What is CBPR?
CBPR (Cross-Border Privacy Rules), told as a story about a pass several neighboring kingdoms agreed in advance to honor.
Every neighboring kingdom has a different border rule.A merchant wants to carry a guest ledger (personal data) abroad — but every kingdom's rule is its own.
Each border meant starting the inspection all over again.Clear border A, and border B still starts from zero. So moving the ledger is slow, and the standard shifts at each border.
CBPR is a pass several kingdoms agreed in advance to honor.An independent inspector (an accountability agent) certifies once, and that counts as proof of meeting the participants' common standard. Each kingdom's own law still applies. → the cross-border version of compliance.
Here's the difference CBPR makes.The same border crossing — but whether the kingdoms pre-agreed changes how fast the ledger gets through.
The CBPR pass doesn't work with every kingdom.CBPR only works among the economies that opted in. The castle's own privacy law still applies on top → the Three Data Acts, privacy
CBPR = a pass for moving personal data that several neighboring kingdoms agreed in advance to honor. An independent inspector certifies once, and that counts among participants as proof of meeting the common standard.
CBPR, Cross-Border Privacy Rules — a cross-border data transfer certification created by APEC. A company that passes review by an Accountability Agent earns CBPR certification, which proves it follows the common privacy standard the participants agreed on. Whether a country accepts that certification as a legal basis for cross-border transfer depends on its own law. As of November 2026, ISMS-P is the only certification designated under Article 28-8 of Korea's Personal Information Protection Act, so CBPR certification alone doesn't meet that ground. It is valid only among participating economies, and each country's own domestic privacy law still applies on top. In 2022 a separate Global CBPR Forum opened participation beyond APEC, and Global CBPR certification began in June 2025. The APEC and Global certifications are administered separately.
When grown-ups say it
- Cross-Border Privacy Rules
- A pass several kingdoms pre-agreed to honor. A certification, started in APEC, that helps personal data move among participating economies.
- APEC
- The group of kingdoms that created CBPR. Asia-Pacific Economic Cooperation — it built the CBPR framework.
- Accountability Agent
- The independent inspector who checks. The third-party body that actually reviews a company's CBPR compliance.
- Cross-border transfer
- Carrying the guest ledger to another kingdom. One of the central issues in privacy protection. → the visitor's name tag belongs to the visitor
- Personal Information Protection Commission
- Our own castle's supervising office. Domestic law oversight is separate from CBPR, and sits here. → the Three Data Acts amendment
- GDPR
- The European Union's data-protection law. CBPR is a certification a company opts into; GDPR is a law that binds whoever it covers.
- Local law still applies
- The castle's own law still applies on top. CBPR certification doesn't replace the domestic privacy law.
- MyData
- The guest's own right to move their ledger. CBPR covers transfers between companies; MyData is the guest's own request to move it. → MyData