Generally accepted privacy principles are a set of criteria for how an organization collects, uses, keeps, and discloses personal information. Each principle states a duty, such as notice, choice, access, or security, and an examination can test whether the organization meets it.
Those criteria have been used in a Service Organization Control (SOC) engagement when the report covers privacy. The principles are the yardstick. The control report is the examiner’s opinion against that yardstick.
What a Principle Requires
- Notice. People are told what is collected and why.
- Choice and access. People can decide about certain uses and can see the information held about them.
- Security and retention. The information is protected, and it is kept only as long as the stated purpose requires.
Privacy Criteria and a Control Report
| Compared | Privacy Criteria | Control Report |
| What it is | The duties the organization is measured against | An examiner’s opinion on one organization |
| Who writes it | The profession, as a standing set of principles | The firm that performed the examination |
| How long it lasts | Until the principles are revised | For the period the report covers |