# Disclosure record

URL: /systems/trust-and-governance/controls/disclosure-record · Id: `control:disclosure-record`

> Every disclosure of personal data to a third party is an Event that cites its Agreement and Purpose.

Every disclosure of personal data to a third party is an [Event](/business/nouns/event) that cites its [Agreement](/business/nouns/agreement) and [Purpose](/business/nouns/purpose).

## Satisfies
| Criterion | Text |
| --- | --- |
| [SOC2 P6.1](/systems/trust-and-governance/criteria/soc2/p6-1) | The entity discloses personal information to third parties only with the data subject’s consent. |
| [SOC2 P6.2](/systems/trust-and-governance/criteria/soc2/p6-2) | The entity keeps a complete, accurate and timely record of authorized disclosures of personal information. |
| [SOC2 P6.7](/systems/trust-and-governance/criteria/soc2/p6-7) | The entity gives data subjects, on request, an accounting of the personal information it holds and its disclosures. |

## Implemented by
- [Privacy](/workflows/processes/privacy)
- [Contracting](/workflows/processes/contracting)
- [Privacy](/systems/privacy)
- [Audit log](/systems/trust-and-governance/audit-log)

## Test
| Step | Rule |
| --- | --- |
| Kind | Detective: it finds the failure after it happens. |
| Select | Every outbound transfer of a personal field in the report period. |
| Assert | Each has a disclosure Event naming the recipient, its Agreement and a Purpose the Person was told of. |

## Owner
[Privacy Officer](/agents/legal/privacy-officer), [Legal Team](/agents/legal).

## Example
A recruiting [SaaS](/products/templates/saas) sends a candidate's résumé to a background-check provider. The disclosure Event names the provider, the screening Agreement and the screening Purpose the candidate was told of.