SOC 2 vs GDPR: What's Different and What Overlaps

Overview

A common question from fast-growing SaaS companies: "We have a US enterprise customer asking for SOC 2 and a German customer asking about GDPR. Are these the same thing?" They are not — but they are not independent either. Building one creates a strong foundation for the other.

GDPR Basics

The General Data Protection Regulation (GDPR) came into effect on 25 May 2018 and applies to any organisation that processes personal data of EU/EEA residents, regardless of where the organisation is located. Processing includes collecting, storing, analysing, sharing, or deleting personal data.

GDPR requires lawful basis for processing, data subject rights (access, rectification, erasure, portability), privacy by design, data protection impact assessments for high-risk processing, and mandatory breach notification to supervisory authorities within 72 hours.

Penalties reach €20 million or 4 % of global annual turnover — whichever is higher. Enforcement is by national Data Protection Authorities (DPAs). The CNIL (France), ICO (UK, post-Brexit), and German state DPAs have issued the largest fines.

SOC 2 and Privacy

SOC 2's Privacy criterion (an optional Trust Services Criterion) addresses the organisation's practices for collecting, using, retaining, disclosing, and disposing of personal information. It is based on AICPA's Generally Accepted Privacy Principles (GAPP).

Including Privacy in your SOC 2 scope requires your auditor to test controls related to consent, notice, collection limitation, data quality, and rights of individuals. This overlaps with several GDPR principles (lawfulness, purpose limitation, data minimisation, accuracy, storage limitation).

Critically: a SOC 2 report with Privacy criterion does not certify GDPR compliance. GDPR has specific legal requirements (lawful basis, DPA registration in some cases, SCCs for data transfers) that are outside SOC 2's scope.

Key Differences

Legal nature: GDPR is law. SOC 2 is an industry standard. Violating GDPR can result in government fines and regulatory investigation. Not having SOC 2 results in lost commercial deals.

Geographic scope: GDPR applies to processing of EU residents' data regardless of where your company is based. SOC 2 is designed for US service organisations but is used globally.

Individual rights: GDPR gives individuals extensive rights (right to erasure, portability, restriction of processing, objection) with deadlines and enforcement mechanisms. SOC 2 Privacy criterion tests whether you have procedures for handling such requests but does not mandate specific response timelines.

What Overlaps

Data breach response: SOC 2 CC7.3–CC7.5 requires incident detection and notification procedures. GDPR requires breach notification to supervisory authorities within 72 hours and to affected individuals without undue delay. Building SOC 2 incident response covers the technical detection and response process; GDPR adds the legal notification obligations.

Access controls and data security: SOC 2 CC6 (logical and physical access) directly supports GDPR Article 32 (security of processing). Encrypting personal data, implementing access controls, and monitoring for unauthorised access satisfies both frameworks.

Vendor management: SOC 2 CC9.2 (vendor risk management) and GDPR Article 28 (data processor agreements) both require you to assess and document third-party data processors. Building a vendor security review process satisfies both.

Indian Companies Selling to the EU

Indian companies processing EU personal data must comply with GDPR. The EU does not currently have an adequacy decision for India (India is not on the approved transfer list), so cross-border data transfers must rely on Standard Contractual Clauses (SCCs) or Binding Corporate Rules.

The DPDP Act 2023 has some areas of alignment with GDPR principles, but GDPR compliance requires specific legal mechanisms (SCCs, ROPA maintenance, DPA appointment) that DPDP compliance does not automatically satisfy.

ISO 27701 (Privacy Information Management System) is often paired with ISO 27001 for EU customers as evidence of privacy governance. This can complement your SOC 2 programme for comprehensive coverage of US and EU requirements.

Running Both Programmes

The practical path for a global SaaS company: get SOC 2 Type II first for US enterprise deals, then layer GDPR-specific requirements (SCCs, privacy policy updates, ROPA, DPA template) for EU customers. The security controls built for SOC 2 support GDPR Article 32 requirements.

Use your SOC 2 report as evidence of technical security measures when EU customers ask about GDPR compliance. Include it alongside your data processing agreement and SCCs in your EU data protection documentation package.