Disclosure record
Every disclosure of personal data to a third party is an Event that cites its Agreement and Purpose.
Satisfies
| Criterion | Text |
|---|---|
| SOC2 P6.1 | The entity discloses personal information to third parties only with the data subject’s consent. |
| SOC2 P6.2 | The entity keeps a complete, accurate and timely record of authorized disclosures of personal information. |
| SOC2 P6.7 | The entity gives data subjects, on request, an accounting of the personal information it holds and its disclosures. |
Implemented by
Test
| Step | Rule |
|---|---|
| Kind | Detective: it finds the failure after it happens. |
| Select | Every outbound transfer of a personal field in the report period. |
| Assert | Each has a disclosure Event naming the recipient, its Agreement and a Purpose the Person was told of. |
Owner
Example
A recruiting SaaS sends a candidate's résumé to a background-check provider. The disclosure Event names the provider, the screening Agreement and the screening Purpose the candidate was told of.