SOC 2 Confidentiality criteria (C1.1–C1.2)

By Sam Rivera, Founder, SentinelPanda · August 10, 2026 · 2 min read · SOC 2

Two criteria, and one persistent confusion: Confidentiality is about information someone agreed to keep secret. Privacy is about personal information. They are not the same category.

Confidentiality is not Privacy

This distinction decides which category you need, so it is worth being precise. Confidentiality covers information designated as confidential — by customer contract, NDA, or your own data classification. Source code, unreleased financials, customer datasets under an agreement, security findings. It says nothing about whether that data describes a person.

Privacy covers personal information specifically, and brings obligations around notice, consent, access, and disclosure that have no Confidentiality equivalent.

Plenty of organisations need Confidentiality and do not need Privacy: you hold customer data under contract, but your customer is the controller who owes the individuals notice and choice, not you.

The two criteria

C1.1 — you identify and maintain confidential information to meet your confidentiality objectives. In practice: a data classification scheme that is actually applied, so you can say which data is confidential and where it lives, plus the protections applied to it.
C1.2 — you dispose of confidential information when it is no longer needed. Retention periods that are defined and enforced, with evidence of deletion.

Why C1.2 is the one that bites

Identifying confidential data is a documentation exercise most teams can complete. Disposing of it is an engineering one, and it is where the evidence gap usually appears.

The recurring finding: a retention policy stating customer data is deleted 30 days after termination, and no mechanism that does it. Data sits in the primary database, in backups, in a data warehouse, in support tickets, and in a decommissioned S3 bucket nobody owns. An auditor asks for evidence of a deletion that actually occurred, and there is none.

Backups are the specific trap. If your retention commitment is 30 days but your backups are kept for a year, deleted data persists for a year. Either the commitment or the backup schedule has to change, and the honest answer is usually to describe the backup window explicitly rather than promise a deletion you cannot perform.

Should you include it

Usually yes, if customers send you data they would describe as sensitive and your agreements use the word "confidential" — which covers most B2B SaaS. Two criteria is a small addition on top of Security, and much of the underlying work (classification, retention, encryption, access control) already exists for the Common Criteria.

The one caution: adding Confidentiality means committing to disposal you can evidence. Do not add it the same month you discover your deletion pipeline does not exist.

Data classification Data retention policy SOC 2 Privacy criteria (P1–P8)