Does SOC 2 cover GDPR?
Short answer
No. SOC 2's optional Privacy criteria can evidence parts of a privacy program, but GDPR is an EU law with obligations — lawful basis, data-subject rights, breach notification — that a SOC 2 report does not satisfy on its own.
Where they overlap
Both care about protecting personal data, access control, and incident response, so the underlying controls reinforce each other.
Where they don't
GDPR imposes legal duties (DPAs, records of processing, data-subject requests) that sit outside the scope of a SOC 2 attestation and usually need legal counsel.