SOC 2 is a US standard, but European companies are asked for it regularly, mostly by US customers, international enterprises and buyers whose procurement templates come from the US. In Europe it sits beside, not instead of, the regulations that apply: a SOC 2 report can be evidence for the security of processing a processor owes under GDPR Article 32, for the supply-chain security NIS2 Article 21 asks customers to manage, and for the ICT third-party assessments DORA requires of financial entities. It does not show compliance with any of them. Many European buyers treat ISO 27001 as the default, so the practical question is which assurance your buyers ask for, and whether one examination can serve more than one of them.
For a European SaaS company the first SOC 2 request usually arrives with the first large US deal, or from a European enterprise whose vendor review was designed in the US. The report is the same one a US company gets, but it lands among European obligations that it helps with and does not replace.
Why European buyers ask for SOC 2
- They are US companies, or European subsidiaries of them, with a procurement process that asks for SOC 2 by default.
- They are international enterprises that accept several standards and list SOC 2 first.
- They are regulated, for example under DORA, and want independent assurance on the controls of the providers they rely on.
SOC 2 and GDPR
Under GDPR Article 28 a processor has to help its controller demonstrate compliance and allow for audits, and under Article 32 it has to implement appropriate security. A SOC 2 report on Security, and often Confidentiality, is strong evidence for the security side and is commonly accepted as part of the audit rights in a data processing agreement. It does not cover lawful basis, records of processing, data subject rights or international transfers. The SOC 2 Privacy category is built on US privacy concepts and is not a GDPR assessment, which is why most European processors leave it out of scope. The GDPR framework page covers what the regulation itself requires.
SOC 2 and NIS2
NIS2 Article 21(2)(d) requires essential and important entities to manage the security of their supply chain, including their relationships with direct suppliers. A supplier's SOC 2 report is one of the answers those customers accept. If you are in scope of NIS2 yourself, a SOC 2 report says nothing about your own obligations, such as incident reporting to your national authority. The NIS2 framework page covers scope and requirements.
SOC 2 and DORA
DORA requires financial entities to assess and monitor their ICT third-party providers and to keep a register of information on every arrangement. A provider's SOC 2 report feeds that assessment, but it does not replace the contractual provisions DORA requires, including audit and access rights for services that support critical or important functions. The guide to SOC 2 and DORA third-party risk covers how financial entities use the report.
SOC 2, ISO 27001 or ISAE 3000
| If your buyers are… | They usually ask for… |
|---|---|
| US enterprises | A SOC 2 Type 2 report |
| European enterprises | ISO 27001, sometimes with an ISAE 3000 report |
| Both | ISO 27001 and SOC 2, mapped to one control set so evidence is collected once |
| Regulated European financial entities | Assurance on the controls behind critical services, plus DORA contract terms |
The comparison of SOC 2 and the ISAE standards covers how the assurance reports relate, and the ISO 27001 and SOC 2 comparison covers the management-system alternative.
Data residency in the report
A SOC 2 report has no residency requirement of its own, but European buyers will read the system description to see where their data lives. Name the cloud regions in scope, the subservice organizations that process data and where they operate, and any support access from outside the EU. The guide to the system description covers how to write those sections.
Finding an auditor in Europe
Only a licensed CPA firm can issue a SOC 2 report, and in Europe that usually means a member firm of an international network that holds the license, or a US firm working remotely. Ask which entity will sign the report, whether the team has examined companies on your infrastructure, and whether the same work can also produce an ISAE 3000 report for buyers who ask for one.