Plug into more global business opportunities. These certifications facilitate how your business can seamlessly exchange personal data across APEC member economies while respecting privacy and security.
The APEC CBPR System was developed by APEC economies to build consumer, business and regulator trust in cross border flows of personal data. The APEC CBPR System requires participating businesses to implement data privacy policies consistent with the APEC Privacy Framework and helps to bridge differing national privacy laws within the APEC region, reducing barriers to the flow of information for global trade.
The CBPR System applies to organisations (data controllers) that control the collection, holding, processing, or use of personal data and enables certified organisations across APEC economies to exchange personal data more seamlessly.
The APEC CBPR certification is based on the APEC Privacy Framework which features nine privacy principles: Accountability, Prevent Harm, Notice, Choice, Collection Limitation, Use of Personal Information, Integrity of Personal Information, Security Safeguards and Access and Correction. The framework was endorsed by 21 APEC economies to promote accountable and responsible transfers of personal information between the APEC economies.
Singapore recognises the APEC CBPR and PRP certifications for overseas transfers of personal data under the PDPA. This means that organisations in Singapore can easily transfer personal data to the overseas certified recipient without meeting additional requirements.
- Template contract clause for transfers of data to overseas recipients that hold CBPR or PRP certifications can be found here
- Learn about the announcement here
The directory of CBPR-certified organisations can be found here.
To learn more:
- CBPR Information Kit (468.08KB) (updated 3 Mar 2021)
- APEC CBPR/PRP Brochure (2.14MB)(updated 17 Jun 2020)
- IMDA’s Accountability Agent Participation Documents
- Other IMDA Data Protection Certifications:
Who can apply?
To be eligible, your organisation must be subject to the laws of Singapore.
Interested organisations (also known as data controllers) that control the collection, holding, processing, or use of data can apply for APEC CBPR. They should be either (1) formed or recognised under the laws of Singapore, or (2) resident, or having an office or a place of business, in Singapore, and in any case, not a public agency (as defined in the Personal Data Protection Act 2012).
Upon submission of the application, the Applicant Organisation is bound by the Terms of Agreement (758.72KB) of the APEC CBPR scheme.
To apply, click here.
Application fee* of $535 (inclusive of GST) is payable to IMDA.
Assessment fee, payable to the Assessment Body, ranges and depends on the size of the organisation (e.g. annual sales turnover, no. of sites, etc) and the Assessment Body you engaged. Please approach the Assessment Bodies listed in this website for a quotation to confirm the actual fee.
To encourage organisations to take up more than one certification (i.e. DPTM, CBPR and PRP), one application fee of $535 (inclusive of GST) is payable to IMDA when organisations apply for multiple certifications in a single application process.
*Application fee is waived for SMEs till 30 Jun 2021.
The Assessment Body (AB) acts as an independent body to assess that an organisation’s data protection practices conform to the APEC CBPR requirements. An organisation may select any of the following five ABs:
|Assessment Body||Contact Person||Contact No|
|BSI Group Singapore||Stella Kong||6270 0777||DPTM@bsigroup.com|
|EPI Certification Pte Ltd||May Cheow||8823 3347||Auditemail@example.com|
|ISOCert Pte Ltd|
Saju S Pillai
9475 5120 / 6659 0810
|Setsco Services Pte Ltd||Dixon Ng||9795 9875 / 6895 firstname.lastname@example.org|
|Laura Koh||6895 email@example.com|
|TUV SUD PSB Pte Ltd||Lau Boon Cheng||8383 8696||DP_Trustmark@tuv-sud-psb.sg|
CBPR Certification Requirements and Support Details
The CBPR certification is based on the APEC Privacy Framework which features nine privacy principles: Accountability, Prevent Harm, Notice, Choice, Collection Limitation, Use of Personal Information, Integrity of Personal Information, Security Safeguards and Access and Correction. The framework was endorsed by 21 APEC economies to promote accountable and responsible transfers of personal information between the APEC economies.
Eligible organisations can consider applying to Enterprise Singapore (ESG) to seek support for some of the costs for APEC CBPR certification and consultancy services. Details on the criteria and application process can be found below:
Interested organisations may refer to this Quick Guide on Enterprise Development Grant Application (222.17KB).
#To help companies during this COVID-19 situation, the maximum support level has been raised from 70% to 80% till 31 March 2022.
Professional Consultancy Services:
Organisations can refer to the List of Data Protection Service Providers if they wish to engage professional consultancy services to prepare them for the APEC CBPR certification.