The Cross Border Privacy Rules (CBPR) System Goes Global
Published: May 28, 2025
In groundbreaking news, it was announced at the CBPR Forum held in Singapore this week that the Global CBPR System will officially go live on June 2nd, 2025.
This is an important update for those involved in international privacy as the CBPR system, focused on the privacy and security of personal data flowing cross-borders, finally expands its reach beyond the APEC member economies. The establishment of the Global CBPR System signals to privacy professionals that the system is looking to include additional jurisdictions as participants while increasing its exposure and applicability on a global scale.
How We Got Here: The History of the CBPR System
The APEC CBPR System was endorsed by APEC leaders in 2011 and was established as a set of requirements applicable to controllers, based on a privacy framework inspired by the Organization for Economic Cooperation and Development (OECD) guidelines on the Protection of Privacy and Transborder Flows of Personal Data. Over the years, nine of the APEC member economies joined the system, with five of those countries (Japan, Korea, Singapore, Chinese Taipei/Taiwan, and the United States) implementing the certification mechanism and operationalizing the system within their borders.
The system expanded in 2015 to include a set of requirements and an option for processors with the Privacy Recognition for Processors (PRP) certification. The APEC CBPR System (and CBPR and PRP Certifications) then experienced steady growth over the years but has been limited by design to the twenty-one APEC member economies.
Where We're Going: The Future of the Evolving Global CBPR System
With the announcement of the CBPR System going global, the scope of potential members increases exponentially. Since the founding of the Global CBPR Forum was announced in April 2022, multiple jurisdictions have been accepted as associates, including Bermuda, Dubai International Financial Centre, Mauritius, and the United Kingdom. In May 2025, Nigeria announced its intent to apply as the newest associate within the Global CBPR Forum as well. Jurisdictions may join as associates to become more familiar with the system and can begin to operationalize the system and certifications within their respective jurisdictions, including setting up government oversight, establishing accountability agents and/or acknowledging the system as a valid transfer mechanism, to become full members.
With the creation and establishment of the new Global CBPR System, most organizations will be transferring their certification from the existing APEC CBPR System. The good news is that the organizations certified under the original APEC CBPR System can be grandfathered into the new Global CBPR System. In order to ensure a smooth transition, minimum requirements will not be changing for the time-being, however, updated requirements may be on the horizon. As more jurisdictions join the system, minimum requirements for CBPR and/or PRP may need to be revised to align with a broader baseline of regulatory conditions.
If you would like more information about the Global CBPR System and certification process or requirements, please reach out to Schellman and our Privacy team will get in touch with you as soon as possible. You can also visit the below resources for additional insights on the system and benefits:
About Chris Lippert
Chris Lippert is a Director and Privacy Technical Lead with Schellman and is based in Atlanta, GA. With more than 10 years of experience in information assurance across numerous industries, regulations, and frameworks, Chris developed a passion for and concentration in data privacy. He is an active member of the International Association of Privacy Professionals (IAPP), holds his Fellow of Information Privacy (FIP) designation, and advocates for privacy by design and the adequate protection of personal data in today’s business world.