APEC Cross-Border Privacy Rules (CBPR) System

Why does it matter?

The APEC CBPR System gives organizations an internationally recognized way to prove accountable handling of personal data and to keep cross-border data flows lawful where participating economies recognize the certification.

Key benefits include:

• Enable lawful cross-border data transfers

The Global CBPR System bridges differing national privacy laws among Forum members and gives organizations a verified way to transfer personal information across jurisdictions.

• Demonstrate accountability to regulators and customers

Independent assessment and a published certification mark show that privacy commitments are verified rather than self-declared.

• Harmonize privacy controls across jurisdictions

One set of program requirements aligned with the APEC Privacy Framework and the OECD Privacy Guidelines supports compliance in several markets at once.

• Extend assurance to processors

The companion PRP certification lets processors show controllers that they can meet CBPR obligations on their behalf.

• Reduce enforcement and reputational risk

Each certification is backed by a privacy enforcement authority that participates in the Global Cooperation Arrangement for Privacy Enforcement (Global CAPE), which gives it credibility with consumers and partners.

How does it work?

The CBPR System is built on nine Global CBPR Privacy Principles carried over from the APEC Privacy Framework: Preventing Harm, Notice, Collection Limitation, Uses of Personal Information, Choice, Integrity of Personal Information, Security Safeguards, Access and Correction, and Accountability. The program requirements translate these principles into 50 assessable questions grouped under eight headings, each with assessment criteria that an Accountability Agent verifies. Accountability Agents are recognized by the Forum against published criteria, and privacy enforcement authorities cooperate through Global CAPE; the APEC system uses the CPEA for the same purpose.

Organizations implement the system by completing the intake questionnaire, attaching privacy statements, policies, and procedures as evidence, and working with the Accountability Agent to close gaps before certification. Ongoing activities include maintaining a personal information inventory, honoring notice and choice commitments, managing onward transfers to third parties and processors, running security safeguards proportionate to risk, handling access and correction requests, and responding to complaints and the Accountability Agent's ongoing compliance monitoring.

Within SmartSuite, teams can operationalize the CBPR System by loading the 50 program requirements as a control library, assigning owners and review cadences, attaching the privacy statements and procedures an Accountability Agent will ask for, and tracking recertification, complaints, and third-party transfers in one workspace with dashboards for privacy leadership.

Key Elements

• Global CBPR Privacy Principles

Nine principles derived from the APEC Privacy Framework that define what a certified organization must commit to.

• Program requirements and intake questionnaire

Fifty questions with assessment criteria that applicants answer and evidence, replicated in the intake questionnaire. The current Global CBPR program requirements are valid until 31 March 2027, and an updated version takes effect on 1 April 2027.

• Accountability Agents

Independent, Forum-recognized bodies that assess applicants, certify them, monitor compliance, and handle disputes.

• Privacy Recognition for Processors (PRP)

A parallel certification that lets processors demonstrate they can implement a controller's CBPR obligations.

• Enforcement backstop

Privacy enforcement authorities in each participating jurisdiction can act on a certified organization's failure to honor its commitments, cooperating through Global CAPE.

• Global CBPR Forum governance

The Forum, established by the 2022 Global CBPR Declaration, sets the Framework, program requirements, and recognition criteria and admits members and associates.

What does it cover?

The CBPR System applies to personal information controllers headquartered in a participating jurisdiction that seek certification, and through PRP to processors acting on a controller's instructions. It covers the collection, use, disclosure, transfer, and safeguarding of personal information about identified or identifiable individuals, and it is typically adopted by multinational organizations that transfer customer or employee data among Asia-Pacific and Global CBPR Forum jurisdictions.

What are its objectives?

The APEC CBPR System aims to protect personal information while keeping trusted cross-border data flows open among participating economies.

Give individuals clear notice, choice, and access rights wherever their data travels

Hold certified organizations accountable through independent assessment and regulator enforcement

Provide a single recognized transfer mechanism that bridges differing national privacy laws

Extend verified privacy assurance to processors through the PRP certification

Promote interoperability with the OECD Privacy Guidelines, GDPR, and other frameworks

Support trusted cross-border data flows for businesses of all sizes, including micro, small, and medium-sized businesses

Framework in Context

The CBPR System operationalizes the APEC Privacy Framework and is consistent with the OECD Privacy Guidelines; the Global CBPR Framework of 2023 restates both as the basis for the global certifications. Organizations commonly run it alongside GDPR and UK GDPR transfer mechanisms, the EU-US Data Privacy Framework, ISO/IEC 27701, and the national privacy laws of the participating economies.

Common Framework Mappings

Organizations map the CBPR program requirements to regional privacy laws and privacy management standards so that one privacy program supports certification, statutory compliance, and international transfers.

Mapped frameworks include:

APEC PF

APEC Privacy Recognition for Processors (PRP)

OECD Privacy Guidelines

GDPR

UK GDPR

EU-US DPF

Convention 108+

ISO 27701

ISO 29100

NIST Privacy Framework v1.0

Privacy Act 1988 (APPs)

APPI

PIPA (South Korea)

Singapore PDPA

Philippines DPA (RA 10173)