Global Cross-Border Privacy Rules Forum. Data localisation / cross-border. Certification system
Global CBPR / Global PRPGlobal Cross-Border Privacy Rules (Global CBPR) and Global Privacy Recognition for Processors (Global PRP) Systems
Partly verified
Medium confidence.The exact go-live day in 2025 is unclear (late May or early June 2025). The founding members are understood to be the US, Canada, Japan, Korea, Singapore, the Philippines and Chinese Taipei, but I did not open the membership page.
§1Summary
- Synopsis
An international certification system that takes the APEC CBPR and PRP model outside APEC, open to any jurisdiction that joins the Forum. Companies are certified by Forum-recognised Accountability Agents against Global CBPR (controller) or Global PRP (processor) requirements.
- Key themes
- Unique features
The Forum is independent of APEC. Its systems started out the same as APEC's but are expected to diverge over time, and it admits non-APEC Associates such as the UK, Bermuda, DIFC and Mauritius.
- SaaS relevance
A SaaS provider acting as processor can get Global PRP certification to show baseline controls to customers in member jurisdictions.
§2Obligations
- Breach notification
- None
- DPO
- No
- Cross-border transfers
- Certification-based transfer mechanism
- Maximum penalty
- Decertification; enforcement under local law
§3Dates
- Key dates
- Adopted
- In force
- Global CBPR Forum declaration April 2022; the Global CBPR and Global PRP certifications launched in 2025 (Forum news items dated 2025-05-28 and 2025-06-09 announce launch and 'now live')
§4Text and authority
- Text
- Authoritative text globalcbpr.org
- Authority
- Global CBPR Forum; Accountability Agents
§5Where it applies
- Members of the body
Membership-based — check ratification status. Membership of Global Cross-Border Privacy Rules Forum does not mean a state has signed or ratified this instrument.
- Alabama
- Alaska
- Alberta
- Arizona
- Arkansas
- Australia
- Australian Capital Territory
- British Columbia
- California
- Canada
- Colorado
- Connecticut
- Delaware
- District of Columbia
- Dubai International Financial Centre
- Florida
- Georgia
- Guam
- Hawaii
- Idaho
- Illinois
- Indiana
- Iowa
- Japan
- Kansas
- Kentucky
- Louisiana
- Maine
- Maryland
- Massachusetts
- Mexico
- Michigan
- Minnesota
- Mississippi
- Missouri
- Montana
- Nebraska
- Nevada
- New Brunswick
- New Hampshire
- New Jersey
- New Mexico
- New South Wales
- New York
- Newfoundland and Labrador
- North Carolina
- North Dakota
- Northern Territory
- Nova Scotia
- Ohio
- Oklahoma
- Ontario
- Oregon
- Pennsylvania
- Philippines
- Puerto Rico
- Quebec
- Queensland
- Rhode Island
- Singapore
- South Australia
- South Carolina
- South Dakota
- South Korea
- Taiwan
- Tasmania
- Tennessee
- Texas
- United States
- US Virgin Islands
- Utah
- Vermont
- Victoria
- Virginia
- Washington
- West Virginia
- Western Australia
- Wisconsin
- Wyoming
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.The exact go-live day in 2025 is unclear (late May or early June 2025). The founding members are understood to be the US, Canada, Japan, Korea, Singapore, the Philippines and Chinese Taipei, but I did not open the membership page.