SOC 2 P6.1: Privacy - Disclosure to Third Parties

Build and maintain an inventory of every third-party data sharing arrangement. For each one, record the third party's identity, what categories of personal data you share, why you share it, the legal basis (consent, privacy notice, contractual necessity), how often and by what method data moves, and what contractual protections are in place.

Compare your inventory against your privacy notice line by line. Any sharing arrangement not reflected in the notice needs to either be added to the notice or stopped. Make sure the notice describes categories of third parties and the purposes for sharing in plain language.

Put data processing agreements (DPAs) or equivalent contracts in place with every third party receiving personal information. These should specify the purpose and scope of data use, prohibit use beyond the stated purpose, require appropriate security measures, include breach notification obligations, address data subject rights, and define data return or destruction when the relationship ends.

Minimise what you share. Only send the personal data elements the third party actually needs. Use anonymisation, pseudonymisation, or aggregation wherever the recipient does not need individual-level data. Set up technical controls to restrict what third-party integrations can access.

Log all data transfers to third parties - what was shared, when, and how. Review these logs periodically to catch any drift from the stated purpose or contract terms. Deal with unauthorised or excessive sharing immediately.

Before sharing personal data with any new third party, run a privacy and security assessment, confirm the arrangement is covered by notice or consent, execute the right contracts, and document the approval.