations require their own applicability and processing assessment. No fixed overlap percentage is established here. The remaining GDPR requirements are specific to data subject rights, lawful basis for processing, and data protection governance — areas that SOC 2 does not directly address.
SOC 2 Privacy Criterion and GDPR
Including the SOC 2 Privacy criterion significantly increases overlap with GDPR:
| Privacy Criterion Area | GDPR Alignment |
|---|---|
| Notice | Article 13-14 — information provided to data subjects about processing |
| Choice and consent | Article 6 — lawful basis for processing; Article 7 — conditions for consent |
| Collection limitation | Article 5(1)(b) — purpose limitation; Article 5(1)(c) — data minimization |
| Use, retention, and disposal | Article 5(1)(e) — storage limitation; Article 17 — right to erasure |
| Access | Article 15 — right of access by the data subject |
| Disclosure to third parties | Articles 28-29 — data processor agreements; Article 44-49 — international transfers |
| Quality | Article 5(1)(d) — accuracy of personal data |
| Monitoring and enforcement | Article 24 — responsibility of the controller; Article 32 — security of processing |
Including the SOC 2 Privacy criterion does not establish GDPR compliance. Map the actual processing, legal obligations, controls, and evidence; do not infer legal coverage from the report’s criterion selection.
Where GDPR Goes Beyond SOC 2?
GDPR-Specific Requirements
| GDPR Requirement | Description | Not Covered by SOC 2 |
|---|---|---|
| Lawful basis for processing | Article 6 — every processing activity requires a documented lawful basis (consent, contract, legitimate interest, etc.) | SOC 2 does not require documenting lawful basis for data processing |
| Data subject rights | Articles 15-22 — right to access, rectification, erasure, restriction, portability, objection, automated decision-making | SOC 2 Privacy criterion covers some rights but not the full GDPR scope |
| Data Protection Officer | Articles 37-39 — mandatory DPO appointment in certain circumstances | SOC 2 does not require a DPO |
| Data Protection Impact Assessment | Article 35 — DPIA required for high-risk processing activities | SOC 2 requires risk assessment but not processing-specific DPIAs |
| Records of processing activities | Article 30 — documented records of all processing activities | SOC 2 does not require processing activity records |
| International data transfers | Articles 44-49 — legal mechanisms for transferring personal data outside the EU (SCCs, adequacy decisions, BCRs) | SOC 2 does not address cross-border data transfer mechanisms |
| Data protection by design and default | Article 25 — privacy built into system design; default settings protect privacy | SOC 2 does not explicitly require privacy by design |
| Consent management | Article 7 — specific conditions for valid consent | SOC 2 Privacy criterion references consent but does not prescribe GDPR-specific consent requirements |
| Breach notification to supervisory authority | Depends on scope and readiness | SOC 2 requires incident response but not specific regulatory notification timelines |
How do you build a Unified Compliance Program?
Implementation Strategy
| Layer | What It Contains | Purpose |
|-------|-----------------|---------|
| Foundation (SOC 2) | Security controls, access management, change management, monitoring, incident response, risk assessment, vendor management, policies | Addresses SOC 2 Trust Service Criteria and the technical/organizational measures of GDPR Article 32 |
| Extended controls (SOC 2 Privacy) | Notice, consent, data collection limitation, data lifecycle management, data subject access mechanisms | Addresses SOC 2 Privacy criterion and extends coverage into GDPR data protection principles |
| GDPR-specific layer | Lawful basis documentation, DPIA process, records of processing, data transfer mechanisms, DPO appointment, consent management | Addresses GDPR requirements not covered by SOC 2 |
Implementation Priority
| Priority | Activity | SOC 2 Benefit | GDPR Benefit |
|---|---|---|---|
| 1 | Implement access management controls | CC6 compliance | Article 32 security measures |
| 2 | Enable encryption at rest and in transit | CC6 compliance | Article 32 pseudonymization and encryption |
| 3 | Conduct risk assessment | CC3 compliance | Article 32 risk-appropriate measures; foundation for DPIAs |
| 4 | Implement incident response with 72-hour capability | CC7 compliance | Articles 33-34 breach notification |
| 5 | Build vendor management program with DPA templates | CC9 compliance | Articles 28-29 processor agreements |
| 6 | Document data processing activities | SOC 2 system description | Article 30 records of processing |
| 7 | Implement data subject rights mechanisms | SOC 2 Privacy criterion | Articles 15-22 data subject rights |
| 8 | Establish data transfer mechanisms | SOC 2 scope documentation | Articles 44-49 international transfers |
| 9 | Appoint DPO (if required) | Not directly required | Articles 37-39 DPO appointment |
| 10 | Conduct DPIAs for high-risk processing | SOC 2 risk assessment supports | Article 35 DPIA requirement |
Data Processing Agreements and SOC 2
For SaaS companies processing EU personal data on behalf of customers, Data Processing Agreements (DPAs) are required under GDPR Article 28. Your SOC 2 report can serve as evidence within the DPA relationship:
| DPA Requirement | How SOC 2 Supports It |
|---|---|
| Technical and organizational measures (Article 32) | SOC 2 report provides independent verification of security controls |
| Sub-processor management | SOC 2 vendor management controls (CC9) demonstrate sub-processor oversight |
| Audit rights | SOC 2 report satisfies many customers' audit requirements under the DPA |
| Breach notification | SOC 2 incident response controls (CC7) demonstrate notification capability |
| Data deletion upon contract end | SOC 2 controls can include data retention and deletion procedures |
Using SOC 2 as GDPR Evidence
Article 32: Security of Processing
GDPR Article 32 requires organizations to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. A SOC 2 Type II report with an unqualified opinion provides strong evidence of Article 32 compliance for the security controls within its scope.
| Article 32 Requirement | SOC 2 Evidence |
|---|---|
| Pseudonymization and encryption | CC6 controls demonstrating encryption at rest and in transit |
| Confidentiality, integrity, availability | Trust Service Criteria coverage across Security, Availability, and Confidentiality |
| Ability to restore availability | Business continuity and DR controls (CC9, A1) |
| Regular testing of security measures | SOC 2 Type II demonstrates ongoing control effectiveness over the observation period |
How European Customers Use SOC 2 Reports
European customers increasingly accept SOC 2 reports as evidence of technical measures, but with specific expectations:
| European Buyer Expectation | How to Address |
|---|---|
| SOC 2 should include Privacy or Confidentiality criterion | Include at least one data protection-relevant criterion beyond Security |
| Report should reference GDPR-relevant controls | System description should mention EU data handling where applicable |
| Data transfer mechanisms should be documented | Include data residency and transfer mechanism documentation alongside the SOC 2 report |
| DPA should reference the SOC 2 report | Include the SOC 2 report as an exhibit or reference in your Data Processing Agreement |
International Data Transfers
Data Transfer Mechanisms
For SaaS companies transferring EU personal data to the US or other non-adequate countries:
| Mechanism | When to Use | SOC 2 Relevance |
|---|---|---|
| Standard Contractual Clauses (SCCs) | Most common mechanism for EU-US data transfers | SOC 2 provides evidence of the supplemental measures required alongside SCCs |
| EU-US Data Privacy Framework | Available for certified US companies | Certification is separate from SOC 2; both demonstrate data protection commitment |
| Binding Corporate Rules (BCRs) | Intra-group transfers within multinational companies | Primarily enterprise mechanism; SOC 2 supports the security measures component |
| Adequacy decisions | Transfers to countries with EU-recognized adequate protection | No additional mechanism needed for adequate countries |
SOC 2 as Supplementary Measures for SCCs
Following the Schrems II decision, organizations using SCCs for EU-US data transfers must implement supplementary measures to ensure an adequate level of data protection. What we advise our clients is that a SOC 2 report with appropriate criteria (Security + Confidentiality or Privacy) serves as strong evidence of supplementary technical measures:
| Supplementary Measure Category | SOC 2 Evidence |
|---|---|
| Encryption of data in transit and at rest | CC6 encryption controls |
| Access controls limiting who can access personal data | CC6 access management controls |
| Monitoring and logging of data access | CC7 monitoring controls |
| Incident detection and response | CC7 incident response controls |
Trust Service Criteria Selection for Global Companies
Recommended Criteria for GDPR Alignment
| Criterion | GDPR Alignment Value | Recommendation |
|---|---|---|
| Security | Addresses Article 32 technical measures | Required (mandatory for all SOC 2) |
| Confidentiality | Addresses data protection and access restrictions | Strongly recommended — demonstrates data confidentiality commitment |
| Privacy | Addresses data lifecycle management aligned with GDPR principles | Strongly recommended — maximizes GDPR overlap |
| Availability | Addresses Article 32 availability and resilience requirements | Recommended |
| Processing Integrity | Addresses data accuracy (Article 5(1)(d)) | Situational |
We recommend including Security, Confidentiality, and Privacy for the strongest SOC 2 foundation for GDPR compliance. This combination addresses the technical measures, data protection, and data lifecycle management requirements that overlap between the two frameworks.
AICPA & CIMA’s SOC overview describes CPA assurance services. It defines the assurance context; it does not establish vendor rankings, market prices, or a particular company’s readiness.
Frequently Asked Questions
How much of GDPR does a SOC 2 program already cover?
Can a SOC 2 report be used as GDPR evidence?
Where does GDPR go beyond SOC 2?
Tyler Carbone
Managing Director and Cofounder
Tyler Carbone is a Managing Director and Cofounder of Agency and one of the industry's leading voices on governance, risk, and compliance. He holds degrees from Harvard and a JD/MBA from the University of Virginia, and previously worked in cybersecurity at Deloitte. Tyler has helped hundreds of companies operate SOC 2, ISO 27001, HIPAA, and GDPR programs.
LinkedIn
