GLOBAL CROSS-BORDER PRIVACYRULES (CBPR) FRAMEWORK (2023)

CONTENTSPart I.

PreamblePart II.

Scope

Part III.

Global CBPR Privacy Principles

Part IV.

Implementation
Part A. Domestic Implementation
Part B. International Implementation

Page 1 of 28

GLOBAL CROSS-BORDER PRIVACY RULES (CBPR) FRAMEWORKPart I. Preamble
Recognising that growing Internet connectivity and the digitisation of the global economy
have resulted in the rapid increase in the collection, use, and transfer of data across borders,a trend that continues to accelerate;
Conscious that trusted cross-border data flows are indispensable – not just for big,
multinational technology companies, but for companies across all sectors of the economy,and for micro, small- and medium-sized businesses, workers, and consumers as well;
Believing that cross-border data flows increase living standards, create jobs, connect people
in meaningful ways, facilitate vital research and development in support of public health,foster innovation and entrepreneurship, and allow for greater international engagement;
Acknowledging that regulatory barriers threaten to undermine opportunities created by thedigital economy at a time when companies are relying increasingly on digital technologies andinnovations to continue business operations and recover economically;
Recognising the importance of strong and effective data protection and privacy instrengthening consumer and business trust in digital transactions;Acknowledging the important contribution made by the Asia-Pacific Economic Cooperation(APEC) in developing the APEC CBPR System to foster cross-border data flows andinteroperability;
1. This Framework is based on the APEC Privacy Framework and is consistent with thecore principles of the OECD’s Guidelines on the Protection of Privacy and Trans-Border
Flows of Personal Data (OECD Guidelines).
2. The Framework specifically addresses the importance of protecting personal
information and privacy while maintaining information flows. Its practical anddistinctive approach is to focus attention on consistent rather than identical
approaches to data protection and privacy. In so doing, it seeks to reconcile dataprotection and privacy with business and societal needs and commercial interests, andat the same time, accords due recognition to cultural and other diversities that exist
within Members.
3. The Framework is intended to inform the interpretation of the Global Cross-Border
Privacy Rules (CBPR) and Global Privacy Recognition for Processors (PRP) Systems
program requirements that were developed based on the nine Global CBPR Privacy
Principles.
4. Global CBPR Forum Members, acknowledging the Framework as an important tool in
encouraging the development of appropriate data protection and privacy
approaches and enabling trust in cross-border flows of personal data, should review
Page 2 of 28

the Global CBPR and Global PRP Systems program requirements periodically so that
the Global CBPR Forum can continue to effectively promote data protection practices
which facilitate cross-border data flows globally.

Page 3 of 28

Part II. Scope
5. The purpose of Part II of the Global CBPR Framework is to make clear the extent ofcoverage of the Global CBPR Privacy Principles contained in Part III of this Framework.
CORE DEFINITIONSCOMMENTARY

6. Personal information means any
information about an identified
or identifiable individual.

6. The Framework is intended to apply to
information about natural living persons,not legal persons. The Framework applies
to personal information, which isinformation that can be used to identify anindividual. It also includes information thatwould not meet this criterion alone, butwhen put together with other information
would identify an individual. For example,
certain types of metadata, whenaggregated,canrevealpersonal
information and can give an insight into anindividual’s behavior, social relationships,
private preferences and identity.

7. Personal information controllermeans a person or organization
who controls the collection,
holding,
processing,use,
disclosure or transfer of personal
information. It includes a personor organization who instructs
another person or organization
to collect, hold, process, use,transfer or disclose personal
information on his or her behalf,
but excludes a person ororganization who performs suchfunctions as instructed byanother person or organization.
It also excludes an individual who
collects, holds, processes or uses
personal
informationinconnection with the individual’s
personal, family or household
affairs.

7. The Framework applies to persons ororganizations in the public and private
sectors who control the collection,
holding, processing, use, transfer ordisclosure of personal information. For the
purposes of the Framework, where aperson or organization instructs anotherperson or organization to collect, hold,use, process, transfer or disclose personal
information on its behalf, the instructing
person or organization is the personal
information controller and is responsible
for ensuring compliance with the Global
CBPR Privacy Principles.
Individuals will often collect, hold and use
personal information for personal, family
or household purposes. For example, theyoften keep address books and phone lists
or prepare family newsletters. The
Framework is not intended to apply tosuch personal, family or household
activities.
Page 4 of 28

8. Publicly available information 8. The Framework has limited application tomeans personal information
publicly available information. Notice andabout an individual that the
choice requirements, in particular, often
individual knowingly makes orare superfluous where the information ispermits to be made available toalready publicly available, and thethe public, or that is legally
personal information controller does not
obtained and accessed from:collect the information directly from theindividual concerned. Publicly availablea) government records that are
information may be contained inavailable to the public;
government records that are available tothe public, such as registers of people whob) journalistic reports; orare entitled to vote, or in news items
broadcast or published by the news media.
c) information required by law
to be made available to the
public.
ADDITIONAL DEFINITIONS
9. Data Protection and Privacy Laws 9. Data Protection and Privacy Laws come inmeans laws and regulations of aa variety of forms. Some are general
Member, the enforcement ofprivacy or data protection statutes while
which have the effect ofothers take a sectoral approach covering
protecting personal information
particular areas such as credit reporting or
consistent with the Global CBPR
health information. In some cases, theFramework.
relevant legal provisions are contained
within broader laws dealing with such
issues as telecommunications or consumer
protection. It is not important for the
purposes of the definition what the laws
are called: it is the effect of the laws thatmatters.
10.
Global CBPR System is the 10. The Global CBPR System is a voluntaryabbreviation of the Global Crossaccountability-based scheme to facilitate
Border Privacy Rules System.
data protection- and privacy-respecting
personal information flows acrossjurisdictions. It has four main components:•

set criteria for bodies to become
recognised as Global CBPR Forum
Accountability Agents;•

a process for personal information
controllers to be certified as Global
Page 5 of 28

CBPR
System-compliant
byrecognized Accountability Agent;a•assessment criteria for use byrecognised Accountability Agents
when reviewing whether a controller
meets Global CBPR System program
requirements; and•arrangements for enforcing Global
CBPR System program requirements
throughcomplaints
processes
provided by recognised Accountability
Agents backed up by a Privacy
Enforcement Authority that is aparticipant in the Global Cooperation
Arrangement for Privacy Enforcement("Global CAPE").

11. Global PRP System is the 11. The Global PRP System represents theabbreviation of the Global Privacy
baseline requirements a personal
Recognition
forProcessors
information processor must meet in order
System.
to be recognized by an approved
Accountability Agent and provide
assurances with respect to the processor's
data protection and privacy policies andpractices. The Global PRP System helps
processors to demonstrate their ability toprovide effective implementation of apersonal information controller’s dataprotection and privacy obligations related
to the processing of personal information.
12. Privacy Enforcement Authority 12. A Privacy Enforcement Authority is a publicmeans any public body that isbody that is responsible for enforcing Data
responsible for enforcing Data
Protection and Privacy Laws. It has powers
Protection and Privacy Laws, andto conduct investigations and/or pursuethat has powers to conduct
enforcement proceedings. A member may
investigations and/or pursue
have more than one Privacy Enforcement
enforcement proceedings.
Authority.
13. Global CAPE is the abbreviation of 13. The Global CAPE is a multilateral
theGlobalCooperation
mechanism which enables Privacy
Arrangementfor
Privacy
Enforcement Authorities to cooperate in
Enforcement which is a practicalcross-border enforcement of Data
multilateral mechanism which
Protection and Privacy Laws. Any Privacy
Page 6 of 28

enables Privacy Enforcement
Authorities to cooperate in crossborder data protection andprivacy enforcement by creating aframework
under
which
authorities may, on a voluntarybasis, share information andrequest and render assistance in
certain ways.

Enforcement Authority may participate.
The Global CAPE aims to:a) facilitate information sharing among
participating Privacy Enforcement
Authorities;b) provide mechanisms to promote
effective cross-border cooperation
betweenPrivacy
Enforcement
Authorities in the enforcement of
Data Protection and Privacy Laws; andc) encourage information sharing andcooperation on data protection andprivacy investigation and enforcementwith privacy enforcement authorities
not participating in the Global CAPE.

APPLICATION
14. In view of the differences in social, 14. Although it is not essential for electronic
cultural, economic and legal
commerce that all laws and practices bebackgrounds of each Member,
identical, compatible approaches to data
there should be flexibility inprotection and privacy among Members
implementing the Global CBPR
will greatly facilitate international
Privacy Principles.
commerce and privacy enforcement
cooperation. Nonetheless, the Framework
recognizes the need also to take into
account social, cultural and other
differences among Members.
15. Exceptions to the Global CBPR 15. Members implementing the Framework at
Privacy Principles, including thosea domestic level may adopt suitable
relating to national sovereignty,
exceptions that suit their particularnational security, public safety anddomestic circumstances.
public policy, should be:
While recognizing the importance ofa) limited and proportional togovernmental respect for data protection
meeting the objectives toand privacy, the Framework is notwhich the exceptions relate;intended to impede governmental actions
andauthorized by law when taken to protect
national security, public safety, nationalb) (i) made known to the public;
sovereignty or achieve other importantorpublic policy objectives. Nonetheless,Members should endeavor to ensure that
Page 7 of 28

(ii) in accordance with law.

the impact of these activities upon therights, responsibilities and legitimate
interests of individuals and organizations is
as limited as possible.

Page 8 of 28

Part III.

Global CBPR Privacy Principles

16. The Global CBPR Privacy Principles should be read as a whole rather than as individual
principles as they are inter-related.1
PRINCIPLESI.

COMMENTARY

Preventing Harm

17. Recognizing the interests of the 17. This Principle recognizes that one of theindividual
tolegitimate
primary objectives of the Framework is to
expectations of data protection
prevent misuse of personal informationand privacy, personal informationand consequent harm to individuals.
protection should be designed to
Therefore, data protection and privacy
prevent the misuse of suchapproaches, including self-regulatory
information.
Further,efforts, education and awarenessacknowledging the risk that harm
campaigns, laws, regulations, andmay result from such misuse ofenforcement mechanisms, should bepersonal information, specificdesigned to prevent harm to individuals
obligations should take account offrom the wrongful collection and misuse
such risk, and remedial measuresof their personal information.
should be proportionate to thelikelihood and severity of the harmHence, organizational controls should bethreatened by the collection, use
designed to prevent harms resulting fromandtransferofpersonal
the wrongful collection or misuse of
information.
personal information, and should be
proportionate to the likelihood andseverity of any harm threatened by thecollection, use or transfer of personal
information.
Where there has been a significant
security breach affecting personal
information, it may help to reduce therisk of harmful consequences to theindividuals concerned to give notice toPrivacy Enforcement Authorities and/or
the individuals concerned.

1

There may be some minor inconsistency in language usage between principles (e.g. in relation to how the
principles describe the use of personal information). Unless, the context suggests otherwise, ‘use’ of personal
information should be considered to include collection, holding, processing, use, disclosure or transfer of personal
information.

Page 9 of 28

II. Notice

18. Personal information controllers 18-20. This Principle is directed towards
should provide clear and easily
ensuring that individuals are able toaccessible statements about theirknow what information is collected
practices and policies with respect
about them and for what purpose it isto personal information that should
to be used. By providing notice,include:personal information controllers may
enable an individual to make a morea) thefact
thatpersonal
informed decision about interacting
information is being collected;
with the organization.
b) the purposes for which
personal
informationiscollected;c) the types of persons ororganizations
towhom
personal information might bedisclosed;d) the identity and location of thepersonal
information
controller,
includinginformation on how to contact
them about their practices andhandlingof
personal
information;e) the choices and means the
personal information controller
offers individuals for limiting
the use and disclosure of, andfor accessing and correcting,their personal information.
19. All reasonably practicable steps shallbe taken to ensure that such notice isprovided either before or at the timeof collection of personal information.
Otherwise, such notice should be
provided as soon after as ispracticable.
20. It may not be appropriate for
personal information controllers to

Depending on the context in which thepersonal information is collected,
notice may be provided using various
methods. For example, one common
method of compliance with thisPrinciple is for personal information
controllers to post notices on theirwebsites. Where organizations engage
individuals in offline settings, such as inperson or via the telephone, posted or
written notices or telephone scripts
may be used. In other situations,placement of notices on intranet sites
or in employee handbooks, forexample, may be appropriate. There
are practical challenges to giving noticein the mobile context. To provide
notice on small screens, personal
information controllers may want toconsider the value of standard notices,
icons, or other measures.
Organizations should inform relevant
individuals at the time of, or before,
information is collected about them. At
the same time, the Principle also
recognizes
that
there
are
circumstances in which it would not bepracticable to give notice at or before
the time of collection, such as in somecases where digital technology
automatically collects information
when a prospective customer initiates
contact, as is often the case with thePage 10 of 28

provide notice regarding thecollection and use of publicly
available information.

use of cookies.
Moreover, where personal information
is not obtained directly from theindividual, but from a third party, it
may not be practicable to give notice ator before the time of collection of theinformation. For example, when an
insurancecompany
collects
employees’ information from an
employer in order to provide medical
insurance services, it may not bepracticable for the insurance company
to give notice at or before the time ofcollection of the employees’ personal
information.
Additionally, there are situations inwhich it would not be necessary toprovide notice, such as in the collection
and use of publicly available
information, or of business contact
information and other professional
information
that
identifies
anindividual in his or her professional
capacity in a business context. For
example, if an individual gives his or her
business card to another individual in
the context of a business relationship,
the individual would not expect to begiven notice regarding the collection
and normal use of that information for
expected business purposes.
Further, if colleagues who work for thesame company as an individual were toprovide the individual’s businesscontact information to potential
customers of that company, theindividual would not have an
expectation that notice would be
provided regarding the transfer or the
expected use of that information.

Page 11 of 28

III. Collection Limitation

21. Thecollectionofpersonal 21. This Principle limits collection of
information should be limited topersonal information by reference toinformation that is relevant to thethe purposes for which it is collected.
purposes of collection and any such
The collection of the personal
information should be obtained byinformation should be relevant to suchlawful and fair means, and where
purposes,andnecessity
andappropriate, with notice to, or
proportionality to the fulfillment ofconsentof,theindividualsuch purposes may be factors inconcerned.
determining what is relevant.
This Principle also provides thatcollection methods must be lawful andfair. For example, obtaining personal
information under false pretenses(e.g., where an organization uses
phishing, telemarketing calls, orpretexting emails to fraudulently
misrepresent itself as anothercompany in order to deceive
consumers and induce them to disclose
their credit card numbers, bankaccount information or other sensitive
personal information) may in many
Members be considered unlawful.
Therefore, even in those Members
where there is no explicit law against
these specific methods of collection,
they may be considered to be unfair
means of collection.
The Principle also recognizes that there
are circumstances where providing
notice to, or obtaining consent of,individuals would be inappropriate.
For example, in a situation where there
is an outbreak of food poisoning, it
would be appropriate for the relevant
health authorities to collect thepersonal information of patrons fromrestaurants without providing notice toor obtaining the consent of individuals
in order to inform them of thepotential health risk.
Page 12 of 28

IV. Uses of Personal Information

22. Personal information collected 22. This Principle limits the use of personal
should be used only to fulfill theinformation to fulfilling the purposes of
purposes of collection and othercollection and other compatible orcompatible or related purposes
related purposes. For the purposes of
except:this Principle, “uses of personal
information” includes the transfer ora) with the consent of the individual
disclosure of personal information.
whose personal information iscollected;
Application of this Principle requiresconsideration of the nature of theb) when necessary to provide a
personal information, the context ofservice or product requested bycollection,
theindividual’s
the individual; or,
expectations and the intended use of
the information. The fundamentalc) by the authority of law and othercriterion in determining whether alegal instruments, proclamations
purpose is compatible with or related
and pronouncements of legal
to the stated purposes is whether theeffect.
extended usage stems from or is infurtherance of such purposes. The useof
personal
information
for“compatible or related purposes”
would extend, for example, to matterssuch as the creation and use of acentralized database to manage
personnel in an effective and efficientmanner; the processing of employee
payrolls by a third party; or, the use of
informationcollected
byanorganization for the purpose of
granting credit for the subsequent
purpose of collecting debt owed to thatorganization.

V. Choice

23. Where appropriate, individuals 23. The general purpose of the Choiceshould be provided with clear,
Principle is to ensure that individuals
prominent, easily understandable,
are provided with choice in relation toaccessible
andaffordable
collection, use transfer and disclosure
mechanisms to exercise choice inof their personal information. Whether
relation to the collection, use andthe choice is conveyed electronically, indisclosure of their personal
writing or by other means, notice of
information. It may not besuch choice should be clearly worded
Page 13 of 28

appropriate
forpersonal
information controllers to provide
these mechanisms when collecting
publicly available information.

anddisplayed
clearly
andconspicuously. The mechanisms forexercising choice should be accessible
and affordable to individuals. Ease ofaccess and convenience are factorsthat should be taken into account.
Where an organization provides
information on available mechanisms
for exercising choice, consideration
should be given to tailoring theinformation and the way it is conveyed
to
make
it
more
“easily
understandable” to particular groups
of individuals (e.g., by providing
explanations in relevant languages, if
the information is aimed at children, inways that are age- appropriate).
This Principle also recognizes, throughthe introductory words “whereappropriate”, that there are certain
situations where it would not benecessary to provide a mechanism to
exercise choice.
In many situations it would not benecessary or practicable to provide amechanism to exercise choice whencollecting
publicly
available
information. For example, it would not
be necessary to provide a mechanism
to exercise choice to individuals whencollecting their name and address froma public record or a newspaper.
In specific and limited circumstances, itwould not be necessary or practicableto provide a mechanism to exercise
choice when collecting, using,transferring or disclosing other types of
information. For example, whenbusiness contact information or otherprofessional information that identifies
an individual in his or her professional
capacity is being exchanged in a
Page 14 of 28

business context, it is generally
impractical or unnecessary to provide amechanism to exercise choice, as
individuals in these circumstances
would expect that their information be
used in this way.
Further, in certain situations, it would
not be practicable for employers toprovide a mechanism to exercise
choice related to the use of thepersonal
informationof
their
employees
when
using
such
information for employment purposes.
For example, if an organization has
decided to centralize human resources
information, that organization should
not be required to provide amechanism to exercise choice to its
employees before engaging in such anactivity.

VI. Integrity of Personal Information

24. Personal information should be 24. This Principle recognizes that aaccurate, complete and kept up-topersonal information controller isdate to the extent necessary for the
obliged to maintain the accuracy andpurposes of use.
completeness of records and keepthem up to date as necessary to fulfill
the purposes of use. Making decisions
about individuals based on inaccurate,incomplete or outdated information
may not be in the interests ofindividuals or organizations.
VII. Security Safeguards

25. Personal information controllers 25. This
Principle
recognizes
thatshouldprotect
personal
individuals
whose
personal
information that they hold withinformation is entrusted to others areappropriate safeguards against
entitled to expect that theirrisks, such as loss or unauthorized
information be protected withaccess to personal information, or
reasonable security safeguards.
unauthorized destruction, use,
modification or disclosure ofPage 15 of 28

information, or other misuses. Suchsafeguards should be proportional
to the likelihood and severity of theharm threatened, the sensitivity of
the information and the context inwhich it is held, and should be
subject to periodic review andreassessment.

VIII. Access and Correction

26. Individuals should be able to:a) obtain from the personal
information
controller
confirmation of whether or notthepersonal
information
controller
holds
personal
information about them;b) have communicated to them,after having provided sufficient
proof of their identity, personal
information about them;(i) within a reasonable time;(ii) at a charge, if any, that is
not excessive;(iii) in a reasonable manner;(iv) in a form that is generally
understandable; and,c) challenge the accuracy of
personal information relating
to them and, if possible and as
appropriate,
havetheinformation
rectified,completed,amendedordeleted.

27. Such access and opportunity forcorrection should be provided
except where:

26-28. The ability to access and correct
personal information, while generally
regarded as a central aspect of dataprotection and privacy, is not an
absolute right. This Principle includes
specific conditions for what would
be considered reasonable in theprovisionofaccess,includingconditions related to timing, fees, andthe manner and form in which accesswould be provided. What is to beconsidered reasonable in each of theseareas will vary from one situation toanother depending on circumstances,such as the nature of the information
processing activity. Access will also be
conditioned by security requirementsthat preclude the provision of directaccess to information and will requiresufficient proof of identity prior toprovision of access.
Access must be provided in areasonable manner and form. A
reasonable manner should include thenormal methods of interaction
between organizations and individuals.
For example, if a computer was
involved in the transaction or request,
and the individual’s email address isavailable, email would be considered “areasonable manner” to provide
information. Organizations that have
Page 16 of 28

a) the burden or expense of doing
so would be unreasonable ordisproportionate to the risks totheindividual’s
personal
information and privacy in thecase in question;b) the information should not be
disclosed due to legal or
security reasons or to protect
confidentialcommercial
information; orc) the personal information andprivacy of persons other than
the individual would be violated.
28. If a request under 25(a) or 25(b) or
a challenge under 25(c) is denied,the individual should be provided
with reasons why and be able tochallenge such denial.

transacted with an individual may
reasonably be expected to answer
requests in a form that is similar towhat has been used in prior exchanges
with said individual or in the form thatis used and available within theorganization, but should not be
understood to require separate
language translation or conversion ofcode into text.
Both the copy of personal information
supplied by an organization in responseto an access request and any
explanation of codes used by theorganization should be readily
comprehensible. This obligation does
not extend to the conversion ofcomputer language (e.g., machinereadable instructions, source codes orobject codes) into text. However,where a code represents a particularmeaning, the personal information
controller must explain the meaning ofthat code to the individual. For
example, if the personal information
held by the organization includes theage range of the individual, and that isrepresented by a particular code (e.g.,“1” means 18-25 years old, “2” means“26-35 years old, etc.), then whenproviding the individual with such a
code, the organization shall explain to
the individual what age range that code
represents.
Where an individual requests access to
his or her information, that information
should be provided in the language inwhich it is currently held. Where
information is held in a language
different from the language of originalcollection, and if the individual
requests the information be provided
in that original language, anorganization should supply the
Page 17 of 28

information in the original language if
the individual pays the cost oftranslation.
The details of the procedures by which
the ability to access and correct
information is provided may differ
depending on the nature of theinformation and other interests. For
this reason, in certain circumstances, it
may be impossible, impracticable or
unnecessary to change, suppress ordelete records.
Consistent with the fundamental
nature of access, organizations should
always make good faith efforts toprovide access. For example, wherecertain information needs to beprotected and can be readily separated
from other information subject to anaccess request, the organization should
redact the protected information andmake available the other information.
However, in some situations, it may benecessary for organizations to denyclaims for access and correction, andthis Principle sets out the conditions
that must be met in order for suchdenials to be considered acceptable,
which include: situations where claims
would constitute an unreasonable
expense or burden on the personal
information controller, such as whenclaims for access are repetitious or
vexatious by nature; cases where
providing the information would
constitute a violation of laws or would
compromise security; or, incidenceswhere it would be necessary in order toprotect
commercial
confidential
information that an organization has
taken steps to protect from disclosure,
where disclosure would benefit acompetitor in the marketplace, such asa particular computer or modeling
Page 18 of 28

program.
“Confidential commercial information”
is information that an organization has
taken steps to protect from disclosure,
where such disclosure would facilitate
a competitor in the market to use or
exploit the information against thebusiness interest of the organization
causing significant financial loss. The
particular computer program orbusiness process an organization uses,
such as a modeling program, or thedetails of that program or businessprocessmaybeconfidentialcommercial
information.
Whereconfidential commercial information
can be readily separated from otherinformation subject to an accessrequest, the organization should redact
theconfidentialcommercial
information and make available thenon-confidential information, to theextentthat
suchinformation
constitutes personal information of theindividual concerned. Organizations
may deny or limit access to the extent
that it is not practicable to separate thepersonal information from theconfidential commercial information
and where granting access would
revealtheorganization’sown
confidential commercial information as
defined above, or where it would
reveal the confidential commercial
information of another organizationthat is subject to an obligation ofconfidentiality.
When an organization denies a request
for access, for the reasons specified
above, such an organization should
provide the individual with an
explanation as to why it has made that
determination and information on how
to challenge that denial. An
Page 19 of 28

organization would not be expected toprovide an explanation in cases wheresuch explanation would violate a law or
judicial order.

IX. Accountability

29. A personal information controller 29. Efficient and cost-effective businessshouldbeaccountable
formodels often require information
complying with measures that givetransfers between different types ofeffect to the Principles statedorganizations in different locations
above. When personal information
with varying relationships. Whenis to be transferred to anothertransferring information, personal
person or organization, whether
information controllers should bedomestically or internationally, theaccountable for ensuring that thepersonal information controller
recipient will protect the information
should obtain the consent of theconsistently with these Principles when
individual or exercise due diligence
not obtaining consent. Thus, personal
and take reasonable steps to ensure
information controllers should takethat the recipient person orreasonable steps to ensure theorganization will protect the
information is protected in accordance
information consistently with thesewith these Principles, after it isPrinciples.
transferred.
There are certain situations where suchdue diligence may be impractical or
impossible, for example, when there isno on-going relationship between the
personal information controller andthe third party to whom theinformation is disclosed. In these typesof circumstances, personal information
controllers may choose to use othermeans, such as obtaining consent, toassure that the information is being
protected consistently with these
Principles. However, in cases wheredisclosures are required by domestic
law, the personal information
controller would be relieved of any due
diligence or consent obligations.
A useful means for a personal
information controller to help ensureaccountability for the personal
Page 20 of 28

information it holds is to have in placea data protection and privacy
management programme.2

Part. IV.

Implementation

30. Part IV provides guidance to Members on implementing the Global CBPR Framework.
Section A focuses on measures that Members should consider in implementing the
Framework domestically, while Section B sets out Forum-wide arrangements for the
implementation of the Framework’s cross-border elements.
A. GUIDANCE FOR DOMESTIC IMPLEMENTATION
31. Members should have regard to the following basic concept in considering the
adoption of measures designed for domestic implementation of the Global CBPR
Framework:
I.

Maximizing Benefits of Data Protection and Privacy and Information Flows

32. Personal information should be collected, held, processed, used, transferred, anddisclosed in a manner that (a) protects individuals’ data and privacy, and (b) allows
individuals and Members to maximize the benefits of data flows within and acrossborders.
33. Consequently, as part of establishing or reviewing their data protection and privacy
approaches to give effect to the Global CBPR Framework, Members should take allreasonable and appropriate steps to identify and remove unnecessary barriers to
information flows and avoid the creation of any such barriers.
II. Giving Effect to the Global CBPR Framework

34. There are several options for giving effect to the Framework and securing dataprotection and privacy for individuals, including legislative, administrative, industry
self-regulatory or a combination of these policy instruments. In practice, theFramework is meant to be implemented in a flexible manner that can accommodate
various models of enforcement, including through Privacy Enforcement Authorities,
multi-agency enforcement bodies, a network of designated industry bodies, courts
and tribunals, or a combination of the above, as Members deem appropriate.
35. The means of giving effect to the Framework will often differ between Members. A
Member may determine that different Global CBPR Privacy Principles call for different
means of domestic implementation. Whatever approach is adopted in a particular
circumstance, the overall goal should be to develop compatible data protection and2

See paras 40-42 below.

Page 21 of 28

privacy approaches among Members that are respectful of individual Members’
requirements.
36. Members should adopt non-discriminatory practices in giving effect to the
Framework’s principles and in protecting individuals from data protection and privacy
violations occurring in that Member’s jurisdiction. For example, Members should
ensure that laws or other approaches that give effect to the protections in the
Framework do not impede individuals living in other jurisdictions from benefittingfrom those protections.
37. Coordination across government agencies and other stakeholders is important to
identify ways to strengthen data protection and privacy without creating obstacles tonational security, public safety, and other public policy objectives.
38. Members should maintain Privacy Enforcement Authorities. These Privacy
Enforcement Authorities should be provided with the governance, resources andtechnical expertise necessary to exercise their powers effectively and to makedecisions in an objective, impartial and consistent basis.
39. Privacy Enforcement Authorities may find it useful to apply a risk-based approach toselected oversight efforts and, where permitted, to prioritize their enforcement
efforts according to the likelihood and severity of harm that might result from dataprotection and privacy violations or from an action taken or proposed.3
III. Data Protection and Privacy Management Programmes

40. An operative data protection and privacy management programme will provide asound basis for a personal information controller to demonstrate that it is complying
with measures that give effect to the Global CBPR Privacy Principles.
41. Accordingly, Members should consider encouraging personal information controllers
to develop and implement data protection and privacy management programmes for
all personal information under their control. Data protection and privacy management
programmes should:a) be tailored to the structure and scale of the operations of the personal information
controller, as well as the volume and sensitivity of the personal information under
its control;b) provide appropriate safeguards based upon risk assessment that take into accountthe potential harm to individuals;c) establish mechanisms for internal oversight and response to inquiries andincidents;
3

See the Preventing Harm Principle.

Page 22 of 28d) be overseen by designated accountable and appropriately trained personnel; ande) be monitored and be regularly updated.

42. Personal information controllers should be prepared to demonstrate their dataprotection and privacy management programmes at the request of a competentPrivacy Enforcement Authority of that Member or in response to a valid request byanother appropriate entity, such as an Accountability Agent designated under the
Global CBPR Forum or under an industry code of conduct giving effect to the
Framework.
IV. Promotion of technical measures to protect personal information and privacy

43. Technical measures can make a significant contribution to the overall effectivenessand impact of domestic data protection and privacy regimes, by supplementing andcomplementing legal protections of personal information and privacy. Therefore,
when considering approaches to give effect to the Framework, Members should
promote technical measures which help to protect personal information and privacy.
44. Members may, for example, encourage personal information controllers to make fulluse of readily available technical safeguards and measures. In addition, they may
promote research and development, encourage further data protection and privacy
innovation and support the development of technical standards that embed best dataprotection and privacy practice into systems engineering.
V. Public education and communication

45. For the Framework to be of practical effect, it should be known and accessible.
Accordingly, Members should:a) Publicize how their Data Protection and Privacy Laws and other domesticarrangements provide protections to individuals;b) engage in activities that raise awareness amongst:i.

personal information controllers about the Member’s Data Protection andPrivacy Laws and the controllers’ responsibilities;

ii. Personal information processors about practices that help provide effective
implementation of a personal information controller’s data protection andprivacy obligations related to the processing of personal information; andiii. individuals about how they can report violations and how remedies can be
pursued; andPage 23 of 28c) Encourage or require Privacy Enforcement Authorities and other bodies having
responsibilities to administer Data Protection and Privacy Laws established at thedomestic level (for example, Global CBPR Forum-recognized Accountability Agentsor bodies established to give effect to self-regulatory schemes) to report publicly
on their activities where appropriate.

VI. Cooperation within and between the Public and Private Sectors

46. Active participation of non-governmental entities will help ensure that the full
benefits of the Framework can be realized. Accordingly, Members should engage in a
dialogue with relevant non-government stakeholders, including those representing
citizens, consumers and industry and technical and academic communities, to obtain
input on data protection and privacy and information flow issues and to seek
cooperation in furthering the Framework’s objectives.
47. Members should seek the cooperation of non-governmental entities such as those
representing citizens and consumers in raising public awareness about data protection
and privacy issues. As well, Members should encourage these entities to actively
engage in promoting and supporting the personal information and privacy interests ofindividuals, for example by referring complaints to Privacy Enforcement Authorities
and publicizing the outcomes of those complaints.
48. Members should consider developing strategies that reflect a coordinated approachto data protection and privacy across governmental bodies.
49. Members should also consider undertaking consultation and capacity building efforts
across the public and private sectors, and with non-government stakeholders,
including, for example, by:a) developing or supporting networks of individuals responsible for data protection
and privacy compliance within organizations; andb) producing informational materials and arranging experience sharing events.
VII. Providing for appropriate remedies in situations where data protection and privacy
are violated

50. A Member’s system of data protection and privacy should include appropriate
remedies for data protection and privacy violations, which could include redress, theability to stop a violation from continuing, and other remedies. In determining therange of remedies for data protection and privacy violations, Members should take anumber of factors into account including:a) the particular system in that Member that provides data protection and privacy(e.g., legislative enforcement powers, which may include rights of individuals toPage 24 of 28

pursue legal action, industry self-regulation, or a combination of systems); andb) the importance of having a range of remedies commensurate with the extent of
the actual or potential harm to individuals resulting from such violations.

51. A Member should consider encouraging or requiring personal information controllers
to provide notice, as appropriate, to Privacy Enforcement Authorities and/or otherrelevant authorities in the event of a significant security breach affecting personal
information under its control. Where it is reasonable to believe that the breach is likely
to affect individuals, timely notification directly to affected individuals should be
encouraged or required, where feasible and reasonable.
VIII. Reporting Domestic Implementation of the Global CBPR Framework

52. Members should provide timely notice to the Global Forum Assembly on theirdomestic implementation of the Framework, including any new laws or regulations
and any amendments to existing laws or regulations, as well as all other developmentsthat may affect the operation and enforcement of the Global CBPR System and/or
Global PRP System.
B. GUIDANCE FOR INTERNATIONAL IMPLEMENTATION
53. In addressing the international implementation of the Global CBPR Framework, andconsistent with the provisions of Part A, Members should consider the following points
relating to the protection of the privacy of personal information:
I.

Information sharing among Members

54. Members are encouraged to share and exchange information, surveys and research inrespect of matters that have a significant impact on data protection and privacy.
55. Members are encouraged to educate one another in issues related to data protection
and privacy and to share and exchange information on promotional, educational andtraining programs for the purpose of raising public awareness and enhancing
understanding of the importance of data protection and privacy and compliance with
relevant laws and regulations.
56. Members are encouraged to share experiences on various techniques in investigating
violations of data protection and privacy and regulatory strategies in resolving
disputes involving such violations including, for instance, complaints handling andalternative dispute resolution mechanisms.
57. Members should designate and make known to the other members the publicauthorities within their own jurisdictions that will be responsible for facilitating crossborder cooperation and information sharing between members in connection withdata protection and privacy.
Page 25 of 28

58. Members should encourage the development of internationally comparable metrics
to inform the policy making process relating to data protection and privacy andpersonal information flows.
II. Cross-border cooperation in investigation and enforcement

59. Taking into consideration existing international arrangements (including the Global
CAPE) and existing or developing self-regulatory or co-regulatory approaches, and to
the extent permitted by domestic law and policy, members should expand their use ofexisting cooperative arrangements and consider developing additional cooperative
arrangements or procedures, as necessary, to facilitate cross-border cooperation in
the enforcement of Data Protection and Privacy Laws. Such cooperative
arrangements may take the form of bilateral or multilateral arrangements.
60. The preceding paragraph is to be construed with regard to the right of Members to
decline or limit cooperation on particular investigations or matters on the ground thatcompliance with a request for cooperation would be inconsistent with domestic laws,
policies or priorities, or on the ground of resource constraints, or based on the absenceof a mutual interest in the investigations in question.
61. In civil enforcement of Data Protection and Privacy Laws, cooperative cross-borderarrangements may include the following aspects:a) mechanisms for promptly, systematically and efficiently notifying designatedpublic authorities in other Members of investigations or data protection andprivacy enforcement matters that target conduct that is (i) inconsistent with theprotections set forth in the Framework and (ii) may affect individuals or personal
information controllers in those other Members;b) mechanisms for effectively sharing information necessary for successful
cooperation in cross-border data protection and privacy investigation andenforcement cases;c) mechanisms for investigative assistance in data protection and privacy
enforcement cases;d) mechanisms to prioritize cases for cooperation with public authorities in otherMembers based on the severity of the unlawful infringements of personal
information and privacy, the actual or potential harm involved, as well as otherrelevant considerations; ande) steps to maintain the appropriate level of confidentiality in respect of informationexchanged under the cooperative arrangements.
III. Cross-border data protection and privacy mechanisms
Page 26 of 28

62. Members recognize the importance of protecting personal information and privacy
while maintaining the free flow of personal information across borders and encourage
the implementation the Framework to provide conditions in which information canflow safely and accountably, for instance through the use of the Global CBPR and PRP
Systems.
63. Members should endeavor to support the development and recognition or
acceptance of cross-border data transfer and privacy mechanisms for use byorganizations to transfer personal information globally, recognizing that organizations
would still be responsible for complying with the local data protection and privacy
requirements, as well as with all applicable laws. Such mechanisms should beconsistent with the Global CBPR Privacy Principles.
64. To give effect to paragraph 62, Members participate in the Global CBPR System, which
provides a practical mechanism to implement the Global CBPR Framework in aninternational, cross-border context, and to provide a means for organizations totransfer personal information across borders in a manner in which individuals maytrust that the privacy of their personal information is protected.
65. The Global PRP System complements the Global CBPR System to help personal
information processors demonstrate their ability to provide effective implementationof a personal information controller’s obligations related to the processing of personal
information.
IV. Cross-border transfers

66. A Member should refrain4 from restricting cross border flows of personal information
between itself and another Member where (a) the other Member has in placelegislative or regulatory instruments that give effect to the Framework or (b) sufficient
safeguards exist, including effective enforcement mechanisms and appropriate
measures (such as the Global CBPR System) put in place by the personal information
controller to ensure a continuing level of protection consistent with the Frameworkand the laws or policies that implement it.
67. Any restrictions to cross-border flows of personal information should be
proportionate to the risks presented by the transfer, taking into account thesensitivity of the information, and the purpose and context of the cross-bordertransfer.
V. Interoperability with data protection and privacy frameworks

68. Members should promote interoperability of the Global CBPR System and PRP Systemwith other data protection and privacy frameworks that give practical effect to this4

Cross border data flows remain subject to members’ applicable domestic laws, regulations, andinternational agreements and commitments.

Page 27 of 28

Framework.
69. Improving the global interoperability of data protection and privacy frameworks canbring benefits in improved personal information flows, help ensure that dataprotection and privacy requirements are maintained when personal information flows
beyond Members and can simplify compliance for personal information controllers
and processors. Global interoperability can also assist individuals to assert theirpersonal information and privacy rights in a global environment and help authorities
to improve cross-border privacy enforcement.

Page 28 of 28