Back to Frameworks

Global Cross-Border Privacy Rules (Global CBPR) Forum

Self-Assess
International (Global CBPR Forum Members)
vGlobal CBPR Program Requirements updated March 2026 (57; certification from 1 April 2027; 50-requirement set until then); Global PRP Program Requirements (18); Policies, Rules and Guidelines April 2024
11 domains
75 controls

The Global Cross-Border Privacy Rules (CBPR) and Privacy Recognition for Processors (PRP) Systems of the Global CBPR Forum, the international successor to the APEC CBPR System: 57 Global CBPR Program Requirements for controllers (the updated set certified from 1 April 2027, each mapped to the 50 certified today) and 18 Global PRP Program Requirements for processors, verified by Forum-recognised Accountability Agents. Built from the Forum's own requirement documents.

Verified

Global Cross-Border Privacy Rules (Global CBPR) Forum is a compliance framework from International (Global CBPR Forum Members) with 11 domains and 75 controls that map to 41 other frameworks. The largest domains are Global CBPR: Accountability (requirements 46 to 57) – Global Cross-Border Privacy Rules (Global CBPR) Forum (12 controls), Global CBPR: Security Safeguards (requirements 33 to 42) – Global Cross-Border Privacy Rules (Global CBPR) Forum (10 controls), Global PRP: Accountability Measures (requirements 9 to 18) – Global Cross-Border Privacy Rules (Global CBPR) Forum (10 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (11)

Global CBPR: Access and Correction (requirements 43 to 45) – Global Cross-Border Privacy Rules (Global CBPR) Forum

3 controls
Controls in the Global CBPR: Access and Correction (requirements 43 to 45) – Global Cross-Border Privacy Rules (Global CBPR) Forum domain of Global Cross-Border Privacy Rules (Global CBPR) Forum: 3 controls
CodeTitle
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.43Global CBPR requirement 43: confirm on request whether personal information is held
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.44Global CBPR requirement 44: provide access to the personal information held
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.45Global CBPR requirement 45: challenge, correction, completion and deletion

Global CBPR: Accountability (requirements 46 to 57) – Global Cross-Border Privacy Rules (Global CBPR) Forum

12 controls
Controls in the Global CBPR: Accountability (requirements 46 to 57) – Global Cross-Border Privacy Rules (Global CBPR) Forum domain of Global Cross-Border Privacy Rules (Global CBPR) Forum: 12 controls
CodeTitle
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.46Global CBPR requirement 46: measures to ensure compliance, including records of processing
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.47Global CBPR requirement 47: a qualified individual responsible for overall compliance
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.48Global CBPR requirement 48: procedures to receive, investigate and respond to privacy complaints
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.49Global CBPR requirement 49: timely responses to complaints
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.50Global CBPR requirement 50: explain remedial action in complaint responses
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.51Global CBPR requirement 51: train employees on privacy policies and complaint handling
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.52Global CBPR requirement 52: respond to subpoenas, warrants and government orders
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.53Global CBPR requirement 53: mechanisms with processors so obligations to individuals are met
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.54Global CBPR requirement 54: processor agreements with the required terms
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.55Global CBPR requirement 55: processor self-assessments
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.56Global CBPR requirement 56: spot checks or monitoring of processors
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.57Global CBPR requirement 57: protect information where recipient due diligence is impractical

Global CBPR: Choice (requirements 19 to 27) – Global Cross-Border Privacy Rules (Global CBPR) Forum

9 controls
Controls in the Global CBPR: Choice (requirements 19 to 27) – Global Cross-Border Privacy Rules (Global CBPR) Forum domain of Global Cross-Border Privacy Rules (Global CBPR) Forum: 9 controls
CodeTitle
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.19Global CBPR requirement 19: a mechanism to exercise choice over collection
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.20Global CBPR requirement 20: a mechanism to exercise choice over use
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.21Global CBPR requirement 21: a mechanism to exercise choice over disclosure
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.22Global CBPR requirement 22: choice over direct marketing at any time
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.23Global CBPR requirement 23: choice mechanisms clear and conspicuous
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.24Global CBPR requirement 24: choice mechanisms clearly worded and understandable
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.25Global CBPR requirement 25: choice mechanisms easily accessible and affordable
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.26Global CBPR requirement 26: choices recorded and honoured effectively and promptly
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.27Global CBPR requirement 27: withdrawal of consent and requests to cease use or disclosure

Global CBPR: Collection Limitation (requirements 10 to 12) – Global Cross-Border Privacy Rules (Global CBPR) Forum

3 controls
Controls in the Global CBPR: Collection Limitation (requirements 10 to 12) – Global Cross-Border Privacy Rules (Global CBPR) Forum domain of Global Cross-Border Privacy Rules (Global CBPR) Forum: 3 controls
CodeTitle
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.10Global CBPR requirement 10: identify how personal information is obtained
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.11Global CBPR requirement 11: limit collection to information relevant to the purposes, mapped type by type
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.12Global CBPR requirement 12: collect by lawful and fair means

Global CBPR: Integrity of Personal Information (requirements 28 to 32) – Global Cross-Border Privacy Rules (Global CBPR) Forum

5 controls
Controls in the Global CBPR: Integrity of Personal Information (requirements 28 to 32) – Global Cross-Border Privacy Rules (Global CBPR) Forum domain of Global Cross-Border Privacy Rules (Global CBPR) Forum: 5 controls
CodeTitle
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.28Global CBPR requirement 28: keep personal information accurate, complete and up to date
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.29Global CBPR requirement 29: a working mechanism to correct inaccurate, incomplete or outdated information
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.30Global CBPR requirement 30: pass corrections on to processors and service providers
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.31Global CBPR requirement 31: pass corrections on to third parties that received the information
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.32Global CBPR requirement 32: processors report inaccurate information back

Global CBPR: Notice (requirements 6 to 9) – Global Cross-Border Privacy Rules (Global CBPR) Forum

4 controls
Controls in the Global CBPR: Notice (requirements 6 to 9) – Global Cross-Border Privacy Rules (Global CBPR) Forum domain of Global Cross-Border Privacy Rules (Global CBPR) Forum: 4 controls
CodeTitle
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.6Global CBPR requirement 6: a clear, accessible privacy statement with the required content
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.7Global CBPR requirement 7: notice at the time of collection
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.8Global CBPR requirement 8: state the purposes at the time of collection
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.9Global CBPR requirement 9: tell individuals at collection that their information may be shared with third parties

Global CBPR: Preventing Harm (requirements 1 to 5) – Global Cross-Border Privacy Rules (Global CBPR) Forum

5 controls
Controls in the Global CBPR: Preventing Harm (requirements 1 to 5) – Global Cross-Border Privacy Rules (Global CBPR) Forum domain of Global Cross-Border Privacy Rules (Global CBPR) Forum: 5 controls
CodeTitle
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.1Global CBPR requirement 1: extra safeguards for sensitive personal information
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.2Global CBPR requirement 2: assess whether children's personal information is processed
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.3Global CBPR requirement 3: verify parental consent or another legal basis for children's information
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.4Global CBPR requirement 4: risk assessment of harm to individuals and proportionate mitigation
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.5Global CBPR requirement 5: notify affected individuals of a breach likely to cause significant harm

Global CBPR: Security Safeguards (requirements 33 to 42) – Global Cross-Border Privacy Rules (Global CBPR) Forum

10 controls
Controls in the Global CBPR: Security Safeguards (requirements 33 to 42) – Global Cross-Border Privacy Rules (Global CBPR) Forum domain of Global Cross-Border Privacy Rules (Global CBPR) Forum: 10 controls
CodeTitle
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.33Global CBPR requirement 33: a written information security policy
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.34Global CBPR requirement 34: physical, technical and administrative safeguards against loss and misuse
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.35Global CBPR requirement 35: safeguards proportional to harm, sensitivity and context
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.36Global CBPR requirement 36: staff awareness of security obligations through training and oversight
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.37Global CBPR requirement 37: safeguards across people, systems, attack response and physical security
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.38Global CBPR requirement 38: a policy for secure disposal
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.39Global CBPR requirement 39: detect, prevent and respond to attacks and security failures
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.40Global CBPR requirement 40: test the effectiveness of safeguards and adjust
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.41Global CBPR requirement 41: third-party certifications or risk assessments, with recommendations implemented
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.42Global CBPR requirement 42: require processors to protect information, notify breaches and correct failures

Global CBPR: Uses of Personal Information (requirements 13 to 18) – Global Cross-Border Privacy Rules (Global CBPR) Forum

6 controls
Controls in the Global CBPR: Uses of Personal Information (requirements 13 to 18) – Global Cross-Border Privacy Rules (Global CBPR) Forum domain of Global Cross-Border Privacy Rules (Global CBPR) Forum: 6 controls
CodeTitle
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.13Global CBPR requirement 13: use personal information only for the stated or compatible purposes
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.14Global CBPR requirement 14: unrelated uses only on express consent or legal compulsion
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.15Global CBPR requirement 15: identify disclosures to other controllers
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.16Global CBPR requirement 16: identify transfers to processors
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.17Global CBPR requirement 17: disclosures and transfers limited to the original or a compatible purpose
global-cross-border-privacy-rules-global-cbpr-forum::CBPR.18Global CBPR requirement 18: unrelated disclosures only on consent, necessity for a requested service, or legal compulsion

Global PRP: Accountability Measures (requirements 9 to 18) – Global Cross-Border Privacy Rules (Global CBPR) Forum

10 controls
Controls in the Global PRP: Accountability Measures (requirements 9 to 18) – Global Cross-Border Privacy Rules (Global CBPR) Forum domain of Global Cross-Border Privacy Rules (Global CBPR) Forum: 10 controls
CodeTitle
global-cross-border-privacy-rules-global-cbpr-forum::PRP.10Global PRP requirement 10: delete, update and correct on the controller's request
global-cross-border-privacy-rules-global-cbpr-forum::PRP.11Global PRP requirement 11: measures to comply with the controller's instructions
global-cross-border-privacy-rules-global-cbpr-forum::PRP.12Global PRP requirement 12: an individual responsible for Global PRP compliance
global-cross-border-privacy-rules-global-cbpr-forum::PRP.13Global PRP requirement 13: forward or handle individuals' requests and complaints
global-cross-border-privacy-rules-global-cbpr-forum::PRP.14Global PRP requirement 14: tell controllers of government demands unless prohibited
global-cross-border-privacy-rules-global-cbpr-forum::PRP.15Global PRP requirement 15: notify the controller of subprocessors engaged
global-cross-border-privacy-rules-global-cbpr-forum::PRP.16Global PRP requirement 16: mechanisms binding subprocessors to the processor's obligations
global-cross-border-privacy-rules-global-cbpr-forum::PRP.17Global PRP requirement 17: subprocessor terms: instructions, onward limits, certification, evidence and monitoring
global-cross-border-privacy-rules-global-cbpr-forum::PRP.18Global PRP requirement 18: train employees on privacy policies and client instructions
global-cross-border-privacy-rules-global-cbpr-forum::PRP.9Global PRP requirement 9: process only for the purposes the controller specifies

Global PRP: Security Safeguards (requirements 1 to 8) – Global Cross-Border Privacy Rules (Global CBPR) Forum

8 controls
Controls in the Global PRP: Security Safeguards (requirements 1 to 8) – Global Cross-Border Privacy Rules (Global CBPR) Forum domain of Global Cross-Border Privacy Rules (Global CBPR) Forum: 8 controls
CodeTitle
global-cross-border-privacy-rules-global-cbpr-forum::PRP.1Global PRP requirement 1: information security policy covering personal information processed for controllers
global-cross-border-privacy-rules-global-cbpr-forum::PRP.2Global PRP requirement 2: safeguards that implement the security policy, reviewed periodically
global-cross-border-privacy-rules-global-cbpr-forum::PRP.3Global PRP requirement 3: employee awareness of security obligations
global-cross-border-privacy-rules-global-cbpr-forum::PRP.4Global PRP requirement 4: detect, prevent and respond to security failures
global-cross-border-privacy-rules-global-cbpr-forum::PRP.5Global PRP requirement 5: test safeguards and adjust
global-cross-border-privacy-rules-global-cbpr-forum::PRP.6Global PRP requirement 6: notify the controller of breaches
global-cross-border-privacy-rules-global-cbpr-forum::PRP.7Global PRP requirement 7: secure disposal or return on instruction or at termination
global-cross-border-privacy-rules-global-cbpr-forum::PRP.8Global PRP requirement 8: third-party certifications or risk assessments

Your Compliance Coverage

If you comply with Global Cross-Border Privacy Rules (Global CBPR) Forum, you already cover:

Privacy Act 1988 (Australia)

2%

2 controls mapped

Compare →

Bahrain PDPL

2%

2 controls mapped

Compare →

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)

2%

2 controls mapped

Compare →

+ 38 more: Family Educational Rights and Privacy Act (FERPA) (2%), GLI-33 - Gaming Laboratories International Event Wagering Systems (2%)

See all 41 mapped frameworks ↓

Maps to 41 other frameworks

87 total controls
Privacy Act 1988 (Australia)
2 source controls mapped|4 target controls covered
2%
Bahrain PDPL
2 source controls mapped|6 target controls covered
2%
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)
2 source controls mapped|5 target controls covered
2%
Family Educational Rights and Privacy Act (FERPA)
2 source controls mapped|6 target controls covered
2%
GLI-33 - Gaming Laboratories International Event Wagering Systems
2 source controls mapped|2 target controls covered
2%
Vietnam Law on Cybersecurity (No. 116/2025/QH15)
1 source controls mapped|2 target controls covered
1%
Vermont Data Privacy and Online Surveillance Act
1 source controls mapped|1 target controls covered
1%
USMCA Chapter 19 - Digital Trade (United States-Mexico-Canada Agreement)
1 source controls mapped|2 target controls covered
1%
UK Defence Standard 05-138 - Cyber Security for Defence Suppliers
1 source controls mapped|1 target controls covered
1%
TEFCA - Trusted Exchange Framework and Common Agreement
1 source controls mapped|1 target controls covered
1%
Russia Federal Law on Personal Data (152-FZ)
1 source controls mapped|2 target controls covered
1%
South Korea PIPA
1 source controls mapped|1 target controls covered
1%
Italy Personal Data Protection Code (Legislative Decree No. 196/2003, amended 2018)
1 source controls mapped|2 target controls covered
1%
India Account Aggregator Framework (RBI)
1 source controls mapped|1 target controls covered
1%
APPI
1 source controls mapped|3 target controls covered
1%
ISO/IEC 27400:2022
1 source controls mapped|2 target controls covered
1%
ISO/IEC 29134:2023
1 source controls mapped|3 target controls covered
1%
COSO Internal Control - Integrated Framework (2013)
1 source controls mapped|1 target controls covered
1%
Austria Data Protection Act (Datenschutzgesetz, DSG, amended 2018)
1 source controls mapped|3 target controls covered
1%
Australian Privacy Principles (APPs)
1 source controls mapped|3 target controls covered
1%
ISO/IEC 27557:2022 - Organisational Privacy Risk Management
1 source controls mapped|6 target controls covered
1%
German Supply Chain Due Diligence Act (LkSG)
1 source controls mapped|1 target controls covered
1%
IEC 60601-1 - Medical Electrical Equipment Safety
1 source controls mapped|3 target controls covered
1%
FedRAMP Rev 5
1 source controls mapped|2 target controls covered
1%
FTC GLBA Safeguards Rule (16 CFR Part 314)
1 source controls mapped|1 target controls covered
1%
ISO/IEC 29100:2024
1 source controls mapped|3 target controls covered
1%
Florida Digital Bill of Rights (FDBR)
1 source controls mapped|3 target controls covered
1%
AML/CTF Act 2006 (Australia)
1 source controls mapped|1 target controls covered
1%
Azerbaijan Law on Personal Data (2010)
1 source controls mapped|3 target controls covered
1%
Armenia Law on Protection of Personal Data (2015)
1 source controls mapped|3 target controls covered
1%
Aged Care Quality Standards 2019 (repealed edition)
1 source controls mapped|1 target controls covered
1%
Singapore AI Governance Framework
1 source controls mapped|2 target controls covered
1%
BS 65000:2014 - Guidance on Organizational Resilience
1 source controls mapped|2 target controls covered
1%
Barbados Data Protection Act 2019
1 source controls mapped|3 target controls covered
1%
FFIEC Cybersecurity Assessment Tool (CAT)
1 source controls mapped|2 target controls covered
1%
AS9100D - Aerospace Quality Management System
1 source controls mapped|1 target controls covered
1%
GLBA
1 source controls mapped|1 target controls covered
1%
API 1164
1 source controls mapped|1 target controls covered
1%
Albania Law No. 124/2024 on Personal Data Protection
1 source controls mapped|2 target controls covered
1%
FedRAMP High
1 source controls mapped|1 target controls covered
1%
FedRAMP Moderate
1 source controls mapped|1 target controls covered
1%
Compare Global Cross-Border Privacy Rules (Global CBPR) Forum with Privacy Act 1988 (Australia)

Coverage is not the same as your position

This page shows what Global Cross-Border Privacy Rules (Global CBPR) Forum overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.

The Compliance Position Diagnostic, $5,000 fixed, ten business days

What is Global Cross-Border Privacy Rules (Global CBPR) Forum and who does it apply to?

Global Cross-Border Privacy Rules (Global CBPR) Forum is a compliance framework from International (Global CBPR Forum Members) with 11 domains and 75 controls. The Global Cross-Border Privacy Rules (CBPR) and Privacy Recognition for Processors (PRP) Systems of the Global CBPR Forum, the international successor to the APEC CBPR System: 57 Global CBPR Program Requirements for controllers (the updated set certified from 1 April 2027, each mapped to the 50 certified today) and 18 Global PRP Program Requirements for processors, verified by Forum-recognised Accountability Agents. Built from the Forum's own requirement documents. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does Global Cross-Border Privacy Rules (Global CBPR) Forum actually require?

Global Cross-Border Privacy Rules (Global CBPR) Forum has 75 controls organised across 11 domains. The largest domains are Global CBPR: Accountability (requirements 46 to 57) – Global Cross-Border Privacy Rules (Global CBPR) Forum (12 controls), Global CBPR: Security Safeguards (requirements 33 to 42) – Global Cross-Border Privacy Rules (Global CBPR) Forum (10 controls), Global PRP: Accountability Measures (requirements 9 to 18) – Global Cross-Border Privacy Rules (Global CBPR) Forum (10 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of Global Cross-Border Privacy Rules (Global CBPR) Forum do I already cover?

Global Cross-Border Privacy Rules (Global CBPR) Forum maps to 41 other compliance frameworks. The top mapping partners are Privacy Act 1988 (Australia) (2% coverage), Bahrain PDPL (2% coverage), Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) (2% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement Global Cross-Border Privacy Rules (Global CBPR) Forum?

Start your Global Cross-Border Privacy Rules (Global CBPR) Forum compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Global Cross-Border Privacy Rules (Global CBPR) Forum requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 75 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.

Get Started Free →

Free forever, no credit card required