APEC CROSS-BORDER PRIVACY RULES SYSTEM PROGRAMREQUIREMENTS

Updated as of November 2019
The purpose of this document is to provide the baseline program requirements of the APEC Cross
Border Privacy Rules (CBPR) System in order to assist APEC-recognized Accountability Agents in an
Applicant’s compliance review process and to ensure this process is conducted consistently
throughout participating APEC Economies. Accountability Agents are responsible for receiving an
Applicant’s intake documentation, verifying an Applicant’s compliance with the requirements of the
CBPR System and, where appropriate, assisting the Applicant in modifying its policies and practices
to meet the requirements of the CBPR System. The Accountability Agent will certify those Applicant
deemed to have met the minimum criteria for participation provided herein, and will be responsible
for monitoring the Participants’ compliance with the CBPR System, based on this criteria. This
document is to be read in consistently with the APEC CBPR Intake Document1.
NOTICE ........................................................................................................................................................ 2
COLLECTION LIMITATION.................................................................................................................................. 6
USES OF PERSONAL INFORMNATION ............................................................................................................8
CHOICE ...................................................................................................................................................... 11
INTEGRITY OF PERSONAL INFORMATION ................................................................................................ 15
SECURITY SAFEGUARDS ...................................................................................................................... 17
ACCESS AND CORRECTION.................................................................................................................. 21
ACCOUNTABILITY ........................................................................................................................................ 24
GENERAL ............................................................................................................................................................... 24
MAINTAINING ACCOUNTABILITY WHEN PERSONAL INFORMATION IS TRANSFERRED................. 26

1

NOTE: The APEC Cross Border Privacy Rules Intake Questionnaire lists the acceptable qualifications to theprovision of notice, the provision of choice mechanisms, and the provision of access and correction mechanisms
referred to in this document.

Page | 1

NOTICE
Assessment Purpose – To ensure that individuals understand the applicant’s personal information policies (subject to any qualifications),
including to whom the personal information may be transferred and the purpose for which the personal information may be used. Refer to the
APEC Cross Border Privacy Rules Intake Questionnaire for a list of acceptable Qualifications to the provision of notice.
Question

Assessment Criteria

1. Do you provide clear and easily
accessible statements about your practices
and policies that govern the personal
information described above (a privacy
statement)? Where YES, provide a copy of
all applicable privacy statements and/or
hyperlinks to the same.

If YES, the Accountability Agent must verify that the Applicant’s privacy practices and policy (orother privacy statement) include the following characteristics:•

Available on the Applicant’s Website, such as text on a Web page, link from URL, attacheddocument, pop-up windows, included on frequently asked questions (FAQs), or other (must be
specified).

•

Is in accordance with the principles of the 2015 APEC Privacy Framework;•

Is easy to find and accessible.

•

Applies to all personal information; whether collected online or offline.

•

States an effective date of Privacy Statement publication.

Where Applicant answers NO to question 1, and does not identify an applicable qualification
subject to the Qualifications to Notice set out below, the Accountability Agent must inform theApplicant that Notice as described herein is required for compliance with this principle. Where theApplicant identifies an applicable qualification, the Accountability Agent must verify whether theapplicable qualification is justified.
1.a) Does this privacy statement describe
how personal information is collected?

If YES, the Accountability Agent must verify that:•

The statement describes the collection practices and policies applied to all covered personal
information collected by the Applicant.

•the Privacy Statement indicates what types of personal information, whether collected
directly or through a third party or agent, is collected, and•

The Privacy Statement reports the categories or specific sources of all categories of personal
information collected.

If NO, the Accountability Agent must inform the Applicant that Notice as described herein isPage | 2required for compliance with this principle.
1.b) Does this privacy statement describe
the purpose(s) for which personal
information is collected?

1.c) Does this privacy statement inform
individuals whether their personal
information is made available to third
parties and for what purpose?

Where the Applicant answers YES, the Accountability Agent must verify that the Applicant
provides notice to individuals of the purpose for which personal information is being collected.
Where the Applicant answers NO and does not identify an applicable qualification set out below,
the Accountability Agent must notify the Applicant that notice of the purposes for which personal
information is collected is required and must be included in their Privacy Statement. Where theApplicant identifies an applicable qualification, the Accountability Agent must verify whether theapplicable qualification is justified.
Where the Applicant answers YES, the Accountability Agent must verify that the Applicant notifies
individuals that their personal information will or may be made available to third parties, identifies
the categories or specific third parties, and the purpose for which the personal information
will or may be made available.
Where the Applicant answers NO and does not identify an applicable qualification, the
Accountability Agent must notify the Applicant that notice that personal information will beavailable to third parties is required and must be included in their Privacy Statement. Where theApplicant identifies an applicable qualification, the Accountability Agent must verify whether theapplicable qualification is justified.

1.d) Does this privacy statement disclose
the name of the applicant’s company andlocation, including contact information
regarding practices and handling of
personal information upon collection?
Where YES describe.

Where the Applicant answers YES, the Accountability Agent must verify that the Applicant
provides name, address and a functional e-mail address.

1.e) Does this privacy statement provide
information regarding the use anddisclosure of an individual’s personal
information?

Where the Applicant answers YES, the Accountability Agent must verify that the Applicant’s
Privacy Statement includes, if applicable, information regarding the use and disclosure of all
personal information collected. Refer to question 8 for guidance on permissible uses of personal
information. Where the Applicant answers NO and does not identify an applicable qualification, the
Accountability Agent must inform the Applicant, that such information is required for compliancewith this principle. Where the Applicant identifies an applicable qualification, the Accountability

Where the Applicant answers NO and does not identify an applicable qualification, the
Accountability Agent must inform the Applicant that such disclosure of information is required forcompliance with this principle. Where the Applicant identifies an applicable qualification, the
Accountability Agent must verify whether the applicable qualification is justified.

Page | 3

Agent must verify whether the applicable qualification is justified.
1.f) Does this privacy statement provide
information regarding whether and how anindividual can access and correct theirpersonal information?

Where the Applicant answers YES, the Accountability Agent must verify that the Privacy Statement
includes:•The process through which the individual may access his or her personal information(including electronic or traditional non-electronic means).

•

The process that an individual must follow in order to correct his or her personal
information

Where the Applicant answers NO and does not identify an applicable qualification, the
Accountability Agent must inform the Applicant that providing information about access andcorrection, including the Applicant’s typical response times for access and correction requests, isrequired for compliance with this principle. Where the Applicant identifies an applicablequalification, the Accountability Agent must verify whether the applicable qualification is justified.
2. Subject to the qualifications listed below,
at the time of collection of personal
information (whether directly or throughthe use of third parties acting on yourbehalf), do you provide notice that suchinformation is being collected?

Where the Applicant answers YES, the Accountability Agent must verify that the Applicant
provides notice to individuals that their personal information is being (or, if not practicable, has
been) collected and that the notice is reasonably available to individuals.

3. Subject to the qualifications listed below,
at the time of collection of personal
information (whether directly or throughthe use of third parties acting on yourbehalf), do you indicate the purpose(s) for
which personal information is being
collected?

Where the Applicant answers YES, the Accountability Agent must verify that the Applicant explains
to individuals the purposes for which personal information is being collected. The purposes must be
communicated orally or in writing, for example on the Applicant’s website, such as text on a
website link from URL, attached documents, pop-up window, or other.

4. Subject to the qualifications listed

Where the Applicant answers YES, the Accountability Agent must verify that the Applicant

Where the Applicant answers NO and does not identify an applicable qualification, the
Accountability Agent must inform the Applicant that the notice that personal information is being
collected is required for compliance with this principle. Where the Applicant identifies anapplicable qualification, the Accountability Agent must verify whether the applicable qualification
is justified.

Where the Applicant answers NO and does not identify an applicable qualification set out on part IIof the CBPR Self-Assessment Guidelines for Organisations, the Accountability Agent must informthe Applicant of the need to provide notice to individuals of the purposes for which personal
information is being collected. Where the Applicant identifies an applicable qualification, the
Accountability Agent must verify whether the applicable qualification is justified.

Page | 4below, at the time of collection of personal
information, do you notify individuals that
their personal information may be sharedwith third parties?

provides notice to individuals that their personal information will be or may be shared with third
parties and for what purposes.
Where the Applicant answers NO and does not identify an applicable qualification set out on part IIof the CBPR Self-Assessment Guidelines for Organisations, the Accountability Agent must informthe Applicant to provide notice to individuals that the personal information collected may be sharedwith third parties. Where the Applicant identifies an applicable qualification, the Accountability
Agent must determine whether the applicable qualification is justified.

Page | 5

COLLECTION LIMITATION
Assessment Purpose - Ensuring that collection of information is limited to the specific purposes stated at the time of collection. The collection of
the information should be relevant to such purposes, and proportionality to the fulfillment of such purposes may be a factor in determining what isrelevant. In all instances, collection methods must be lawful and fair
Question

Assessment Criteria

5. How do you obtain personal
information:

The Accountability Agent must verify that the Applicant indicates from whom they obtain personal
information.

5.a) Directly from the individual?

Where the Applicant answers YES to any of these sub-parts, the Accountability Agent must verify
the Applicant’s practices in this regard.

5.b) From third parties collecting on yourbehalf?

There should be at least one ‘yes’ answer to these three questions. If not, the Accountability Agentmust inform the Applicant that it has incorrectly completed the questionnaire.

5.c) Other. If YES, describe.

6. Do you limit your personal informationcollection (whether directly or through theuse of third parties acting on your behalf)
to information that is relevant to fulfill the
purpose(s) for which it is collected or othercompatible or related purposes?

Where the Applicant answers YES and indicates it only collects personal information which isrelevant to the identified collection purpose or other compatible or related purposes, the
Accountability Agent must require the Applicant to identify:•

Each type of data collected•

The corresponding stated purpose of collection for each; and•All uses that apply to each type of data•

An explanation of the compatibility or relatedness of each identified use with the statedpurpose of collection

Using the above, the Accountability Agent will verify that the applicant limits the amount and typeof personal information to that which is relevant to fulfill the stated purposes
Where the Applicant answers NO, the Accountability Agent must inform the Applicant that it must
limit the use of collected personal information to those uses that are relevant to fulfilling thePage | 6

purpose(s) for which it is collected.
7. Do you collect personal information(whether directly or through the use ofthird parties acting on your behalf) by
lawful and fair means, consistent with therequirements of the jurisdiction thatgoverns the collection of such personal
information? Where YES, describe.

Where the Applicant answers YES, the Accountability Agent must require the Applicant to certifythat it is aware of and complying with the requirements of the jurisdiction that governs thecollection of such personal information and that it is collecting information by fair means, without
deception.
Where the Applicant Answers NO, the Accountability Agent must inform that Applicant that lawful
and fair procedures are required for compliance with this principle.

Page | 7

USES OF PERSONAL INFORMATION
Assessment Purpose - Ensuring that the use of personal information is limited to fulfilling the specific purposes of collection and other compatibleor related purposes. This section covers use, transfer and disclosure of personal information. Application of this Principle requires considerationof the nature of the information, the context of collection and the intended use of the information. The fundamental criterion in determining
whether a purpose is compatible with or related to the stated purposes is whether the extended usage stems from or is in furtherance of such
purposes. The use of personal information for "compatible or related purposes" could extend, for example, to matters such as the creation and useof a centralized database to manage personnel in an effective and efficient manner; the processing of employee payrolls by a third party; or, the useof information collected by an applicant for the purpose of granting credit for the subsequent purpose of collecting debt owed to that applicant
Question

Assessment Criteria

8. Do you limit the use of the personal
information you collect (whether directlyor through the use of third parties acting on
your behalf) as identified in your privacy
statement and/or in the notice provided at
the time of collection, to those purposes forwhich the information was collected or forother compatible or related purposes? Ifnecessary, provide a description in thespace below.

Where the Applicant answers YES, the Accountability Agent must verify the existence of written
policies and procedures to ensure that] all covered personal information collected either directly or
indirectly through an agent is done so in accordance with the purposes for which the information
was collected as identified in the Applicant’s Privacy Statement(s) in effect at the time of collection
or for other compatible or related purposes.

9. If you answered NO, do you use thepersonal information you collect for
unrelated purposes under one of thefollowing circumstances? Describe below.

Where the Applicant answers NO to question 8, the Applicant must clarify under whatcircumstances it uses personal information for purposes unrelated to the purposes of collection andspecify those purposes. Where the applicant selects 9a, the Accountability Agent must require theApplicant to provide a description of how such consent was obtained, and the Accountability Agentmust verify that the Applicant’s use of the personal information is based on express consent of theindividual (9.a), such as:9.a) Based on express consent of theindividual?

Where the Applicant Answers NO, the Accountability Agent must consider answers to Question 9
below.

•

Online at point of collection•

Via e-mail•Via preference/profile page

Page | 89.b) Compelled by applicable laws?

•

Via telephone•

Via postal mail, or•

Other (in case, specify)

Where the Applicant answers 9.a, the Accountability Agent must require the Applicant to provide a
description of how such consent was obtained. The consent must meet the requirements set forth inquestions 17-19 below.
Where the Applicant selects 9.b, the Accountability Agent must require the Applicant to provide a
description of how the collected personal information may be shared, used or disclosed ascompelled by law.
Where the Applicant does not answer 9.a or 9.b, the Accountability Agent must inform theApplicant that limiting the use of collected information to the identified purposes of collection orother compatible or related purposes, unless permitted under the circumstances listed in thisQuestion, is required for compliance with this principle.
10. Do you disclose personal information
you collect (whether directly or through theuse of third parties acting on your behalf)
to other personal information controllers?
If YES, describe.
11. Do you transfer personal information topersonal information processors? If YES,
describe.
12. If you answered YES to question 10
and/or question 11, is the disclosure and/ortransfer undertaken to fulfill the original
purpose of collection or another compatibleor related purpose? If YES, describe.

Where the Applicant answers YES in questions 10 and 11, the Accountability Agent must verify that
if personal information is disclosed to other personal information controllers or transferred toprocessors, such disclosure and/or transfer must be undertaken to fulfill the original purpose ofcollection or another compatible or related purpose, unless based upon the express consent of theindividual necessary to provide a service or product requested by the individual, or compelled bylaw.
Also, the Accountability Agent must require the Applicant to identify:1) each type of data disclosed or transferred;
2) the corresponding stated purpose of collection for each type of disclosed data; and3) the manner in which the disclosure fulfills the identified purpose (e.g. order fulfillmentetc.).
Using the above, the Accountability Agent must verify that the Applicant’s disclosures ortransfers of all personal information is limited to the purpose(s) of collection, or compatibleor related purposes.

Page | 9

13. If you answered NO to question 12 or if
otherwise appropriate, does the disclosure
and/or transfer take place under one of thefollowing circumstances?
13.a) Based on express consent of theindividual?

Where applicant answers NO to question 13, the Applicant must clarify under what circumstances it
discloses or transfers personal information for unrelated purposes, specify those purposes.
Where the Applicant answers YES to 13.a, the Accountability Agent must require the Applicant toprovide a description of how individual’s provide consent to having their personal information
disclosed and/or transferred for an unrelated use, such as:•

Online at point of collection

13.b) Necessary to provide a service or
product requested by the individual?

•

Via e-mail13.c) Compelled by applicable laws?

•

Via preference/profile page•Via telephone•

Via postal mail, or•

Other (in case, specify)

Where the Applicant answers YES to 13.b, the Accountability Agent must require the Applicant toprovide a description of how the disclosure and/or transfer of collected personal information isnecessary to provide a service or product requested by the individual. The Accountability Agentmust verify that the disclosure or transfer is necessary to provide a service or product requested by
the individual.
Where the Applicant answers YES to 13.c, the Accountability Agent must require the Applicant toprovide a description of how collected information may be shared, used or disclosed as compelledby law. The Applicant must also outline the legal requirements under which it is compelled to share
the personal information, unless the Applicant is bound by confidentiality requirements. The
Accountability Agent must verify the existence and applicability of the legal requirement.
Where the Applicant answers NO to 13.a, b and c, the Accountability Agent must inform theApplicant that limiting the disclosure and/or transfer of collected information to the identified
purposes of collection or other compatible or related purposes, unless permitted under thecircumstances listed in this Question, is required for compliance with this principle.

Page | 10

CHOICE
Assessment Purpose - Ensuring that individuals are provided with choice in relation to collection, use, and disclosure of their personal
information. However, this Principle recognizes, through the introductory words "where appropriate" in the Framework itself, that there arecertain situations where consent may be clearly implied or where it would not be necessary to provide a mechanism to exercise choice. Thesesituations are detailed in part II of the CBPR Self-Assessment Guidelines for Organisations. Refer to the APEC Cross Border Privacy Rules Intake
Questionnaire for a list of acceptable Qualifications to the provision of choice mechanisms.
Question
14. Subject to the qualifications described
below, do you provide a mechanism forindividuals to exercise choice in relation to
the collection of their personal
information? Where YES describe suchmechanisms below.

Assessment Criteria
Where the Applicant answers YES, the Accountability Agent must verify that the Applicant
provides a description of the mechanisms provided to individuals so that they may exercise choice
in relation to the collection of their personal information, such as:•

Online at point of collection•

Via e-mail•Via preference/profile page•Via telephone•

Via postal mail, or•

Other (in case, specify)

The Accountability Agent must verify that these mechanisms are in place and operational and thatthe purpose of collection is clearly stated.
Where the Applicant answers NO, the Applicant must identify the applicable qualification and the
Accountability Agent must verify whether the applicable qualification is justified. Where theApplicant answers NO and does not identify an applicable qualification the Accountability Agentmust inform the Applicant that a mechanism for individuals to exercise choice in relation to thecollection of their personal information must be provided.
15. Subject to the qualifications described
below, do you provide a mechanism forindividuals to exercise choice in relation to
the use of their personal information?

Where the Applicant answers YES, the Accountability Agent must verify that the Applicant
provides a description of mechanisms provided to individuals so that they may exercise choice inrelation to the use of their personal information, such as:Page | 11

Where YES describe such mechanisms
below.

•

Online at point of collection•

Via e-mail•Via preference/profile page•Via telephone•

Via postal mail, or•

Other (in case, specify)

The Accountability Agent must verify that these types of mechanisms are in place and operational
and identify the purpose(s) for which the information will be used. Subject to the qualifications
outlined below, the opportunity to exercise choice should be provided to the individual at the time ofcollection, for subsequent uses of personal information. Subject to the qualifications outlined
below, the opportunity to exercise choice may be provided to the individual after collection, but
before: ]•being able to make use of the personal information, when the purposes of such use is not
related or compatible to the purpose for which the information was collected, and•Personal information may be disclosed or distributed to third parties, other than Service
Providers.

Where the Applicant answers NO, the Applicant must identify the applicable qualification to theprovision of choice, and provide a description and the Accountability Agent must verify whether theapplicable qualification is justified.
Where the Applicant answers NO and does not identify an acceptable qualification, the
Accountability Agent must inform the Applicant a mechanism for individuals to exercise choice inrelation to the use of their personal information must be provided.
16. Subject to the qualifications described
below, do you provide a mechanism forindividuals to exercise choice in relation to
the disclosure of their personal
information? Where YES describe suchmechanisms below.

Where the Applicant answers YES, the Accountability Agent must verify that the Applicant
provides a description of how individuals may exercise choice in relation to the disclosure of theirpersonal information, such as:•

Online at point of collection•

Via e-mailPage | 12

•Via preference/profile page•Via telephone•

Via postal mail, or•

Other (in case, specify)

The Accountability Agent must verify that these types of mechanisms are in place and operational
and identify the purpose(s) for which the information will be disclosed. Subject to the qualifications
outlined below, the opportunity to exercise choice should be provided to the individual at the time ofcollection, for subsequent disclosures of personal information. Subject to the qualifications outlined
below, the opportunity to exercise choice may be provided to the individual after collection, but
before:•disclosing the personal information to third parties, other than Service Providers, for a
purpose that is not related or when the Accountability Agent finds that the Applicant’s
choice mechanism is not displayed in a clear and conspicuous manner , or compatible withthat for which the information was collected.]

Where the Applicant answers NO, the Applicant must identify the applicable qualification to theprovision of choice and provide a description and the Accountability Agent must verify whether theapplicable qualification is justified.
Where the Applicant answers NO and does not identify an acceptable qualification, the
Accountability Agent must inform the Applicant that a mechanism for individuals to exercise choice
in relation to the disclosure of their personal information must be provided.
17 When choices are provided to theindividual offering the ability to limit thecollection (question 14), use (question 15)
and/or disclosure (question 16) of theirpersonal information, are they displayed orprovided in a clear and conspicuous
manner?

Where the Applicant answers YES, the Accountability Agent must verify that the Applicant’s choicemechanism is displayed in a clear and conspicuous manner .

18. When choices are provided to theindividual offering the ability to limit the

Where the Applicant answers YES, the Accountability Agent must verify that the Applicant’s choicemechanism is clearly worded and easily understandable.

Where the Applicant answers NO, or when the Accountability Agent finds that the Applicant’s
choice mechanism is not displayed in a clear and conspicuous manner, the Accountability Agentmust inform the Applicant that all mechanisms that allow individuals to exercise choice in relation
to the collection, use, and/or disclosure of their personal information, must be clear and conspicuousin order to comply with this principle.

Page | 13

collection (question 14), use (question 15)
and/or disclosure (question 16) of theirpersonal information, are they clearly
worded and easily understandable?

Where the Applicant answers NO, and/or when the Accountability Agent finds that the Applicant’s
choice mechanism is not clearly worded and easily understandable, the Accountability Agent must
inform the Applicant that all mechanisms that allow individuals to exercise choice in relation to thecollection, use, and/or disclosure of their personal information, must be clearly worded and easily
understandable in order to comply with this principle.

19. When choices are provided to theindividual offering the ability to limit thecollection (question 14), use (question 15)
and/or disclosure (question 16) of theirpersonal information, are these choices
easily accessible and affordable? Where
YES, describe.

Where the Applicant answers YES, the Accountability Agent must verify that the Applicant’s choicemechanism is easily accessible and affordable.

20. What mechanisms are in place so thatchoices, where appropriate, can be honoredin an effective and expeditious manner?
Provide a description in the space below orin an attachment if necessary. Describe
below.

Where the Applicant does have mechanisms in place, the Accountability Agent must require theApplicant to provide of the relevant policy or procedures specifying how the preferences expressed
through the choice mechanisms (questions 14, 15 and 16) are honored.

Where the Applicant answers NO, or when the Accountability Agent finds that the Applicant’s
choice mechanism is not easily accessible and affordable, the Accountability Agent must inform theApplicant that all mechanisms that allow individuals to exercise choice in relation to the collection,use, and/or disclosure of their personal information, must be easily accessible and affordable inorder to comply with this principle.

Where the Applicant does not have mechanisms in place, the Applicant must identify the applicablequalification to the provision of choice and provide a description and the Accountability Agent mustverify whether the applicable qualification is justified.
Where the Applicant answers NO and does not provide an acceptable qualification, the
Accountability Agent must inform the Applicant that a mechanism to ensure that choices, whenoffered, can be honored, must be provided.

Page | 14

INTEGRITY OF PERSONAL INFORMATION
Assessment Purpose - The questions in this section are directed towards ensuring that the personal information controller maintains the accuracy
and completeness of records and keeps them up to date. This Principle also recognizes that these obligations are only required to the extent
necessary for the purposes of use
Question
21. Do you take steps to verify that thepersonal information held by you is up todate, accurate and complete, to the extent
necessary for the purposes of use? If YES,
describe.

Assessment Criteria
Where the Applicant answers YES, the Accountability Agent must require the Applicant to provide
the procedures the Applicant has in place to verify and ensure that the personal information held is
up to date, accurate and complete, to the extent necessary for the purposes of use.
The Accountability Agent will verify that reasonable procedures are in place to allow the
Applicant to maintain personal information that is up to date, accurate and complete, to theextent necessary for the purpose of use.
Where the Applicant answers NO, the Accountability Agent must inform the Applicant thatprocedures to verify and ensure that the personal information held is up to date, accurate andcomplete, to the extent necessary for the purposes of use, are required for compliance with thisprinciple.

22. Do you have a mechanism forcorrecting inaccurate, incomplete and outdated personal information to the extent
necessary for purposes of use? Provide a
description in the space below or in an
attachment if necessary.

Where the Applicant answers YES, the Accountability Agent must require the Applicant to provide
the procedures and steps the Applicant has in place for correcting inaccurate, incomplete and outdated personal information, which includes, but is not limited to, procedures which allows
individuals to challenge the accuracy of information such as accepting a request for correction
from individuals by e-mail, post, phone or fax, through a website, or by some other method.
The Accountability Agent must verify that this process is in place and operational.
Where the Applicant answers NO, the Accountability Agent must inform the Applicant thatprocedures/steps to verify and ensure that the personal information held is up to date, accurate andcomplete, to the extent necessary for the purposes of use, are required for compliance with thisprinciple.

23. Where inaccurate, incomplete or out ofdate information will affect the purposes ofuse and corrections are made to theinformation subsequent to the transfer of

Where the Applicant answers YES, the Accountability Agent must require the Applicant to provide
the procedures the Applicant has in place to communicate corrections to personal information
processors, agent, or other service providers to whom the personal information was transferred andthe accompanying procedures to ensure that the corrections are also made by the processors, agents

Page | 15

the information, do you communicate thecorrections to personal information
processors, agents, or other service
providers to whom the personal
information was transferred? If YES,
describe.

or other service providers acting on the Applicant’s behalf.

24. Where inaccurate, incomplete or out ofdate information will affect the purposes ofuse and corrections are made to theinformation subsequent to the disclosure of
the information, do you communicate thecorrections to other third parties to whom
the personal information was disclosed? If
YES, describe.

Where the Applicant answers YES, the Accountability Agent must require the Applicant to provide
the procedures the Applicant has in place to communicate corrections to other third parties, to whom
personal information was disclosed.

25. Do you require personal information
processors, agents, or other service
providers acting on your behalf to informyou when they become aware of
information that is inaccurate, incomplete,or out-of-date?

Where the Applicant answers YES, the Accountability Agent must require the Applicant to provide
the procedures the Applicant has in place to receive corrections from personal information
processors, agents, or other service providers to whom personal information was transferred ordisclosed to ensure that personal information processors, agents, or other service providers to whom
personal information was transferred inform the Applicant about any personal information known to
be inaccurate incomplete, or outdated.

The Accountability Agent must verify that these procedures are in place and operational, and thatthey effectively ensure that corrections are made by the processors, agents or other service providers
acting on the Applicant’s behalf.
Where the Applicant answers NO, the Accountability Agent must inform the Applicant thatprocedures to communicate corrections to personal information processors, agent, or other service
providers to whom the personal information was transferred, are required for compliance with thisprinciple.

The Accountability Agent must verify that these procedures are in place and operational.
Where the Applicant answers NO, the Accountability Agent must inform the Applicant thatprocedures to communicate corrections to other third parties to whom personal information wasdisclosed, are required for compliance with this principle.

The Accountability Agent will ensure that the procedures are in place and operational, and, whereappropriate, lead to corrections being made by the Applicant and by the processors, agents or otherservice providers.
Where the Applicant answers NO, the Accountability Agent must inform the Applicant thatprocedures to receive corrections from personal information processors, agents, or other service
providers to whom personal information was transferred or disclosed, are required for compliancewith this principle.

Page | 16

SECURITY SAFEGUARDS
Assessment Purpose - The questions in this section are directed towards ensuring that when individuals entrust their information to an applicant,that applicant will implement reasonable security safeguards to protect individuals’ information from loss,unauthorized access or disclosure, orother misuses
Question
26. Have you implemented an information
security policy?

Assessment Criteria
Where the Applicant answers YES, the Accountability Agent must verify the existence of thiswritten policy.
Where the Applicant answers NO, the Accountability Agent must inform the Applicant that theimplementation of a written information security policy is required for compliance with thisprinciple.

27. Describe the physical, technical andadministrative safeguards you have
implemented to protect personal
information against risks such as loss orunauthorized access, destruction, use,
modification or disclosure of informationor other misuses?

Where the Applicant provides a description of the physical, technical and administrative safeguards
used to protect personal information, the Accountability Agent must verify the existence of such
safeguards, which may include:•

Authentication and access control (eg password protections)•

Encryption•

Boundary protection (eg firewalls, intrusion detection)•

Audit logging•

Monitoring (eg external and internal audits, vulnerability scans)•

Other (specify)

The Applicant must implement reasonable administrative, technical and physical safeguards,
suitable to the Applicant’s size and complexity, the nature and scope of its activities, and thesensitivity of the personal information and/or Third Party personal information it collects, in orderto protect that information from leakage, loss or unauthorized use, alteration, disclosure,
distribution, or access.
Such safeguards must be proportional to the probability and severity of the harm threatened thesensitivity of the information, and the context in which it is held.

Page | 17

The Applicant must take reasonable measures to require information processors, agents, contractors,
or other service providers to whom personal information is transferred to protect against leakage,loss or unauthorized access, destruction, use, modification or disclosure or other misuses of theinformation. The Applicant must periodically review and reassess its security measures to evaluate
their relevance and effectiveness.
Where the Applicant indicates that it has NO physical, technical and administrative safeguards, orinadequate safeguards, to protect personal information, the Accountability Agent must inform theApplicant that the implementation of such safeguards is required for compliance with this principle.
28. Describe how the safeguards you
identified in response to question 27 are
proportional to the likelihood and severityof the harm threatened, the sensitivity of
the information, and the context in which itis held.

Where the Applicant provides a description of the physical, technical and administrative safeguards
used to protect personal information, the Accountability Agent must verify that these safeguards areproportional to the risks identified.

29. Describe how you make youremployees aware of the importance of
maintaining the security of personal
information (e.g. through regular training
and oversight).

The Accountability Agent must verify that the Applicant's employees are aware of the importanceof, and obligations respecting, maintaining the security of personal information through regulartraining and oversight as demonstrated by procedures, which may include:

The Applicant must implement reasonable administrative, technical and physical safeguards,
suitable to the Applicant’s size and complexity, the nature and scope of its activities, and theconfidentiality or sensitivity of the personal information (whether collected directly from theindividuals or through a third party) it gathers, in order to protect that information fromunauthorized leakage, loss, use, alteration, disclosure, distribution, or access.

•Training program for employees•

Regular staff meetings or other communications•

Security policy signed by employees•

Other (specify)

Where the Applicant answers that it does not make employees aware of the importance of, andobligations respecting, maintaining the security of personal information through regular training andoversight, the Accountability Agent has to inform the Applicant that the existence of suchprocedures are required for compliance with this principle.
30. Have you implemented safeguards thatare proportional to the likelihood andWhere the Applicant answers YES (to questions 30.a to 30.d), the Accountability Agent has toverify the existence each of the safeguards.

Page | 18

severity of the harm threatened, thesensitivity of the information, and thecontext in which it is held through:30.a) Employee training and management
or other safeguards?
30.b) Information systems andmanagement, including network andsoftware design, as well as information
processing, storage, transmission, anddisposal?

The safeguards have to be proportional to the probability and severity of the harm threatened, theconfidential nature or sensitivity of the information, and the context in which it is held. The
Applicant must employ suitable and reasonable means, such as encryption, to protect all personal
information.
Where the Applicant answers NO (to questions 30.a to 30.d), the Accountability Agent must informthe Applicant that the existence of safeguards on each category is required for compliance with thisprinciple.

30.c) Detecting, preventing, andresponding to attacks, intrusions, or othersecurity failures?
30.d) Physical security?
31. Have you implemented a policy forsecure disposal of personal information?

Where the Applicant answers YES, the Accountability Agent must verify the implementation of apolicy for the secure disposal of personal information.
Where the Applicant answers NO, the Accountability Agent must inform Applicant that theexistence of a policy for the secure disposal of personal information is required for compliance withthis principle.

32. Have you implemented measures todetect, prevent, and respond to attacks,
intrusions, or other security failures?

Where the Applicant answers YES, the Accountability Agent must verify the existence of measures
to detect, prevent, and respond to attacks, intrusions, or other security failures.

33. Do you have processes in place to test
the effectiveness of the safeguards referred
to above in question 32? Describe below.

The Accountability Agent must verify that such tests are undertaken at appropriate intervals, andthat the Applicant adjusts their security safeguards to reflect the results of these tests.

34. Do you use risk assessments or thirdparty certifications? Describe below.

The Accountability Agent must verify that such risk assessments or certifications are undertaken
at appropriate intervals, and that the Applicant adjusts their security safeguards to reflect the results

Where the Applicant answers NO, the Accountability Agent must inform the Applicant that theexistence of measures to detect, prevent, and respond to attacks, intrusions, or other security
failures, is required for compliance with this principle.

Page | 19

of these certifications or risk assessments. One example is whether privacy compliance audits arecarried out by the Applicant and if audits are carried out, the Accountability Agent must verify
whether recommendations made in the audits are implemented.
35. Do you require personal information
processors, agents, contractors, or otherservice providers to whom you transfer
personal information to protect against
loss, or unauthorized access, destruction,use, modification or disclosure or othermisuses of the information by:

The Accountability Agent must verify that the Applicant has taken reasonable measures (such as byinclusion of appropriate contractual provisions) to require information processors, agents,
contractors, or other service providers to whom personal information is transferred, to protect
against leakage, loss or unauthorized access, destruction, use, modification or disclosure or othermisuses of the information. The Applicant must periodically review and reassess its security
measures to evaluate their relevance and effectiveness.

35.a) Implementing an information security
program that is proportionate to thesensitivity of the information and services
provided?
35.b) Notifying you promptly when they
become aware of an occurrence of breachof the privacy or security of thepersonal
information of the Applicant’s customers?
35.c) Taking immediate steps tocorrect/address the security failure whichcaused the privacy or security breach?

Page | 20

ACCESS AND CORRECTION
Assessment Purpose - The questions in this section are directed towards ensuring that individuals are able to access and correct theirinformation. This section includes specific conditions for what would be considered reasonable in the provision of access. Access will also be
conditioned by security requirements that preclude the provision of direct access to information and will require sufficient proof of identity prior toprovision of access. The details of the procedures whereby the ability to access and correct information is provided may differ depending on thenature of the information and other interests, which is why, in certain circumstances, it may be impossible, impracticable or unnecessary tochange, suppress or delete records.
The ability to access and correct personal information, while generally regarded as a central aspect of privacy protection, is not an absolute right.
While you should always make good faith efforts to provide access, in some situations, it may be necessary to deny claims for access andcorrection. Section II of the CBPR Self-Assessment Guidelines for Organisations sets out those conditions that must be met in order for suchdenials to be considered acceptable. When you deny a request for access, for the reasons specified herein, you should provide the requesting
individual with an explanation as to why you have made that determination and information on how to challenge that denial. You would not be
expected to provide an explanation, however, in cases where such disclosure would violate a law or judicial order. Refer to the APEC Cross
Border Privacy Rules Intake Questionnaire for a list of acceptable Qualifications to the provision of access and correction mechanisms.

Question
36. Upon request, do you provide
confirmation of whether or not you holdpersonal information about the requesting
individual? Describe below.

Assessment Criteria
Where the Applicant answers YES, the Accountability Agent must verify that the Applicant has
procedures in place to respond to such requests.
The Applicant must grant access to any individual, to personal information collected or gathered
about that individual, upon receipt of sufficient information confirming the individual’s identity.
The Applicant’s processes or mechanisms for access by individuals to personal information must be
reasonable having regard to the manner of request and the nature of the personal information.
The personal information must be provided to individuals in an easily comprehensible way.
The Applicant must provide the individual with a time frame indicating when the requested accesswill be granted.
Where the Applicant answers NO and does not identify an applicable qualification, the
Accountability Agent must inform the Applicant that the existence of written procedures to respondto such requests is required for compliance with this principle. Where the Applicant identifies anPage | 21

applicable qualification, the Accountability Agent must verify whether the applicable qualification
is justified.
37. Upon request, do you provide
individuals access to the personal
information that you hold about them?
Where YES, answer questions 37(a) – (e)and describe your applicant's
policies/procedures for receiving andhandling access requests. Where NO,
proceed to question 38.
37.a) Do you take steps to confirm theidentity of the individual requesting
access? If YES, please describe.

Where the Applicant answers YES the Accountability Agent must verify each answer provided.
The Applicant must implement reasonable and suitable processes or mechanisms to enable theindividuals to access their personal information, such as account or contact information.
If the Applicant denies access to personal information, it must explain to the individual why access
was denied, and provide the appropriate contact information for challenging the denial of accesswhere appropriate.
Where the Applicant answers NO and does not identify an applicable qualification, the
Accountability Agent must inform the Applicant that it may be required to permit access by
individuals to their personal information. Where the Applicant identifies an applicable qualification,
the Accountability Agent must verify whether the applicable qualification is justified.

37.b) Do you provide access within areasonable time frame following an
individual’s request for access? If YES,
please describe.
37.c) Is information communicated in areasonable manner that is generally
understandable (in a legible format)?
Please describe.
37.d) Is information provided in a way thatis compatible with the regular form ofinteraction with the individual (e.g. email,same language, etc)?
37.e) Do you charge a fee for providing
access? If YES, describe below on what thefee is based and how you ensure that thefee is not excessive.
38. Do you permit individuals to challenge
the accuracy of their information, and to

Where the Applicant answers YES to questions 38.a, the Accountability Agent must verify that

Page | 22have it rectified, completed, amended
and/or deleted? Describe your applicant's
policies/procedures in this regard below
and answer questions 37 (a), (b), (c), (d)and (e).
38.a) Are your access and correction
mechanisms presented in a clear andconspicuous manner? Provide a
description in the space below or in an
attachment if necessary.
38.b) If an individual demonstrates that
personal information about them isincomplete or incorrect, do you make therequested correction, addition, or whereappropriate, deletion?

such policies are available and understandable in the primarily targeted economy.
If the Applicant denies correction to the individual’s personal information, it must explain to theindividual why the correction request was denied, and provide the appropriate contact information
for challenging the denial of correction where appropriate.
All access and correction mechanisms have to be simple and easy to use, presented in a clear andvisible manner, operate within a reasonable time frame, and confirm to individuals that the
inaccuracies have been corrected, amended or deleted. Such mechanisms could include, but are notlimited to, accepting written or e-mailed information requests, and having an employee copy therelevant information and send it to the requesting individual.
Where the Applicant answers NO to questions 38a-38e and does not identify an applicablequalification, the Accountability Agent must inform the Applicant that the existence of written
procedures to respond to such requests is required for compliance with this principle. Where theApplicant identifies an applicable qualification, the Accountability Agent must verify whether theapplicable qualification is justified.

38.c) Do you make such corrections ordeletions within a reasonable time frame
following an individual’s request forcorrection or deletion?
38.d) Do you provide a copy to theindividual of the corrected personal
information or provide confirmation thatthe data has been corrected or deleted?
38.e) If access or correction is refused,
do you provide the individual with an
explanation of why access or correction
will not be provided, together with contact
information for further inquiries about thedenial of access or correction?

Page | 23

ACCOUNTABILITY
Assessment Purpose - The questions in this section are directed towards ensuring that the Applicant is accountable for complying with measuresthat give effect to the other Principles stated above. Additionally, when transferring information, the Applicant should be accountable for ensuringthat the recipient will protect the information consistently with these Principles when not obtaining consent. Thus, you should take reasonable
steps to ensure the information is protected, in accordance with these Principles, after it is transferred. However, there are certain situations wheresuch due diligence may be impractical or impossible, for example, when there is no on-going relationship between you and the third party to whom
the information is disclosed. In these types of circumstances, you may choose to use other means, such as obtaining consent, to assure that the
information is being protected consistently with these Principles. However, in cases where disclosures are required by domestic law, you would be
relieved of any due diligence or consent obligations.

Question
39. What measures do you take to ensurecompliance with the APEC Information
Privacy Principles? Please check all that
apply and describe.

Assessment Criteria
The Accountability Agent has to verify that the Applicant indicates the measures it takes to ensurecompliance with the APEC Information Privacy Principles.

• Internal guidelines or policies (ifapplicable, describe how implemented)•

Contracts• Compliance with applicableindustry or sector laws and regulations• Compliance with self-regulatory
applicant code and/or rules•

Other (describe)

40. Have you appointed an individual(s) tobe responsible for your overall compliance

Where the Applicant answers YES, the Accountability Agent must verify that the Applicant has
designated an employee(s) who is responsible for the Applicant’s overall compliance with these

Page | 24

with the Privacy Principles?

Principles.
The Applicant must designate an individual or individuals to be responsible for the Applicant’s
overall compliance with privacy principles as described in its Privacy Statement, and must
implement opportune procedures to receive, investigate, and respond to privacy-related complaints,
providing an explanation of any remedial action where applicable.
Where the Applicant answers NO, the Accountability Agent must inform the Applicant thatdesignation of such an employee(s) is required for compliance with this principle.

41. Do you have procedures in place toreceive, investigate and respond to privacyrelated complaints? Please describe.

Where the Applicant answers YES, the Accountability Agent must verify that the Applicant has
procedures in place to receive, investigate and respond to privacy-related complaints, such as:1) A description of how individuals may submit complaints to the Applicant (e.g.
Email/Phone/Fax/Postal Mail/Online Form); AND/OR
2) A designated employee(s) to handle complaints related to the Applicant’s compliancewith the 2015 APEC Privacy Framework and/or requests from individuals for accessto personal information; AND/OR
3) A formal complaint-resolution process; AND/OR
4) Other (must specify).
Where the Applicant answers NO, the Accountability Agent must inform the Applicant that
implementation of such procedures is required for compliance with this principle.

42. Do you have procedures in place toensure individuals receive a timely
response to their complaints?

Where the Applicant answers YES, the Accountability Agent must verify that the Applicant has
procedures in place to ensure individuals receive a timely response to their complaints.

43. If YES, does this response include an
explanation of remedial action relating totheir complaint? Describe.

The Accountability Agent must verify that the Applicant indicates what remedial action isconsidered.

44. Do you have procedures in place fortraining employees with respect to yourprivacy policies and procedures, including

Where the Applicant answers YES, the Accountability Agent must verify that the Applicant has
procedures regarding training employees with respect to its privacy policies and procedures,
including how to respond to privacy-related complaints.

Where the Applicant answers NO, the Accountability Agent must inform the Applicant that
implementation of such procedures is required for compliance with this principle.

Page | 25

how to respond to privacy-related
complaints? If YES, describe.

Where the Applicant answers that it does not have procedures regarding training employees withrespect to their privacy policies and procedures, including how to respond to privacy-related
complaints, the Accountability Agent must inform the Applicant that the existence of suchprocedures is required for compliance with this principle.

45. Do you have procedures in place forresponding to judicial or other government
subpoenas, warrants or orders, including
those that require the disclosure of personal
information?

Where the Applicant answers YES, the Accountability Agent must verify that the Applicant has
procedures in place for responding to judicial or other government subpoenas, warrants or orders,
including those that require the disclosure of personal information, as well as provide the necessary
training to employees regarding this subject.

46. Do you have mechanisms in place withpersonal information processors, agents,
contractors, or other service providers
pertaining to personal information they
process on your behalf, to ensure that yourobligations to the individual will be met(check all that apply)?

Where the Applicant answers YES, the Accountability Agent must verify the existence of each typeof agreement described.

•

Internal guidelines or policies•

Contracts

Where the Applicant answers NO, the Accountability Agent must inform the Applicant that suchprocedures are required for compliance with this principle.

Where the Applicant answers NO, the Accountability Agent must inform the Applicant that
implementation of such agreements is required for compliance with this principle.

• Compliance with applicableindustry or sector laws and regulations• Compliance with self-regulatory
applicant code and/or rules•

Other (describe)

47. Do these agreements generally requirethat personal information processors,
agents, contractors or other service

The Accountability Agent must verify that the Applicant makes use of appropriate methods toensure their obligations are met.

Page | 26

providers:• Abide by your APEC-compliant
privacy policies and practices as statedin your Privacy Statement?
• Implement privacy practices thatare substantially similar to yourpolicies or privacy practices as statedin your Privacy Statement?
• Follow instructions provided by
you relating to the manner in whichyour personal information must be
handled?
• Impose restrictions on
subcontracting unless with yourconsent?
• Have their CBPRs certified by an
APEC accountability agent in theirjurisdiction?
• Notify the Applicant in the case ofa breach of the personal information of
the Applicant’s customers?
•

Other (describe)

48. Do you require your personal
information processors, agents, contractors
or other service providers to provide youwith self-assessments to ensure compliancewith your instructions and/or
agreements/contracts? If YES, describe
below.

The Accountability Agent must verify the existence of such self-assessments.

49. Do you carry out regular spot checking

Where the Applicant answers YES, the Accountability Agent must verify the existence of the

Page | 27

or monitoring of your personal information
processors, agents, contractors or otherservice providers to ensure compliancewith your instructions and/or
agreements/contracts? If YES, describe.

Applicant’s procedures such as spot checking or monitoring mechanisms.

50. Do you disclose personal information
to other recipient persons or organisations
in situations where due diligence andreasonable steps to ensure compliance withyour APEC CBPRs by the recipient as
described above is impractical or
impossible?

If YES, the Accountability Agent must ask the Applicant to explain:

Where the Applicant answers NO, the Accountability Agent must require the Applicant to describe
why it does not make use of such spot checking or monitoring mechanisms.

(1) why due diligence and reasonable steps consistent with the above Assessment Criteria foraccountable transfers are impractical or impossible to perform; and(2) the other means used by the Applicant for ensuring that the information, nevertheless, isprotected consistent with the APEC Privacy Principles. Where the Applicant relies on an
individual’s consent, the Applicant must explain to the satisfaction of the Accountability Agent thenature of the consent and how it was obtained.

Page | 28