Study guide
17.2 Privacy, Confidentiality, and Compliance Frameworks
Uniform CPA Examination Exam
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: CPA Exam Structure and Licensure Rules
1.1 CPA Evolution Model 1.2 Eligibility, Credit Window, and Scheduling Rules 1.3 Scoring, Pass Rates, and Blueprints
2 Chapter 2: CPA Scoring, Interface, and Exam Strategy
Score Scale and Testlets MCQ/TBS Weighting by Section Sample Test Interface Tools Exam-Day Time Management
3 Chapter 3: AUD Ethics, Independence, and Engagement Acceptance
3.1 Professional Responsibilities and Independence 3.2 Engagement Acceptance and Continuance 3.3 Audit Documentation and Quality Management 3.4 Audit Risk Foundations
4 Chapter 4: AUD Risk Assessment, Controls, and Evidence
4.1 Assertions and Risk Assessment 4.2 Internal Control Design and Operating Effectiveness 4.3 Substantive Procedures and Audit Evidence 4.4 Sampling, Analytics, and Estimates
5 Chapter 21: AUD Sampling, Analytics, and Accounting Estimates
21.1 Audit Sampling Risk and Sample Design 21.2 Substantive Analytical Procedures 21.3 Estimates, Fair Value, and Specialists 21.4 Data Analytics, Exceptions, and Follow-Up
6 Chapter 22: AUD Integrated Audits, IT Controls, and SOC Reliance
22.1 ICFR Integrated Audit Framework 22.2 IT General Controls and Application Controls 22.3 Service Organizations, SOC Reports, and CUECs 22.4 Control Deficiencies and Material Weaknesses
7 Chapter 5: AUD Reporting, Attestation, and Review Engagements
5.1 Audit Opinions and Modifications 5.2 Emphasis, Other Matter, and Going Concern 5.3 Review, Compilation, and Preparation Engagements 5.4 Attestation and Government Auditing Signals
8 Chapter 36: AUD Workbook - From Risk to Report
36.1 Risk-Assertion-Procedure Drill 36.2 Evidence Reliability Drill 36.3 Control Deficiency Classification Drill 36.4 Report Modification Decision Drill
9 Chapter 6: FAR Financial Statements and Reporting Framework
6.1 Conceptual Framework and Standard Setting 6.2 Financial Statement Presentation 6.3 Cash Flow Statement and Disclosures 6.4 Not-for-Profit Reporting Basics
10 Chapter 7: FAR Balance Sheet Accounts and Rollforwards
7.1 Cash, Receivables, and Reconciliations 7.2 Inventory and Cost Flow Errors 7.3 Property, Equipment, and Intangibles 7.4 Debt, Equity, and Contingencies
11 Chapter 8: FAR Selected Transactions and Measurement Models
8.1 Revenue Recognition: Five-Step Model 8.2 Leases, Income Taxes, and Impairment 8.3 Business Combinations and Consolidations 8.4 Accounting Changes, Errors, and Subsequent Events
12 Chapter 32: FAR Revenue, Leases, and Income Taxes Deep Dive
32.1 Revenue Contract Modifications and Variable Consideration 32.2 Lease Classification and Lessee Accounting 32.3 Deferred Tax Assets, Liabilities, and Valuation Allowances 32.4 Simulation Workflows for Revenue, Lease, and Tax Exhibits
13 Chapter 31: FAR Financial Instruments, Fair Value, and Derivatives
31.1 Financial Asset Classification and Measurement 31.2 Fair Value Hierarchy and Disclosures 31.3 Derivatives, Hedge Accounting, and Embedded Features 31.4 Foreign Currency and Comprehensive Income Signals
14 Chapter 24: FAR Consolidations, Equity Method, and Intercompany Workpapers
24.1 Consolidation Decision and Noncontrolling Interest 24.2 Acquisition-Date Measurement and Goodwill 24.3 Equity Method Income, Dividends, and Impairment 24.4 Intercompany Inventory, Debt, and Fixed Asset Eliminations
15 Chapter 9: FAR Governmental Accounting and Fund Reporting
9.1 Governmental Fund Types and Basis 9.2 Government-Wide Statements and Reconciliations 9.3 Budgetary Accounting and Encumbrances 9.4 Governmental and NFP Comparison Traps
16 Chapter 23: FAR Not-for-Profit and Special Reporting Topics
23.1 Not-for-Profit Net Assets and Restrictions 23.2 Contributions, Conditional Gifts, and Agency Transactions 23.3 Functional Expenses and Statement Presentation 23.4 Interim, Segment, and EPS Reporting Traps
17 Chapter 37: FAR Workbook - Journal Entries, Rollforwards, and Reconciliations
Adjusting Entry Workflow Account Rollforward Workflow Reconciliation and Error Correction Drill Statement Presentation Workpaper Drill
18 Chapter 10: REG Tax Procedure, Ethics, and Business Law
10.1 Tax Practice Ethics and Preparer Responsibilities 10.2 IRS Procedure, Statutes, and Penalties 10.3 Contracts, Agency, and Business Entities 10.4 Secured Transactions, Bankruptcy, and Priority
19 Chapter 11: REG Individual Federal Tax Workflows
11.1 Gross Income, Exclusions, and Adjustments 11.2 Filing Status, Dependents, and Deductions 11.3 Credits, Payments, and AMT Concepts 11.4 Retirement, Passive Activity, and Loss Limitations
20 Chapter 12: REG Property Transactions and Entity Taxation
12.1 Basis, Realized Gain, Recognized Gain, and Character 12.2 C Corporations and Shareholder Transactions 12.3 S Corporations, Partnerships, and Basis 12.4 Entity Tax Simulations and K-1 Workflows
21 Chapter 25: REG Entity Choice, Basis, and Owner Tax Consequences
25.1 C Corporation, S Corporation, and Partnership Comparison 25.2 Formation Contributions and Built-In Gain 25.3 Distributions, Redemptions, and Liquidations 25.4 Loss Limits: Basis, At-Risk, and Passive Rules
22 Chapter 26: REG Property Tax, Character, and Deferral Transactions
26.1 Capital, Ordinary, and Section 1231 Character 26.2 Depreciation Recapture and Unrecaptured Gain 26.3 Like-Kind Exchanges, Involuntary Conversions, and Installment Sales 26.4 Related-Party, Wash-Sale, and Imputed-Interest Traps
23 Chapter 33: REG Trusts, Estates, Gifts, and Exempt Organizations
33.1 Trust and Estate Income Tax Basics 33.2 Gift, Estate, and Beneficiary Planning Concepts 33.3 Tax-Exempt Organizations and Unrelated Business Income 33.4 Fiduciary K-1 and Distribution Simulation Workflows
24 Chapter 38: REG Workbook - Tax Return Schedules and Basis Workpapers
38.1 Individual Return Classification Drill 38.2 Property Basis and Character Workpaper 38.3 Pass-through K-1 and Owner Basis Workpaper 38.4 Business Law Issue Spotting Drill
25 Chapter 13: BAR Business Analysis, Economics, and Forecasting
13.1 Financial Statement Analysis and Ratios 13.2 Variance, Forecasting, and Budgeting 13.3 Cost Accounting and Performance Management 13.4 Economics, Finance, and Decision Models
26 Chapter 14: BAR Technical Accounting and Advanced Reporting
14.1 Revenue, Leases, and Complex Arrangements 14.2 Derivatives, Hedges, and Fair Value 14.3 Business Combinations and Consolidations 14.4 SEC Reporting and Public Company Context
27 Chapter 15: BAR State and Local Government Analysis
15.1 Governmental Fund Analysis 15.2 Government-Wide Conversion Workflows 15.3 Budgetary Reconciliation and CAFR/ACFR Reading 15.4 Government Simulation Strategy
28 Chapter 16: ISC Information Systems and Data Management
16.1 Systems Architecture and Data Flow 16.2 ERP, Accounting Systems, and Change Management 16.3 Data Governance, SQL, and Analytics 16.4 Availability, Backup, and Recovery Controls
29 Chapter 17: ISC Security, Privacy, and SOC Engagements
17.1 Security Threats and Control Selection 17.2 Privacy, Confidentiality, and Compliance Frameworks 17.3 SOC 1, SOC 2, SOC 3, and Cybersecurity Reports 17.4 Service Organization Exceptions and User Controls
30 Chapter 18: TCP Individual Tax Planning and Personal Financial Issues
18.1 Nonroutine Individual Income and Estimated Tax 18.2 Passive, At-Risk, and Investment Planning 18.3 Retirement, Education, and Insurance Planning 18.4 Gift, Estate, and Beneficiary Concepts
31 Chapter 19: TCP Entity Compliance and Planning
19.1 C Corporation Tax Planning 19.2 S Corporation Basis and Distributions 19.3 Partnership Tax Planning and Allocations 19.4 Trusts, Tax-Exempt, and International Signals
32 Chapter 34: TCP International and Advanced Entity Tax Topics
34.1 International Tax Signals and Source of Income 34.2 CFC, Foreign Tax Credit, and Permanent Establishment Concepts 34.3 Consolidated Returns and Affiliated Corporations 34.4 Advanced Partnership and S Corp Planning Scenarios
33 Chapter 35: Choosing and Preparing for BAR, ISC, or TCP
35.1 Discipline Fit Matrix by Background 35.2 BAR, ISC, and TCP Blueprint and Skill Comparison 35.3 Discipline Study Plans and Practice Balance 35.4 Switching Disciplines, Retake, and Score Interpretation
34 Chapter 39: CPA TBS Research, Authoritative Literature, and Document Review
39.1 Document Review Simulation Method 39.2 Research and Authoritative Literature Workflow 39.3 Exhibit Overload and Relevant Data Selection 39.4 Written Explanation and Professional Judgment Drills
35 Chapter 20: CPA Simulations, Retakes, and Final Review
20.1 TBS Exhibit Triage and Workpaper Method 20.2 Section-Specific Final Review Plans 20.3 Score Release, Retake, and Credit Window Decisions 20.4 Four-Section Study Roadmaps
36 Chapter 40: Discipline Workbook Drills for BAR, ISC, and TCP
40.1 BAR Ratio, Variance, and Government Drill 40.2 ISC Control Evidence and SOC Drill 40.3 TCP Basis Planning and Entity Drill 40.4 Discipline Final Mock and Review Log
17.2 Privacy, Confidentiality, and Compliance Frameworks
Key Takeaways Explain This Topic AI
Confidentiality protects information the entity has committed to protect; privacy governs personal information and the rights, notices, uses, and disposal attached to it.
The ISC Blueprint names HIPAA, GDPR, PCI DSS, the NIST Cybersecurity Framework, the NIST Privacy Framework, NIST SP 800-53, the CIS Controls, and COBIT 2019 at a foundational level.
Encryption, tokenization, data obfuscation, data loss prevention, and secure deletion are selected based on where data sits in its life cycle.
A breach creates financial-statement, operational, legal, regulatory, reputational, and customer-retention consequences a CPA must weigh.
SOC 2 privacy and confidentiality testing evaluates whether controls meet service commitments, system requirements, and the selected Trust Services Criteria.
Last updated: June 2026
Confidentiality Versus Privacy
Confidentiality concerns information the organization has committed to protect from unauthorized disclosure: customer contracts, pricing models, employee files, source code, trade secrets, or nonpublic financial data. Privacy concerns personal information (PI) and the rules for collecting, using, retaining, disclosing, and disposing of it. Personal information can be confidential, but not all confidential information is personal. This distinction is heavily tested because the two map to different Trust Services Criteria categories.
The exam tests the difference through a control objective. If a company promises customers that uploaded documents are visible only to authorized users, the emphasis is confidentiality . If the company collects consumer location data and must honor consent, access, correction, and deletion obligations and a published privacy notice, the emphasis is privacy .
Frameworks in the ISC Blueprint
Area II requires foundational knowledge of selected regulations, standards, and frameworks. You do not memorize every paragraph; you should know why each exists and how management uses it to design controls.
Framework or rule set Exam focus
HIPAA Security and Privacy Rules Covered entities and business associates; permitted uses and disclosures; administrative, physical, and technical safeguards for protected health information (PHI)
General Data Protection Regulation (GDPR) Scope, personal-data concepts, the six Article 5 principles, and accountability; data-subject rights and breach-notification timelines
PCI DSS Requirements for protecting the cardholder data environment (CDE)
NIST Cybersecurity Framework (CSF) Core Functions, Tiers, and Organizational Profiles for cyber-risk management
- NIST Privacy Framework Core, Profiles, and Implementation Tiers for privacy-risk management
- NIST SP 800-53 Security and privacy control catalog for federal systems and beyond
- CIS Controls Prioritized, defense-first safeguards for common cyber risks
- COBIT 2019 Governance system principles, governance framework principles, and governance-system components
- Data Life-Cycle Controls
Privacy and confidentiality controls should follow the data through its life cycle. At collection , the organization needs notice, consent where required, approved intake channels, and data minimization. During processing , it needs role-based access, segregation of duties, workflow controls, and monitoring. During storage , it needs encryption, key management, classification, backup protection, and retention rules. During transmission , it needs secure protocols such as TLS, certificate management, and transfer monitoring. At deletion , it needs defensible disposal, evidence of erasure, and procedures for legal holds.
Encryption converts data into unreadable form without a key; protects data at rest and in transit.
Tokenization substitutes a non-sensitive token for sensitive data such as a card number, with the real value held in a secure vault.
Data obfuscation / masking scrambles values, ideal for development and test environments.
Data Loss Prevention (DLP) monitors and can block unauthorized movement of sensitive data through email, endpoints, cloud storage, or the network.
Breach Implications
A breach is not only an IT event. It can trigger notification costs, regulatory fines (for example, GDPR penalties up to the greater of EUR 20 million or 4% of global annual revenue), litigation, lost customers, contract penalties, operational downtime, higher cyber-insurance premiums, and loss of trust. For a CPA, those consequences can affect risk assessment, disclosure, going-concern analysis, control-deficiency conclusions, and audit evidence.
SOC 2 Testing Lens
For SOC 2, confidentiality and privacy controls are evaluated against service commitments, system requirements, and the Trust Services Criteria selected for the engagement. A walkthrough might compare the documented retention policy to what personnel actually do in ticketing systems, identity platforms, and storage tools. A test of operating effectiveness inspects access reviews, encryption settings, DLP alerts, deletion tickets, privacy-request logs, or breach-response records.
Start every answer with the obligation: HIPAA PHI, GDPR personal data, PCI cardholder data, and confidential customer data each demand different commitments and evidence.
Worked Scenario: Choosing the Right Framework and Control
A simulation describes a US health-technology vendor that processes patient appointment records for clinics and also accepts credit-card payments through its portal. Two obligations apply at once. The patient records make the vendor a business associate subject to HIPAA, so it needs a business associate agreement, the required administrative, physical, and technical safeguards, and breach-notification procedures. The card data places the payment portal inside the PCI DSS cardholder-data environment, so it needs network segmentation isolating the CDE, tokenization of stored card numbers, and quarterly vulnerability scans.
The testable insight: the same company can be governed by different frameworks for different data, and the right control depends on which data and obligation the stem names. If the question asks about protecting stored card numbers, tokenization is the answer; if it asks about disclosing patient data to a clinic, HIPAA permitted uses and the minimum-necessary standard govern.
Privacy Rights and Data-Subject Requests
GDPR and similar regimes grant individuals rights the entity's controls must support: access, rectification, erasure (the right to be forgotten), restriction, portability, and objection. A SOC 2 privacy engagement tests whether the entity can locate all copies of a person's data, honor a deletion request within the required window, and log the request and response. Controls fail here when data is duplicated across backups and vendor systems with no inventory.
Common Traps
Calling all personal information "confidential" data and missing that privacy is a separate Trust Services Criteria category with its own commitments.
Assuming encryption alone satisfies privacy; encryption protects confidentiality but does not honor consent, notice, retention, or deletion obligations.
Picking obfuscation for a production system when production needs real data and access controls instead; masking belongs in development and test.
Treating a SOC 3 report as adequate due-diligence evidence when detailed control testing is required.
Forgetting that a breach has financial-statement and disclosure consequences, not just IT consequences, for the CPA.