Asia-Pacific Economic Cooperation (APEC). Data localisation / cross-border. Certification system
APEC CBPR / PRPAPEC Cross-Border Privacy Rules (CBPR) System and Privacy Recognition for Processors (PRP) System
Partly verified
Medium confidence.The years are from established references. I did not check whether APEC is winding down its own system in favour of the Global systems.
§1Summary
- Synopsis
Voluntary, enforceable certification schemes. CBPR certifies that a controller's privacy policies meet the APEC Privacy Framework, and PRP certifies a processor's ability to help controllers comply. Recognised Accountability Agents assess companies, and local privacy enforcement authorities back up enforcement.
- Key themes
- Unique features
It is one of the few certification-based transfer tools recognised by several national laws (e.g. Japan, Singapore).
- SaaS relevance
PRP is designed for SaaS and other processors, and CBPR or PRP certification can support transfers and customer due diligence in participating economies.
§2Obligations
- Breach notification
- None
- DPO
- No
- Cross-border transfers
- Certification-based transfer mechanism
- Maximum penalty
- Decertification; enforcement under local law
§3Dates
- Key dates
- Adopted
- In force
- CBPR endorsed by APEC Leaders in 2011, first certifications 2013; PRP launched 2015. Since 2022–25 the systems have been mirrored by the separately administered Global CBPR and Global PRP (see separate row).
§4Text and authority
- Text
- Authoritative text cbprs.org
- Authority
- Participating economies' privacy enforcement authorities; APEC-recognised Accountability Agents
§5Where it applies
- Members of the body
Membership-based — check ratification status. Membership of Asia-Pacific Economic Cooperation (APEC) does not mean a state has signed or ratified this instrument.
- Alabama
- Alaska
- Alberta
- Arizona
- Arkansas
- Australia
- Australian Capital Territory
- British Columbia
- Brunei
- California
- Canada
- Chile
- China
- Colorado
- Connecticut
- Delaware
- District of Columbia
- Florida
- Georgia
- Guam
- Hawaii
- Hong Kong
- Idaho
- Illinois
- Indiana
- Indonesia
- Iowa
- Japan
- Kansas
- Kentucky
- Louisiana
- Maine
- Malaysia
- Maryland
- Massachusetts
- Mexico
- Michigan
- Minnesota
- Mississippi
- Missouri
- Montana
- Nebraska
- Nevada
- New Brunswick
- New Hampshire
- New Jersey
- New Mexico
- New South Wales
- New York
- New Zealand
- Newfoundland and Labrador
- North Carolina
- North Dakota
- Northern Territory
- Nova Scotia
- Ohio
- Oklahoma
- Ontario
- Oregon
- Papua New Guinea
- Pennsylvania
- Peru
- Philippines
- Puerto Rico
- Quebec
- Queensland
- Rhode Island
- Russia
- Singapore
- South Australia
- South Carolina
- South Dakota
- South Korea
- Taiwan
- Tasmania
- Tennessee
- Texas
- Thailand
- United States
- US Virgin Islands
- Utah
- Vermont
- Victoria
- Vietnam
- Virginia
- Washington
- West Virginia
- Western Australia
- Wisconsin
- Wyoming
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.The years are from established references. I did not check whether APEC is winding down its own system in favour of the Global systems.