APEC Cross-Border Privacy Rules (CBPR) System

Asia-Pacific (APEC)

v2011 (updated)

17 domains

59 controls

The APEC Cross-Border Privacy Rules (CBPR) System is a voluntary accountability-based framework for facilitating cross-border data flows among APEC economies while protecting personal information. Participating companies self-certify compliance with programme requirements, verified by APEC-recognised accountability agents. Based on the APEC Privacy Framework. Participating economies include US, Japan, Canada, South Korea, Australia, Singapore, and others. Being transitioned to the Global CBPR Forum.

Verified

APEC Cross-Border Privacy Rules (CBPR) System is a compliance framework from Asia-Pacific (APEC) with 17 domains and 59 controls that map to 20 other frameworks. The largest domains are CBPR Program Requirements: Accountability (12 controls), CBPR Program Requirements: Security Safeguards (10 controls), CBPR Program Requirements: Choice (7 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026Published standard

Get the official standard — this page is an AI-assisted companion tool, not a replacement for the authoritative text.

Visit cbprs.org

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (17)

CBPR Program Requirements: Access and Correction

3 controls

Controls in the CBPR Program Requirements: Access and Correction domain of APEC Cross-Border Privacy Rules (CBPR) System — 3 controls
Code	Title	Description
CBPR-PR-36	Confirmation of holding	On request, the applicant confirms whether or not it holds personal information about the requesting individual.
CBPR-PR-37	Access to personal information	On request, the applicant provides individuals with access to the personal information it holds about them, within a rea...
CBPR-PR-38	Challenge and rectification	The applicant permits individuals to challenge the accuracy of their information and to have it rectified, completed, am...

CBPR Program Requirements: Accountability

12 controls

Controls in the CBPR Program Requirements: Accountability domain of APEC Cross-Border Privacy Rules (CBPR) System — 12 controls
Code	Title	Description
CBPR-PR-39	Measures to ensure compliance	The applicant maintains measures to ensure compliance with the APEC Information Privacy Principles, such as internal gui...
CBPR-PR-40	Responsible individual appointed	The applicant has appointed an individual or individuals responsible for its overall compliance with its privacy policie...
CBPR-PR-41	Complaint handling procedures	The applicant has procedures to receive, investigate and respond to privacy-related complaints.
CBPR-PR-42	Timely complaint response	The applicant has procedures to ensure individuals receive a timely response to their complaints.
CBPR-PR-43	Remedial action explained	Responses to complaints include an explanation of the remedial action relating to the complaint.
CBPR-PR-44	Employee privacy training	The applicant has procedures for training employees on its privacy policies and procedures.
CBPR-PR-45	Response to legal demands	The applicant has procedures for responding to judicial or other government subpoenas, warrants or orders, including tho...
CBPR-PR-46	Mechanisms with processors to meet obligations	The applicant has mechanisms with processors, agents, contractors and other service providers, covering the personal inf...
CBPR-PR-47	Processor agreement content	The agreements with processors, agents, contractors and other service providers generally require them to act consistent...
CBPR-PR-48	Processor self-assessments	The applicant requires processors, agents, contractors and other service providers to provide self-assessments confirmin...
CBPR-PR-49	Spot checking and monitoring of processors	The applicant carries out regular spot checking or monitoring of processors, agents, contractors and other service provi...
CBPR-PR-50	Disclosure where due diligence is impractical	Where due diligence and reasonable steps to ensure the recipient's compliance are impractical or impossible, the applica...

CBPR Program Requirements: Choice

7 controls

Controls in the CBPR Program Requirements: Choice domain of APEC Cross-Border Privacy Rules (CBPR) System — 7 controls
Code	Title	Description
CBPR-PR-14	Choice over collection	The applicant provides a mechanism for individuals to exercise choice in relation to the collection of their personal in...
CBPR-PR-15	Choice over use	The applicant provides a mechanism for individuals to exercise choice in relation to the use of their personal informati...
CBPR-PR-16	Choice over disclosure	The applicant provides a mechanism for individuals to exercise choice in relation to the disclosure of their personal in...
CBPR-PR-17	Choices clear and conspicuous	Where choices are offered over collection, use or disclosure, they are displayed or provided in a clear and conspicuous...
CBPR-PR-18	Choices clearly worded	Where choices are offered, they are clearly worded and easily understandable.
CBPR-PR-19	Choices accessible and affordable	Where choices are offered, they are easily accessible and affordable to the individual.
CBPR-PR-20	Mechanisms to honour choices	The applicant has mechanisms so that choices, where appropriate, can be honoured in an effective and expeditious manner.

CBPR Program Requirements: Collection Limitation

3 controls

Controls in the CBPR Program Requirements: Collection Limitation domain of APEC Cross-Border Privacy Rules (CBPR) System — 3 controls
Code	Title	Description
CBPR-PR-05	Collection methods identified	The applicant identifies how it obtains personal information, whether directly from the individual or from third parties...
CBPR-PR-06	Collection limited to relevant information	The applicant limits collection to information relevant to the purposes for which it is collected or to other compatible...
CBPR-PR-07	Lawful and fair collection	The applicant collects personal information by lawful and fair means consistent with the requirements of the jurisdictio...

CBPR Program Requirements: Integrity of Personal Information

5 controls

Controls in the CBPR Program Requirements: Integrity of Personal Information domain of APEC Cross-Border Privacy Rules (CBPR) System — 5 controls
Code	Title	Description
CBPR-PR-21	Accuracy verification	The applicant takes steps to verify that the personal information it holds is up to date, accurate and complete to the e...
CBPR-PR-22	Correction mechanism	The applicant has a mechanism for correcting inaccurate, incomplete and out of date personal information to the extent n...
CBPR-PR-23	Corrections communicated after transfer	Where corrections are made after the information has been transferred, and the inaccuracy affects the purposes of use, t...
CBPR-PR-24	Corrections communicated after disclosure	Where corrections are made after the information has been disclosed, and the inaccuracy affects the purposes of use, the...
CBPR-PR-25	Processor obligation to report data quality issues	The applicant requires processors, agents and other service providers acting on its behalf to inform it when they become...

CBPR Program Requirements: Notice

4 controls

Controls in the CBPR Program Requirements: Notice domain of APEC Cross-Border Privacy Rules (CBPR) System — 4 controls
Code	Title	Description
CBPR-PR-01	Privacy statement published	The applicant publishes clear and easily accessible statements of the practices and policies governing the personal info...
CBPR-PR-02	Notice at the time of collection	The applicant gives notice that personal information is being collected at the time of collection, whether it collects d...
CBPR-PR-03	Purposes stated at collection	The applicant states at the time of collection the purposes for which the personal information is being collected.
CBPR-PR-04	Notice of sharing with third parties	The applicant notifies individuals at the time of collection that their personal information will be or may be shared wi...

CBPR Program Requirements: Security Safeguards

10 controls

Controls in the CBPR Program Requirements: Security Safeguards domain of APEC Cross-Border Privacy Rules (CBPR) System — 10 controls
Code	Title	Description
CBPR-PR-26	Information security policy	The applicant has implemented an information security policy.
CBPR-PR-27	Physical, technical and administrative safeguards	The applicant has implemented physical, technical and administrative safeguards protecting personal information against...
CBPR-PR-28	Safeguards proportional to risk	The applicant can show that its safeguards are proportional to the likelihood and severity of the harm threatened, the s...
CBPR-PR-29	Employee security awareness	The applicant makes employees aware of the importance of maintaining the security of personal information, for example t...
CBPR-PR-30	Specific proportional safeguards in place	The applicant has implemented the specific safeguards the programme requirements enumerate, proportional to the likeliho...
CBPR-PR-31	Secure disposal policy	The applicant has implemented a policy for the secure disposal of personal information.
CBPR-PR-32	Detection, prevention and response measures	The applicant has implemented measures to detect, prevent and respond to attacks, intrusions and other security failures...
CBPR-PR-33	Testing the effectiveness of safeguards	The applicant has processes to test the effectiveness of the detection, prevention and response measures it has implemen...
CBPR-PR-34	Risk assessments and third party certifications	The applicant uses risk assessments or third party certifications in support of its security safeguards.
CBPR-PR-35	Processor protection obligations	The applicant requires processors, agents, contractors and other service providers to whom it transfers personal informa...

CBPR Program Requirements: Uses of Personal Information

6 controls

Controls in the CBPR Program Requirements: Uses of Personal Information domain of APEC Cross-Border Privacy Rules (CBPR) System — 6 controls
Code	Title	Description
CBPR-PR-08	Use limited to stated purposes	The applicant limits use of the personal information it collects to the purposes identified in its privacy statement or...
CBPR-PR-09	Grounds for unrelated use	Where the applicant uses personal information for unrelated purposes, it does so only on a permitted ground such as expr...
CBPR-PR-10	Disclosure to other controllers identified	The applicant identifies whether it discloses the personal information it collects to other personal information control...
CBPR-PR-11	Transfers to processors identified	The applicant identifies whether it transfers personal information to personal information processors.
CBPR-PR-12	Disclosure consistent with original purpose	Disclosures and transfers are undertaken to fulfil the original purpose of collection or another compatible or related p...
CBPR-PR-13	Grounds for other disclosure	Where a disclosure or transfer does not fulfil the original or a compatible purpose, it takes place only under a permitt...

Consent

1 controls

Controls in the Consent domain of APEC Cross-Border Privacy Rules (CBPR) System — 1 controls
Code	Title	Description
CBPR-04	Choice	Provide clear, prominent, accessible, and affordable mechanisms for individuals to exercise choice over collection, use,...

Data Minimization

1 controls

Controls in the Data Minimization domain of APEC Cross-Border Privacy Rules (CBPR) System — 1 controls
Code	Title	Description
CBPR-02	Collection Limitation	Limit collection of personal information to what is relevant to identified purposes and obtain it by lawful and fair mea...

Data Quality

1 controls

Controls in the Data Quality domain of APEC Cross-Border Privacy Rules (CBPR) System — 1 controls
Code	Title	Description
CBPR-05	Integrity of Personal Information	Maintain personal information that is accurate, complete, and kept up to date to the extent necessary for purposes of us...

Governance

1 controls

Controls in the Governance domain of APEC Cross-Border Privacy Rules (CBPR) System — 1 controls
Code	Title	Description
CBPR-08	Accountability	Be accountable for complying with measures that give effect to privacy principles and for onward transfers to other pers...

Individual Rights

1 controls

Controls in the Individual Rights domain of APEC Cross-Border Privacy Rules (CBPR) System — 1 controls
Code	Title	Description
CBPR-07	Access and Correction	Provide individuals reasonable ability to access, confirm, challenge accuracy, and obtain correction or deletion of thei...

Purpose Limitation

1 controls

Controls in the Purpose Limitation domain of APEC Cross-Border Privacy Rules (CBPR) System — 1 controls
Code	Title	Description
CBPR-03	Uses of Personal Information	Use personal information only for purposes of collection or compatible/related purposes, except with consent or as autho...

Risk

1 controls

Controls in the Risk domain of APEC Cross-Border Privacy Rules (CBPR) System — 1 controls
Code	Title	Description
CBPR-09	Preventing Harm	Design protections to prevent misuse of personal information taking into account risks of harm to individuals.

Security

1 controls

Controls in the Security domain of APEC Cross-Border Privacy Rules (CBPR) System — 1 controls
Code	Title	Description
CBPR-06	Security Safeguards	Protect personal information with reasonable safeguards proportionate to likelihood and severity of harm, sensitivity, a...

Transparency

1 controls

Controls in the Transparency domain of APEC Cross-Border Privacy Rules (CBPR) System — 1 controls
Code	Title	Description
CBPR-01	Notice	Provide clear, accessible notice describing personal information practices including collection, use, disclosure, and ch...

Your Compliance Coverage

If you comply with APEC Cross-Border Privacy Rules (CBPR) System, you already cover:

GDPR

100%

59 controls mapped

Compare →

ISO 27701:2019

92%

54 controls mapped

Compare →

APPI

85%

50 controls mapped

Compare →

+ 17 more: Australia Consumer Data Right - Banking (CDR) (76%), Australian Privacy Principles (APPs) (75%)

See all 20 mapped frameworks ↓

Maps to 20 other frameworks

59 total controls

GDPR

59 source controls mapped|28 target controls covered

100%

ISO 27701:2019

54 source controls mapped|39 target controls covered

92%

APPI

50 source controls mapped|23 target controls covered

85%

Australia Consumer Data Right - Banking (CDR)

45 source controls mapped|23 target controls covered

76%

Australian Privacy Principles (APPs)

44 source controls mapped|11 target controls covered

75%

CCPA/CPRA

40 source controls mapped|24 target controls covered

68%

SOC 2

36 source controls mapped|15 target controls covered

61%

NIST SP 800-53 Rev 5

35 source controls mapped|18 target controls covered

59%

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1

34 source controls mapped|41 target controls covered

58%

NIST SP 800-161 Rev 1

33 source controls mapped|35 target controls covered

56%

Australia My Health Records Act 2012

29 source controls mapped|17 target controls covered

49%

C5 (Germany)

20 source controls mapped|33 target controls covered

34%

NIST SP 800-53 Rev 5 MODERATE

20 source controls mapped|31 target controls covered

34%

FedRAMP Moderate

20 source controls mapped|33 target controls covered

34%

NIST SP 800-53 Revision 5.1 HIGH

20 source controls mapped|32 target controls covered

34%

FedRAMP High

20 source controls mapped|33 target controls covered

34%

NIST SP 800-53 Rev 5 LOW

18 source controls mapped|25 target controls covered

31%

HIPAA Security Rule

17 source controls mapped|22 target controls covered

29%

NIST SP 800-66 Rev 2

17 source controls mapped|20 target controls covered

29%

Azure Security Benchmark

10 source controls mapped|21 target controls covered

17%

Compare APEC Cross-Border Privacy Rules (CBPR) System with GDPR

What is APEC Cross-Border Privacy Rules (CBPR) System and who does it apply to?

APEC Cross-Border Privacy Rules (CBPR) System is a compliance framework from Asia-Pacific (APEC) with 17 domains and 59 controls. The APEC Cross-Border Privacy Rules (CBPR) System is a voluntary accountability-based framework for facilitating cross-border data flows among APEC economies while protecting personal information. Participating companies self-certify compliance with programme requirements, verified by APEC-recognised accountability agents. Based on the APEC Privacy Framework. Participating economies include US, Japan, Canada, South Korea, Australia, Singapore, and others. Being transitioned to the Global CBPR Forum. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does APEC Cross-Border Privacy Rules (CBPR) System actually require?

APEC Cross-Border Privacy Rules (CBPR) System has 59 controls organised across 17 domains. The largest domains are CBPR Program Requirements: Accountability (12 controls), CBPR Program Requirements: Security Safeguards (10 controls), CBPR Program Requirements: Choice (7 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of APEC Cross-Border Privacy Rules (CBPR) System do I already cover?

APEC Cross-Border Privacy Rules (CBPR) System maps to 20 other compliance frameworks. The top mapping partners are GDPR (100% coverage), ISO 27701:2019 (92% coverage), APPI (85% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement APEC Cross-Border Privacy Rules (CBPR) System?

Start your APEC Cross-Border Privacy Rules (CBPR) System compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about APEC Cross-Border Privacy Rules (CBPR) System requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 59 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 686 frameworks.

Get Started Free →

Free forever — no credit card required