APEC CBPR system requirements for economies

  1. APEC CBPR system participation is limited to APEC member economies.
  2. Your economy must participate in the APEC Cross-border Privacy Enforcement Arrangement (CPEA) with a least one Privacy Enforcement Authority. The CPEA provides a framework for regional cooperation in the enforcement of privacy and data protection laws throughout the APEC region. There are currently 27 participating Privacy Enforcement Authorities from 11 APEC economies (Australia, Canada, Chinese Taipei, Hong Kong, Japan, Republic of Korea, New Zealand, US, Mexico, Singapore, and the Philippines). More information about the CPEA can be found here.
  3. Your economy must express its intention to participate in the APEC CBPR system by submitting a letter addressed to the APEC Electronic Commerce Steering Group (ECSG) Chair, the APEC ECSG Data Privacy Subgroup Chair and the APEC CBPR system Joint Oversight Panel (JOP) Chair containing:
    1. Confirmation that your economy has a Privacy Enforcement Authority that is a participant in the APEC CPEA;
    2. Confirmation that your economy intends to use at least one named APEC CBPR system recognised Accountability Agent OR that your economy intends to use at least one APEC CBPR system recognised Accountability Agent once it has/they have been approved; and
    3. Details of relevant domestic laws, regulations and administrative measures which may apply to Accountability Agents operating within your jurisdiction AND the relevant authority or authorities responsible for enforcement of those laws, regulations and administrative measures AND how those domestic laws, regulations and administrative measures could be enforced.
  4. Your economy must complete the APEC Cross Border Privacy Rules System Program Requirements Enforcement Map with details of relevant domestic laws, regulations and administrative measures that would have the effect of protecting personal information consistent with the APEC CBPR system requirements AND how they would be enforced with respect to organisations operating from or within an economy’s jurisdiction. Template notice of intent and enforcement map
  5. Once the above information is received, the JOP Chair will initiate a consultation process. If further information is needed before the JOP can make a determination, this will be requested during the consultation process. At the end of the consultation process, the JOP will issue a findings report with its determination (by simple majority) as to whether the economy requirements have been met. If the JOP determines that the requirements have been met, your economy becomes an APEC CBPR system participant from the date of the JOP findings report.

The JOP findings report (including any dissenting JOP opinion), letter of intent, completed CBPR Program Requirements Enforcement Map, and any other relevant supporting documentation will be made publicly available on this website after the process is complete.