SOC 2 vs GDPR: Which to do first

SOC 2 vs GDPR: which to pursue first when you sell to both US and EU customers

The GDPR is binding law, and SOC 2 is a report a buyer asks for. If you process personal data of EU residents, the GDPR applies to you whether or not any customer requests a report. Article 83 sets maximum administrative fines of EUR 10 million or 2% of worldwide annual turnover for infringements such as those of Articles 25 to 39, and EUR 20 million or 4% for infringements of the core principles, lawful basis, data subject rights and transfer rules, whichever is higher in each case. The regulation requires no audit, attestation or certificate. A SOC 2 is different: a US buyer's security review asks for it, and no regulator enforces it. For most companies in this position, the order is therefore set by legal exposure first and by buyer requests second. Where your platform processes EU personal data on behalf of customers, the Article 28 contract and the security measures it describes come first, because the controller has to be able to rely on you before you sign. Commission Implementing Decision (EU) 2021/915 asks processors to describe their technical and organisational measures, including any relevant certifications, so start by listing what you can evidence today.

Start with the GDPR obligations and the processor paperwork, then scope the SOC 2 to what the buyer needs. Confirm which of your services handle EU personal data, then map the Article 32 security measures and breach notification duties to the controls you already run. A SOC 2 with only the common criteria covers security, while adding privacy adds 18 criteria to design, operate and test, so do not add privacy scope unless a buyer's questionnaire requires it. Ask the US buyer exactly which report and which trust services categories it accepts, since use of a SOC 2 report is generally restricted to the parties named in it. Run both programs in parallel only when you have enough staff to keep the evidence current for each, or when a large EU and US customer base makes the overlapping evidence worth maintaining. Ask any certification body or auditor to confirm in writing what it will and will not test, because an Article 42 certification is voluntary and does not reduce your responsibility for compliance.

How SOC 2 and the GDPR differ on scope, proof and enforcement

This table compares who requires each framework, what proof it produces, who assesses it, what fines apply, how scope is chosen and where each reaches. Read it to see that SOC 2 is a report a buyer asks for, while the GDPR is binding law with no mandatory audit, so the two answer different questions.

Dimension	SOC 2	GDPR
Who requires it	No law requires it. A customer or partner asks for a SOC 2 report as part of its vendor review.	Binding law for controllers and processors that handle personal data within its territorial reach.
Legal status	Voluntary AICPA attestation under AT-C section 205, not a regulation.	Regulation (EU) 2016/679, binding in its entirety and directly applicable in all EU Member States.
Proof produced	A CPA attestation report: Type 1 covers design as of a date, Type 2 adds operating effectiveness over a period.	No mandatory audit, attestation or certificate. Article 42 certification is voluntary and valid for at most three years.
Assessor	A licensed CPA firm acting as service auditor.	Supervisory authorities enforce the law. Accredited certification bodies or supervisory authorities issue Article 42 certificates.
Fines and sanctions	None from SOC 2 itself. Commercial consequences include lost deals or contract terms.	Up to EUR 10 million or 2% of worldwide annual turnover for some infringements, and up to EUR 20 million or 4% for others, whichever is higher (Article 83).
Scope selection	All SOC 2 reports cover the 33 common criteria. Availability, confidentiality, processing integrity and privacy criteria are added only when in scope.	Scope is the whole regulation as it applies to your processing. There is no criteria menu, though the privacy criteria in a SOC 2 do not stand in for it.
Geographic reach	No territorial rule. Reach depends on which customers ask for the report.	Applies across the EU and, under an EEA Joint Committee Decision effective 20 July 2018, in Iceland, Liechtenstein and Norway.
Amendment status	AICPA proposed revisions to baseline attestation standards in February 2026, applying to engagements from 15 June 2029 if adopted.	Text not yet amended as of October 2026. Omnibus IV and Digital Omnibus proposals remain pending; confirm current status on the Legislative Observatory.

What the privacy criteria in a SOC 2 do and do not prove

The privacy category is optional in a SOC 2. Security is covered by the common criteria CC1 to CC9 in every report, but the privacy category adds 18 criteria (P1 to P8) only when management includes it in scope. Even then, a SOC 2 does not test conformity with every GDPR article. Management chooses the controls it describes, the auditor tests those controls against the 2017 Trust Services Criteria, and the points of focus under each criterion are characteristics that help design and evaluate controls, not separate requirements that must each be addressed. A clean report therefore shows that the described privacy controls were designed and, in a Type 2, operated as described. It does not show that the scope chosen by management covers the processing a controller actually performs.

A privacy criterion cannot show a lawful basis for processing under Article 6, the transparency content owed to data subjects, or whether a transfer to a third country relies on a valid mechanism under Chapter V. It also cannot confirm that data subject request handling is accurate in the sense the GDPR requires, because a report samples operating evidence over a period and does not re-perform each request against the law. Regulator-facing duties, including cooperation with supervisory authorities and the notification timelines in Articles 33 and 34, sit outside the examination. Ask your auditor which privacy criteria are in scope and which points of focus were judged not applicable, and ask for that reasoning in writing.

Timing matters as well. A Type 1 report is a point-in-time view of whether privacy controls were suitably designed on a stated date. A Type 2 report adds an opinion on operating effectiveness over a period, which is the only form that speaks to whether request handling and retention controls worked day to day. Before you tell an EU customer that a SOC 2 covers privacy, confirm the report type, the period, and the criteria in scope. Your legal team should then map the GDPR obligations the report leaves open to documented evidence you can produce on request.

Where SOC 2 and GDPR controls overlap in practice

A single control set often serves both a SOC 2 examination and GDPR obligations, but the two frameworks ask different questions. The cards below cover six areas where the same engineering work can be cited for both, and what each framework still leaves for you to show separately.

Access control

SOC 2 common criteria CC6 cover logical access, including how users are provisioned, reviewed and removed. GDPR Article 32 asks for measures that protect personal data against unauthorized access, which the same access reviews can evidence. Check with your auditor which CC6 points of focus your tests will sample, and confirm with counsel whether your access records also satisfy the accountability duties in Article 24.

Security of processing

The GDPR security duty in Article 32 requires controllers and processors to choose measures suited to the risk, and the SOC 2 system description and common criteria describe how those measures operate. A SOC 2 report can support this point, but it does not replace a documented risk assessment for personal data. Confirm with your auditor which in-scope systems hold personal data before relying on one report for both.

Change management

Common criteria CC8 cover change management, including authorization, testing and approval of system changes. For GDPR, the same change records help show that privacy and security were considered when systems that process personal data were modified, which matters for data protection by design under Article 25. Ask your auditor whether change tickets alone will satisfy sampling, or whether you need privacy review evidence too.

Incident handling

SOC 2 common criteria CC7 require detection, response and recovery processes for security events. GDPR Articles 33 and 34 add a separate clock for notifying supervisory authorities and affected individuals of personal data breaches. An incident process that satisfies CC7 may still miss the GDPR notification steps, so check that your runbook names who notifies and within which timeframe for each regulator.

Vendor oversight

SOC 2 criteria in the CC9 series address risk from vendors and business partners, which maps to how you assess subprocessors. Under GDPR Article 28, a controller must be able to rely on a processor's sufficient guarantees, and the EDPB expects the contract to specify how requirements will be met. A subprocessor's SOC 2 report can inform that judgment, but counsel should confirm whether it is enough for your Article 28 files.

Data retention and privacy criteria

Retention and disposal of personal data sit in the privacy category of the 2017 Trust Services Criteria, which adds 18 criteria when you include it in scope. GDPR storage limitation and erasure duties apply to personal data whatever the SOC 2 scope. Including the privacy category is the only way a SOC 2 report tests retention, so decide scope with your auditor and confirm the criterion-to-article links against the NIST Privacy Framework crosswalk with counsel.

How Article 42 certification and Article 28 processor duties differ from a SOC 2

Article 42 certification is a voluntary data protection scheme under the GDPR. Accredited certification bodies or competent supervisory authorities issue it against criteria approved by the authority or the EDPB, and a certificate can last at most three years. It addresses data protection processing, not your whole security program, and it does not reduce the controller's or processor's responsibility for compliance.

Who issues it: Accredited certification bodies or supervisory authorities. EDPB-approved criteria can lead to the European Data Protection Seal.
Duration: At most three years, so renewal is a recurring cost to plan for.
Register: The EDPB register of certification mechanisms, seals and marks lists 17 entries as of October 2026, including seals such as Europrivacy, EuroPriSe and BC 5701:2024, plus national schemes from France, Austria and Germany.
Where it counts: Approved certification can support controller compliance (Article 24(3)), data protection by design (Article 25(3)), a processor's sufficient guarantees (Article 28(5)) and security of processing (Article 32(3)). Adherence is also a factor in setting fines (Article 83(2)(j)).

Confirm that a scheme on the register covers your processing and the services you sell, and check the certification body's accreditation and the certificate's expiry date before citing it in a contract.

Who assesses each framework and what it issues

This table compares who checks each framework, what document or status results, how often it recurs and who can rely on it. Read it as a question of proof: SOC 2 yields a CPA report a buyer requests, while GDPR compliance carries no mandatory check and Article 42 certification is an optional seal. Only the SOC 2 report is something a customer can hold in hand as an attestation.

Framework	Who assesses	What is issued	Cycle	Who can rely on it
SOC 2	CPA service auditor performing an AT-C 205 attestation examination	Type 1 report (design as of a date) or Type 2 report (design and operating effectiveness over a period), plus an optional SOC 3 general use report	Type 1 is a point-in-time report; Type 2 covers an observation period the reader should confirm with the auditor	SOC 2 use is generally restricted to specified parties; SOC 3 can be freely distributed
GDPR	No mandatory assessment; supervisory authorities enforce the Regulation	No audit, attestation or certificate is required; authorities can investigate and impose fines under Article 83	Ongoing obligation with no fixed audit cycle	Supervisory authorities and, through contracts, controllers and processors; no external proof is required by law
Article 42 certification	Accredited certification bodies or the competent supervisory authority, against approved criteria	Voluntary certification, and where EDPB-approved criteria apply, possibly a European Data Protection Seal	Issued for at most three years	Controllers can cite it as an element of compliance, but it does not reduce the controller's or processor's responsibility
EDPB-approved seals	Accredited bodies applying EDPB-approved criteria	Common certification such as the European Data Protection Seal; the EDPB register lists the schemes available	Confirm the validity period and renewal terms of each scheme	Buyers should check the EDPB register to confirm a seal's current status
Audit cost reference	CPA firms for SOC 2; certification bodies for Article 42	Not a certificate; cost varies with scope and firm	The US Justice Department's 89 FR 86116 (October 2024) summarized annual audit costs for CCPA, GDPR and SOC 2 compliance as ranging from $3,000 to $150,000 depending on audit type and firm size	Ask each assessor for a written scope and fee before work starts

Doing both: order of work and evidence you can reuse

This sequence lets one control library and one evidence repository serve a SOC 2 report for US customers and the GDPR duties that controllers and processors owe EU customers, so each audit cycle builds on the last instead of starting over.

Map data flows and processing activities
Engineering, product and the privacy lead list each system that stores or moves personal data, the purpose of each flow, the categories of data subjects and the subprocessors involved. Record which activities you perform as a processor for EU customers and which you perform as a controller for your own purposes, because the answer determines which GDPR duties apply to each flow. The step is done when the inventory is signed off by the data owner and every system in the SOC 2 system description has a matching processing record. Confirm the role split with counsel before relying on it.
Set the TSC categories and criteria in scope
Leadership and the auditor agree which of the five Trust Services Categories the report will cover. Security is always in scope through the common criteria CC1 to CC9. Add privacy only when the commitments you make in customer contracts and public statements match the privacy criteria, since adding categories adds criteria to design, operate and test. Note that privacy criteria in a SOC 2 do not establish GDPR compliance, so the scope decision should follow your actual promises. The step closes with a written scope statement that the auditor accepts.
Map existing controls to GDPR and Article 28 duties
The compliance lead builds a crosswalk from each control in the shared library to the GDPR obligations it supports, such as the security of processing duty in Article 32, records of processing, data subject request handling and breach notification. For processor roles, the same exercise maps the Article 28 terms in each customer data processing agreement to the controls that deliver them. Where a control is only a policy statement, mark it as a gap. The output is one crosswalk that names the owner and the evidence source for each row, which the auditor and customer reviewers can both read.
Close gaps in Article 28 and Article 32 duties
Engineering and legal fix the gaps the crosswalk exposed. Typical items include a processing agreement that restates the GDPR without stating how each requirement will be met, missing subprocessor notice mechanisms, unclear security measures in the contract's technical and organisational measures annex, and encryption or access review controls that exist without logs. EDPB Guidelines 07/2020 expect the agreement to specify the security level required. The step is complete when each gap has a closed ticket, a changed document or a documented risk acceptance signed by an accountable owner.
Run the Type 1 report before the Type 2 window
The auditor first examines the system description and the design of controls as of a single date, which is the SOC 2 Type 1 report. This shows that controls are suitably designed before testing begins over a period. Once the design holds, the organization runs the controls for a defined observation window and the auditor tests operating effectiveness, producing the Type 2 report. Ask the auditor to confirm the observation period and sample approach in writing, because they set the timing of the Type 2 opinion. The output is a Type 1 report and a dated plan for the Type 2 window.
Confirm the attestation standard before fieldwork
The AICPA Auditing Standards Board exposed proposed revisions to its baseline attestation standards in February 2026. If adopted, they would apply to engagements beginning on or after June 15, 2029. Ask the auditor which standard, including AT-C section 205 for the current SOC 2 examination, governs the engagement, and whether the proposal changes representation letters or evidence expectations. Record the answer in the engagement letter. This step is done when the auditor confirms in writing which standard applies to each report period.
Keep one control library and evidence repository
The organization maintains a single control library with one owner per control, linked to the SOC 2 criteria, the GDPR and Article 28 crosswalk rows and any customer questionnaire answers. Evidence such as access reviews, change tickets, backup restores and training records is stored once, tagged to every control it supports, and refreshed on a set schedule that the owner records. Reviewers from the auditor, customers and regulators work from the same repository. The step is done when a sample request from a customer or auditor can be answered from the repository without rebuilding evidence by hand.

What do buyers ask before they fund SOC 2 and GDPR work?

Does the GDPR require a SOC 2 report?

No. The GDPR requires no audit, attestation or certificate. Article 42 certification is voluntary, and a SOC 2 report is not one of the GDPR's mechanisms. A SOC 2 is usually requested by a customer's procurement or security team, which may ask for it as evidence of controls. Whether a buyer asks for one depends on their contract and vendor risk policy, so confirm that requirement in writing before scoping work. Your GDPR duties apply regardless of whether you hold any report.

Does a SOC 2 report prove GDPR compliance?

No. A SOC 2 tests controls against the Trust Services Criteria that you chose in scope, and the privacy category covers privacy commitments you made to users. It does not test whether your lawful basis is valid, whether your records of processing are complete, whether your retention decisions are lawful, or whether a data subject request process meets Article 12 to 22 timelines. A clean report shows that stated controls operated as described over a period. You still need a GDPR gap assessment covering the regulation's own obligations.

What drives the cost of a SOC 2 audit and related GDPR work?

Cost depends on the number of criteria in scope, system complexity, the auditor, and how ready your evidence is. Every SOC 2 covers the 33 common criteria, and adding privacy (18 criteria) or other categories adds design, operating and testing effort. The US Justice Department summarized annual audit costs for CCPA, GDPR and SOC 2 compliance as ranging from $3,000 to $150,000 depending on audit type and firm size (89 FR 86116, October 2024). Ask any quote to separate auditor fees, remediation work, tooling and internal staff time, and to state which items recur each year.

How long does SOC 2 and GDPR readiness take?

No supplied figure fixes a duration, so treat any timeline as a scoping output. Duration depends on how many systems and processors are in scope, whether controls already exist in writing, how many vendor contracts need review, and whether a Type 1 report comes before a Type 2 observation period. A Type 2 report covers operating effectiveness over a period, so the audit window itself sets a minimum. Ask for a written schedule showing each dependency, and confirm with your auditor how the observation period will be measured.

What information does our team need to provide?

Expect to supply a current data map and record of processing activities, privacy and security policies, access review records, a list of processors and subprocessors with their contracts, and incident logs with how each event was handled. For a SOC 2, you also need a written system description and evidence that each control ran during the period. Missing or inconsistent records are the most common source of delay, so assemble and reconcile these before the auditor starts. Ask your advisor which artifacts they will request first.

Can our own team do SOC 2 and GDPR work in-house?

Yes, many teams do the control design and evidence collection internally, but the attestation itself must be performed by an independent CPA firm, so an in-house team cannot issue the SOC 2 report. For GDPR, the controller and processor carry the obligations directly, so internal ownership of the records, policies and processor contracts is expected. Outside help is most useful for gap assessment, system description drafting and implementation of technical controls. DeployOpen prepares systems, controls and evidence for compliance assessments but does not issue audit reports or attestations.

Should we pursue an Article 42 GDPR certification seal?

Consider it only after your core GDPR obligations are documented and tested, because certification does not reduce your responsibility for compliance. Article 42 certification is voluntary, is issued for at most three years by accredited certification bodies or supervisory authorities, and can support your demonstration of compliance under Article 24(3) and a processor's guarantees under Article 28(5). The EDPB register lists 17 entries as of October 2026, so check whether a seal fits your processing and your customers' requirements. Ask a certification body which criteria apply and what evidence it expects.

What to confirm with your auditor, counsel and EU customers

Start by fixing the role each product plays for each customer dataset. A controller decides why and how personal data is processed, while a processor acts on the controller's instructions, and the same company can be a controller for its own marketing data and a processor for a customer's end-user data. Ask counsel to document this per product and per data flow, because the answer decides whether your EU customers will ask for Article 28 terms, processor audit rights or both. Your SOC 2 scope should follow the same map: if the privacy category is in scope, confirm with your auditor which of the 18 privacy criteria your processes actually address, since a SOC 2 does not establish that you meet GDPR obligations on lawful basis, data subject rights or retention.

Confirm three legal and transfer questions with counsel before you sign. First, identify which EU member state supervisory authority is competent for each establishment or customer relationship, since the GDPR is enforced by independent national authorities and the EDPB resolves disputes between them. Second, document the transfer mechanism for every restricted flow to a third country. For transfers to the United States, confirm the current status of the EU-US Data Privacy Framework under Commission Implementing Decision (EU) 2023/1795 with counsel rather than assuming it still applies to your recipients. Third, check the Commission's controller-processor clauses in Decision (EU) 2021/915, which ask you to describe security measures and any relevant certifications in Annex III.

Ask each EU customer in writing whether it will accept a SOC 2 report in place of direct processor audit rights, and what it will accept for the processor's security description, sub-processor notice and breach handling. Treat a "no" as a scoping decision to price in, not a negotiation you can assume away. Before you cite any European Data Protection Seal in a questionnaire, check the EDPB register of certification mechanisms, seals and marks and record the entry, scope and validity date, because the register changes over time. Finally, track the Omnibus IV proposal (procedure 2025/0130(COD)) and the Digital Omnibus proposal (procedure 2025/0360(COD)) on the European Parliament Legislative Observatory and ask counsel to review your contract templates when either one is adopted, since the GDPR text itself was unchanged as of October 2026.

How DeployOpen scopes and supports SOC 2 and GDPR readiness

DeployOpen plans, implements, documents and supports self-hosted open-source platforms inside your own infrastructure, and prepares systems, controls and evidence for compliance assessments. DeployOpen does not issue audit reports or certifications; independent auditors and certification bodies do that work.

How we scope

The written scope states which SOC 2 trust services categories and which GDPR obligations the work covers before any work starts.
Scope names the systems, data flows, processors and hosting locations that the controls and records must cover.
Engagements are fixed-scope, with deliverables and timelines agreed in writing, and a quote follows from that scope.

How we build

Controls are configured in the platforms you run, such as access, logging, backup and change handling, mapped to the criteria or articles in scope.
Security testing of applications, APIs and infrastructure is planned against the systems in scope, with findings tracked to closure.
Processor-facing measures, such as data retention, sub-processor records and breach handling, are built into operating procedures and tooling.

How we hand over

Documentation covers system descriptions, control narratives, configuration baselines and the evidence each control produces.
Evidence packs are organized so your auditor or customer security team can trace each control to its artifact.
Handover includes runbooks and a written list of items you must confirm with your auditor, legal counsel or supervisory authority.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after the initial engagement ends.
Retainers can cover evidence collection between audit periods, so the next SOC 2 or GDPR review starts from current records.
Ask any quote to separate one-time implementation effort from recurring retainer work so you can budget each part.

SOC 2 vs GDPR

SOC 2 vs GDPR: which to pursue first when you sell to both US and EU customers

How SOC 2 and the GDPR differ on scope, proof and enforcement

What the privacy criteria in a SOC 2 do and do not prove

Where SOC 2 and GDPR controls overlap in practice

Access control

Security of processing

Change management

Incident handling

Vendor oversight

Data retention and privacy criteria

How Article 42 certification and Article 28 processor duties differ from a SOC 2

Who assesses each framework and what it issues

Doing both: order of work and evidence you can reuse

Map data flows and processing activities

Set the TSC categories and criteria in scope

Map existing controls to GDPR and Article 28 duties

Close gaps in Article 28 and Article 32 duties

Run the Type 1 report before the Type 2 window

Confirm the attestation standard before fieldwork

Keep one control library and evidence repository