APEC Cross-Border Privacy Rules (CBPR) System

The APEC CBPR System was developed by APEC economies to build consumer, business, and regulator trust in cross border flows of personal data. The APEC CBPR System requires participating businesses to implement data privacy regulations and policies consistent with the APEC Privacy Framework and helps to bridge differing national privacy laws within the APEC region, reducing barriers to the flow of information for global trade.

The CBPR System applies to organisations (data controllers) that control the collection, holding, processing, or use of personal data and enables certified organisations across APEC economies to exchange personal data more seamlessly.

The APEC CBPR certification is based on the APEC Privacy Framework which features nine privacy principles: Accountability, Prevent Harm, Notice, Choice, Collection Limitation, Use of Personal Information, Integrity of Personal Information, Security Safeguards, and Access and Correction. The framework was endorsed by 21 APEC economies to promote accountable and responsible transfers of personal information between the APEC economies.

To become APEC CBPR certified, organisations must implement data protection, privacy policies and practices which meet the Program Requirements for all data collected or received that is within the scope of its certification.

The intake questionnaire for organisations considering certification and detailed program requirements are available here:

• APEC CBPR Intake Questionnaire (112.63KB)
• APEC CBPR Program Requirements (153.34KB)

Singapore recognises the APEC CBPR and PRP certifications for overseas transfers of personal data under the PDPA. This move enhances data privacy and security for individuals and enables organisations in Singapore can easily transfer personal data to overseas certified recipients without meeting additional requirements.

• Template contract clause for transfers of data to overseas recipients that hold CBPR or PRP certifications

To be eligible, your organisation must be subject to the laws of Singapore.

Interested organisations (also known as data controllers) that control the collection, holding, processing, or use of data can apply for APEC CBPR. They should be either (1) formed or recognised under the laws of Singapore, or (2) resident, or having an office or a place of business, in Singapore, and in any case, not a public agency (as defined in the Personal Data Protection Act 2012). Certification is also subject to organisations’ acceptance of the terms of agreement (448.16KB) of the APEC CBPR scheme.

Organisations seeking certification are to complete the CBPR self-assessment form (415.44KB) and then submit the form to any of the following IMDA appointed assessment bodies listed below.

The assessment body* acts as an independent body to assess that an organisation’s data protection practices conform to the APEC CBPR requirements.

The assessment fee, payable to the assessment body, ranges and depends on the size of the organisation (e.g. annual sales turnover, no. of sites, etc) and the assessment body engaged. For a more accurate cost, approach any of the assessment bodies listed above for a quotation.

*For more information on how to be an Assessment Body, please refer to our information kit (337.90KB).

To learn more:

• The directory of APEC CBPR-certified organisations
• Global / APEC CBPR Information Kit (308.25KB)
• APEC CBPR Success Story
• Other IMDA Data Protection Certifications:
• Data Protection Trustmark
• APEC Privacy Recognition for Processors System
• Global Cross-Border Privacy Rules System
• Global Privacy Recognition for Processors System

Funding support:

Eligible organisations can consider applying to Enterprise Singapore (ESG) to seek support for some of the costs for APEC CBPR certification and consultancy services. Details on the criteria and application process can be found below:

• ESG Enterprise Development Grant

Interested organisations may refer to this Quick Guide on Enterprise Development Grant Application (256.46KB).

Professional consultancy services:

Organisations can refer to the list of Consultancy Service Providers (under DPTM Requirements and Resources section) if they wish to engage professional consultancy services to prepare them for the APEC CBPR certification.

For questions, please refer to our FAQs  or contact us at Data_Protection_Certifications@imda.gov.sg or 6377 3800.