Menu
Does SOC 2 cover GDPR?
Short answer
No, SOC 2 does not cover GDPR, though the two frameworks overlap on security controls. SOC 2 is a voluntary attestation focused on how your organization protects data in its systems. GDPR is an EU law focused on individual rights over personal data, and it applies to any company processing EU residents' data regardless of where you are located. A mature SOC 2 program addresses roughly 50 to 60 percent of GDPR's technical and organizational measures, and adding the SOC 2 Privacy criterion raises that to about 70 to 75 percent. The remaining GDPR requirements, covering legal basis for processing, data subject rights (access, deletion, portability), Data Protection Impact Assessments, and potentially a Data Protection Officer, are not addressed by SOC 2 at all.
One of 8 SOC 2 buyer guides we maintain.
What people get wrong
Many US SaaS companies assume passing a SOC 2 audit satisfies their GDPR obligations for EU customers; SOC 2 supports GDPR compliance as a foundation but never replaces the GDPR-specific legal and governance work.
Where the overlap is real
SOC 2’s Common Criteria address access management, encryption, change management, vendor risk, and incident response. Those map directly to GDPR Article 32 (security of processing) and the Article 28 sub-processor requirements. A clean SOC 2 Type 2 is solid evidence that you meet the security half of GDPR.
Where SOC 2 is silent
GDPR is a legal framework, not a security framework. The pieces SOC 2 does not touch:
- Legal basis for processing (Article 6): consent, contract, legitimate interest, etc.
- Data subject rights (Articles 15–22): access, rectification, deletion, portability, objection
- Privacy notices and transparency (Articles 13–14)
- Records of processing activities (Article 30)
- Data Protection Impact Assessments (Article 35)
- Data Protection Officer (Article 37) where required
- International data transfer mechanisms (Chapter V): SCCs, adequacy decisions
- Breach notification timelines (Article 33): 72 hours to your supervisory authority
None of these are SOC 2 controls. They are legal and governance obligations that need their own program.
What adding SOC 2 Privacy criterion buys you
The Privacy criterion (an optional fifth Trust Services Category) covers notice, choice, collection, use, retention, disposal, and access. It moves the technical-control overlap with GDPR up to roughly 70–75 percent, but it still does not address legal basis, DSR procedures, DPIAs, or international transfer mechanisms.
A practical sequence for SaaS selling into the EU
Run SOC 2 Type 2 (Security plus Privacy if budget allows) as the security backbone. Layer a separate GDPR program on top: data mapping, lawful basis documentation, DSR workflow, sub-processor list with SCCs, breach notification runbook. The two efforts share evidence and tools but produce different deliverables. EU enterprise procurement teams will often ask for both: the SOC 2 report plus a GDPR readiness questionnaire response.
Sources
Last verified 2026-05-13. Stale or wrong source? Email hello@soc2auditors.org.