# SOC 2 P1.1 — Privacy Notice to Data Subjects

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_soc2_p11_2cef263c0e-soc-2-p11-privacy-notice-to-data-subjects
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [SOC2 Readiness](https://support.icompaas.com/support/solutions/62000111733) › [Privacy](https://support.icompaas.com/support/solutions/folders/f_gen_62000111733_privacy)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

SOC 2 · Control P1.1 · Priority: high · Component: Privacy

### What this control covers

The entity provides notice to data subjects about its privacy practices to meet the entity's objectives related to privacy. The notice is updated and communicated to data subjects in a timely manner for changes to the entity's privacy practices, including changes in the use of personal information, to meet the entity's objectives related to privacy.

### Why it matters

Encryption and key management make data unreadable to attackers and unintelligible under data-breach safe-harbour clauses — a meaningful regulatory benefit.

### How to implement

#### AWS

Default to **SSE-KMS** with customer-managed keys for S3/EBS/RDS/Secrets Manager. Use **S3 Bucket Keys** and **S3 Block Public Access** at the account level, and turn on **S3 Object Lock** on backup buckets for ransomware resilience.

#### Azure

Store secrets in **Key Vault** (HSM-backed where required) with soft-delete + purge protection; use **customer-managed keys** for Storage, SQL, and Azure Disk Encryption. Tag PII data via **Microsoft Purview**.

#### GCP

Use **Cloud KMS** with customer-managed encryption keys (CMEK) for BigQuery, GCS, and Compute. **Sensitive Data Protection** (DLP API) inspects/de-identifies PII at scale.

#### Google Workspace

Enable **client-side encryption** for Drive/Docs and turn on **Drive Labels + DLP** rules to prevent external sharing of regulated data classes.

#### On-premises

Operate a **Records of Processing Activity (RoPA)** and a **data-subject-request (DSR) workflow** with named owners, SLA per regulation (GDPR 30 days, DPDP 30 days, CCPA 45 days). iCompaas users can track requests + evidence inside the Privacy module.

### Evidence to collect

-   `policy_document` — A signed, version-controlled policy stating leadership intent and the named owner.

Signed policy or standard documents the safeguard. Focus: Privacy Notice to Data Subjects.

### Quick checklist

-   Information — Objectives / Protection
-   Management — Objectives / Protection
-   Privacy — Objectives / Protection
-   Personal — Objectives / Protection
-   Data — Objectives / Protection

### Related articles on this site

-   [Data Privacy Regulations](https://support.icompaas.com/support/solutions/articles/62000225138-data-privacy-regulations)
-   [NIST 800-171 3.14.1 Identify, report, and correct system flaws in a timely manner.](https://support.icompaas.com/support/solutions/articles/62000229241-nist-800-171-3-14-1-identify-report-and-correct-system-flaws-in-a-timely-manner-)
-   [CMMC 2.0 SI.1.210 Identify, report, and correct information and information system flaws in a timely manner.](https://support.icompaas.com/support/solutions/articles/62000229437-cmmc-2-0-si-1-210-identify-report-and-correct-information-and-information-system-flaws-in-a-timely-)
-   [Ensure that encryption at rest is enabled for Amazon Athena query results stored in Amazon S3 in order to secure data and meet compliance requirements for data-at-rest encryption.](https://support.icompaas.com/support/solutions/articles/62000233406-ensure-that-encryption-at-rest-is-enabled-for-amazon-athena-query-results-stored-in-amazon-s3-in-orde)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): The full SOC 2 implementation guide: scoping the Trust Services Criteria, the roadmap to a Type 2 report, and what the auditor samples.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): Teams that finish SOC 2 usually add ISO 27001 next; the control overlap is large and the guide explains what is genuinely extra.