Global CBPR Forum certification operates through ACCREDITED ACCOUNTABILITY AGENTS (AAs). AAs are third-party private-sector organizations accredited by the Forum to certify Controllers (Global CBPR) + Processors (Global PRP); accreditation is jurisdiction-specific (an AA may operate in multiple member jurisdictions but must be accredited per jurisdiction); AAs subject to oversight + audit + sanctions for non-compliance with accreditation standards. ACCREDITED AAs (as of 2026): (a) TRUSTARC (largest by certifications) - operates in US + Canada + Japan + Korea + Philippines + Singapore + Taiwan; (b) SCHELLMAN - US + Canada + Japan + Singapore; (c) BBB NATIONAL PROGRAMS (Better Business Bureau) - US + Canada; (d) JIPDEC (Japan Information Processing Development Center) - Japan (national); (e) others in accreditation pipeline. CERTIFICATION PROCESS: (1) ORGANIZATION SELF-ASSESSMENT against 50 Program Requirements + privacy policies + procedures + practices; (2) ENGAGEMENT OF AA - contract + scope definition + fee structure (typically USD 10K-100K depending on size); (3) AA REVIEW - desk audit + interviews + sampling + remediation period (typically 60-90 days); (4) AA DECISION - certification awarded or remediation required; (5) ANNUAL RECERTIFICATION - lighter-touch review + change-management notifications + dispute-resolution oversight; (6) BREACH NOTIFICATION - to AA + ongoing-compliance monitoring; (7) CONTINUOUS MONITORING - dispute resolution + complaint handling + AA-to-organization escalation + regulator referral if needed. SANCTIONS: organizations may lose certification for material non-compliance + cooperation failure + repeated breach; reinstatement requires remediation + re-assessment.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.