APEC Cross-Border Privacy Rules (CBPR) System

Asia-Pacific (APEC)

v2011 (updated)

17 domains

20 controls

The APEC Cross-Border Privacy Rules (CBPR) System is a voluntary accountability-based framework for facilitating cross-border data flows among APEC economies while protecting personal information. Participating companies self-certify compliance with programme requirements, verified by APEC-recognised accountability agents. Based on the APEC Privacy Framework. Participating economies include US, Japan, Canada, South Korea, Australia, Singapore, and others. Being transitioned to the Global CBPR Forum.

Verified

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (17)

Certification

2 controls

Controls in the Certification domain of APEC Cross-Border Privacy Rules (CBPR) System — 2 controls
Code	Title	Description
CBPR-10	Accountability	Implement measures to ensure compliance with CBPR program requirements, including onward transfer obligations with proce...
CBPR-11	Preventing Harm	Recognize that personal information protection should be designed to prevent the misuse of personal information and reme...

Complaints

1 controls

Controls in the Complaints domain of APEC Cross-Border Privacy Rules (CBPR) System — 1 controls
Code	Title	Description
CBPR-12	Privacy Recognition for Processors (PRP)	Processors handling personal information on behalf of controllers may achieve PRP certification demonstrating they can a...

Consent

1 controls

Controls in the Consent domain of APEC Cross-Border Privacy Rules (CBPR) System — 1 controls
Code	Title	Description
CBPR-04	Choice	Provide clear, prominent, accessible, and affordable mechanisms for individuals to exercise choice over collection, use,...

Data Minimization

1 controls

Controls in the Data Minimization domain of APEC Cross-Border Privacy Rules (CBPR) System — 1 controls
Code	Title	Description
CBPR-02	Collection Limitation	Limit collection of personal information to what is relevant to identified purposes and obtain it by lawful and fair mea...

Data Quality

1 controls

Controls in the Data Quality domain of APEC Cross-Border Privacy Rules (CBPR) System — 1 controls
Code	Title	Description
CBPR-05	Integrity of Personal Information	Maintain personal information that is accurate, complete, and kept up to date to the extent necessary for purposes of us...

Documentation

1 controls

Controls in the Documentation domain of APEC Cross-Border Privacy Rules (CBPR) System — 1 controls
Code	Title	Description
CBPR-17	Records of Processing and Documentation	Maintain records sufficient to demonstrate compliance with program requirements, including data flows, third-party recip...

Governance

2 controls

Controls in the Governance domain of APEC Cross-Border Privacy Rules (CBPR) System — 2 controls
Code	Title	Description
CBPR-08	Accountability	Be accountable for complying with measures that give effect to privacy principles and for onward transfers to other pers...
CBPR-18	Global CBPR Forum Alignment	Align with Global CBPR Forum operational principles established in 2022 enabling broader participation beyond APEC econo...

Incident

1 controls

Controls in the Incident domain of APEC Cross-Border Privacy Rules (CBPR) System — 1 controls
Code	Title	Description
CBPR-16	Regulator Cooperation and Enforcement	Cooperate with relevant Privacy Enforcement Authorities and Accountability Agents, including providing information neces...

Individual Rights

1 controls

Controls in the Individual Rights domain of APEC Cross-Border Privacy Rules (CBPR) System — 1 controls
Code	Title	Description
CBPR-07	Access and Correction	Provide individuals reasonable ability to access, confirm, challenge accuracy, and obtain correction or deletion of thei...

Lifecycle

1 controls

Controls in the Lifecycle domain of APEC Cross-Border Privacy Rules (CBPR) System — 1 controls
Code	Title	Description
CBPR-20	Recertification and Monitoring	Maintain CBPR certification through annual recertification, monitoring, and remediation of findings raised by the Accoun...

People

1 controls

Controls in the People domain of APEC Cross-Border Privacy Rules (CBPR) System — 1 controls
Code	Title	Description
CBPR-15	Recertification and Continuous Monitoring	Maintain CBPR or PRP status through annual recertification, continuous compliance, and notification of material changes.

Purpose Limitation

1 controls

Controls in the Purpose Limitation domain of APEC Cross-Border Privacy Rules (CBPR) System — 1 controls
Code	Title	Description
CBPR-03	Uses of Personal Information	Use personal information only for purposes of collection or compatible/related purposes, except with consent or as autho...

Risk

1 controls

Controls in the Risk domain of APEC Cross-Border Privacy Rules (CBPR) System — 1 controls
Code	Title	Description
CBPR-09	Preventing Harm	Design protections to prevent misuse of personal information taking into account risks of harm to individuals.

Security

1 controls

Controls in the Security domain of APEC Cross-Border Privacy Rules (CBPR) System — 1 controls
Code	Title	Description
CBPR-06	Security Safeguards	Protect personal information with reasonable safeguards proportionate to likelihood and severity of harm, sensitivity, a...

Third Party

1 controls

Controls in the Third Party domain of APEC Cross-Border Privacy Rules (CBPR) System — 1 controls
Code	Title	Description
CBPR-19	Vendor Management	Conduct due diligence and ongoing oversight of vendors and processors that handle personal information.

Transfers

2 controls

Controls in the Transfers domain of APEC Cross-Border Privacy Rules (CBPR) System — 2 controls
Code	Title	Description
CBPR-13	Cross-Border Transfer Safeguards	Transfers between participating economies rely on CBPR certification as an accountability mechanism while maintaining tr...
CBPR-14	Complaint Handling and Redress	Establish accessible mechanisms for individuals to raise complaints and obtain redress, including dispute resolution thr...

Transparency

1 controls

Controls in the Transparency domain of APEC Cross-Border Privacy Rules (CBPR) System — 1 controls
Code	Title	Description
CBPR-01	Notice	Provide clear, accessible notice describing personal information practices including collection, use, disclosure, and ch...

Maps to 1 other framework

20 total controls

GDPR

10 source controls mapped|9 target controls covered

50%

Compare APEC Cross-Border Privacy Rules (CBPR) System with GDPR

Frequently Asked Questions

What is APEC Cross-Border Privacy Rules (CBPR) System?

APEC Cross-Border Privacy Rules (CBPR) System is a compliance framework from Asia-Pacific (APEC) with 17 domains and 20 controls. The APEC Cross-Border Privacy Rules (CBPR) System is a voluntary accountability-based framework for facilitating cross-border data flows among APEC economies while protecting personal information. Participating companies self-certify compliance with programme requirements, verified by APEC-recognised accountability agents. Based on the APEC Privacy Framework. Participating economies include US, Japan, Canada, South Korea, Australia, Singapore, and others. Being transitioned to the Global CBPR Forum. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

How many controls does APEC Cross-Border Privacy Rules (CBPR) System have?

APEC Cross-Border Privacy Rules (CBPR) System has 20 controls organised across 17 domains. The largest domains are Certification (2 controls), Governance (2 controls), Transfers (2 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

What frameworks does APEC Cross-Border Privacy Rules (CBPR) System map to?

APEC Cross-Border Privacy Rules (CBPR) System maps to 1 other compliance frameworks. The top mapping partners are GDPR (50% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I get started with APEC Cross-Border Privacy Rules (CBPR) System compliance?

Start your APEC Cross-Border Privacy Rules (CBPR) System compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about APEC Cross-Border Privacy Rules (CBPR) System requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 20 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 718 frameworks.

Get Started Free →

Free forever — no credit card required