An Overview of CBPR and PRP Certification

Chris Lippert, Director of Schellman's Privacy Practice, is here to answer the most frequently asked questions surrounding Global CBPR and PRP Certification, including what it is, why it's important, who should adopt it, and how closely CBPR and PRP align with other privacy initiatives.  

What is CBPR and PRP Certification? 

The Cross-Border Privacy Rules (CBPR) and Privacy Recognition for Processors (PRP) frameworks are geared towards the protection of personal information, specifically as it flows across borders. It is a voluntary system established by participating jurisdictions and their respective governments who each have corresponding enforcement authority to make sure that participants are upholding the associated minimum requirements.  

The minimum requirements are split into CBPR and PRP to speak to the corresponding privacy roles of controller and processor. If your organization is collecting personal information directly from individuals and determining what to do with that information, CBPR would be the relevant minimum requirements for you. If your organization processes personal information on behalf of your customers, then the PRP minimum requirements would be a better fit. 

Why is CBPR/PRP Important? 

Countries and Jurisdictions across the globe are revamping their privacy legislation and it’s important to stay current with emerging privacy issues and to maintain a strong foundation and application of the core privacy principles. CBPR and PRP have been recognized as a system that upholds and highlights core privacy principles as it encourages the protected sharing of personal data across the globe to foster growth, knowledge, and progress across multiple industries.  

Benefits of CBPR and PRP Certification: 

In addition to establishing trusted cross-border data flows despite varying legislative requirements, the CBPR and PRP frameworks can benefit your organization in the following ways: 

• Increased operational readiness for incoming privacy inquiries 
• Enhanced preparedness to effectively respond to emerging privacy requirements 
• Improved data integrity, confidentiality, and availability 
• Cost savings through increased efficiency, effectiveness, and reduced regulatory fines 
• Certification seal to display for services in-scope for the certification 

Who Should Adopt CBPR and/or PRP? 

Organizations who are looking to expand their global footprint or are already operating internationally can find value in CBPR and/or PRP certification. The certification addresses core privacy concepts that are prevalent throughout modern day privacy legislation. Certain countries and jurisdictions, such as Japan, have even acknowledged the CBPR system as a valid transfer mechanism under privacy law, which can remove some barriers to entry for organizations looking to do business in participating jurisdictions.  

How Closely Do CBPR/PRP Align with Other Compliance Initiatives? 

The CBPR and PRP certification overlap almost completely with ISO 27701, which serves as a similar international privacy certification. Like ISO 27701, CBPR and PRP look at the controls in place for the organizations' respective privacy role(s). Both frameworks ensure that the organization has a good foundation on which to operate its data privacy program and can seamlessly adapt to new privacy legislation requirements. Clients often pursue compliance efforts against ISO 27701 and CBPR/PRP in tandem to increase efficiencies and reduce compliance redundancies and burdens on relevant teams.  

The core privacy principles are also addressed in a SOC 2 examination, making a SOC 2 Report, within the privacy category, a strong starting point for CBPR/PRP certification as most of the controls can be leveraged. If your organization has previously undergone compliance efforts that focus on security and privacy, there is a strong chance you won't be starting from scratch for your CBPR or PRP assessment. 

If you’re ready to proceed with CBPR and PRP Certification or have additional questions about the requirements or process, Schellman can help. Contact us today and we’ll get back to you shortly. In the meantime, discover additional helpful insights in these resources:  

• The Cross Border Privacy Rules (CBPR) System Goes Global 
• The Benefits of an APEC CBPR/PRP Certification for Your Organization