| CARVIEW |
Privacy Assessments
Global CBPR & PRP Certification
The Global Cross-Border Privacy Rules (CBPR) & Privacy Recognition for Processors (PRP) Framework enables participating economies to establish trusted cross-border data flows despite varying legislative requirements.
System Overview
In 2022, the Global CBPR Forum was founded by Australia, Canada, Japan, the Republic of Korea, Mexico, the Philippines, Singapore, Chinese Taipei, and the United States to support the free flow of data and effective data protection and privacy globally. Additional jurisdictions have joined since its founding such as the United Kingdom, Bermuda, Dubai Financial Center, Mauritius, and Nigeria, with more announcing intent to join every year.
To be full participating members of the CBPR System, jurisdictions must establish enforcement authorities for oversight and have at least one accountability agent, which could be a government organization formed or endorsed by the jurisdiction, or a private organization that has been approved by the Joint Oversight Panel. Accountability agents, like Schellman, are then responsible for certifying organizations that would like to participate in the CBPR System against the established minimum requirements for their respective role(s).
System Overview
In 2022, the Global CBPR Forum was founded by Australia, Canada, Japan, the Republic of Korea, Mexico, the Philippines, Singapore, Chinese Taipei, and the United States to support the free flow of data and effective data protection and privacy globally. Additional jurisdictions have joined since its founding, such as the United Kingdom, Bermuda, Dubai Financial Center, and Mauritius, with more announcing intent to join every year.
The Global CBPR System was established in 2025, expanding the existing APEC CBPR System to jurisdictions outside of the APEC Member Economies. The Global CBPR System encourages the flow of personal data across borders internationally via its Cross Border Privacy Rules (CBPR) and Privacy Recognition for Processors (PRP) requirements and available certifications. The CBPR certification established for organizations in the controller role while the PRP certification being implemented for organizations in the processor role. Accountability agents, like Schellman, are available in a number of member jurisdictions to then certify organizations that would like to participate in the CBPR System against the established minimum requirements for their respective role(s).
CBPR Minimum Requirements
Schellman’s Global CBPR Certification program evaluates a United States based organization that serves in the role of a controller and collects personal information that is transferred between participating economies.
The organization is assessed against the CBPR minimum certification requirements noted below.
Notice
The privacy notice or statement must provide clear and easily accessible statements about your practices and policies that govern personal information and must include the following:
- The privacy notice or statement must provide clear and easily accessible statements about your practices and policies that govern personal information and must include the following:
- Outline the services provided by the notice or statement;
- Be available on the client’s Website, such as text on a Web page, link from URL, attached document, pop-up windows, or included in frequently asked questions (FAQs);
- Be easy to find and be accessible;
- Include an effective date;
- Name of the organization and location;
- Include information on how to contact the organization about the practices and handling of personal information upon collection;
- Apply to all personal information, whether collected online or offline;
- Describe the collection practices and policies applied to all covered personal information collected by the client (i.e., how your organization collects personal information);
- Indicate what types of personal information, whether collected directly or through a third party or agent, are collected;
- Report the categories or specific sources of all categories of personal information collected;
- Describe the purpose(s) for which personal information is collected;
- Inform individuals as to whether information is shared with third parties and for what purpose you make personal information available to third parties including the identification of the categories or specific third parties;
- Include information regarding the use and disclosure of an individual’s personal information;
- Include information regarding whether and how an individual can access and correct their personal information including the following:
- The process through which the individual may access his or her personal information (including electronic or traditional non-electronic means);
- The process that an individual must follow in order to correct his or her personal information;
- Provide notice to the individual at the time of collection of personal information, whether directly or through the use of third parties acting on your behalf, that such information is being collected*;
- Indicate the purpose(s) for which personal information is being collected at the time of collection of personal information, whether directly or through the use of third parties acting on your behalf*(the communication must be in writing, for example on the Applicant’s website, such as text on a website link from URL, attached documents, pop-up window, or other);
- Provide notice to the individual at the time of collection of personal information, that their personal information may be shared with third parties.*
* The following are situations in which the application at the time of collection of the APEC Notice Principle may not be necessary or practical. Justification for any of the following will be required.
Obviousness: Personal Information controllers do not need to provide notice of the collection, use or third-party sharing of personal information in those circumstances where consent by the individual can be inferred from the provision of the individual’s information (e.g. if an individual gives his or her business card to another individual in the context of a business relationship, the individual would not expect that notice would be provided regarding the collection and normal use of that information).
Collection of Publicly-Available Information: Personal information controllers do not need to provide notice regarding the collection and use of publicly available information.
Technological Impracticability: Personal Information controllers do not need to provide notice at or before the time of collection in those cases where electronic technology automatically collects information when a prospective customer initiates contact (e.g. through the use of cookies). However, the notice should be provided to the individuals as soon after as is practicable.
Disclosure to a government institution which has made a request for the information with lawful authority: Personal information controllers do not need to provide notice of disclosure to law enforcement agencies for investigation purposes where the provision of such notice to the individual will likely prejudice the investigation.
Disclosure to a third party pursuant to a lawful form of process: Personal information controllers do not need to provide notice of disclosure to a third party when such disclosure was requested pursuant to a lawful form of process such as a discovery request made in the course of civil litigation.
Third-Party Receipt: Where personal information is received from a third party, the recipient personal information controller does not need to provide notice to the individuals at or before the time of collection of the information.
For legitimate investigation purposes: When providing notice would compromise the availability or accuracy of the information and the collection, use and disclosure are reasonable for purposes relating to an internal or external investigation of a violation of a code of conduct, breach of contract or a contravention of domestic law.
Action in the event of an emergency: Personal Information controllers do not need to provide notice in emergency situations that threaten the life, health or security of an individual.
Collection
- The collection of personal information must be limited to information that is relevant to the purposes of collection, consistent with the requirements of the jurisdiction where data was collected, and any such information should be obtained by lawful and fair means, and where appropriate, with notice to, or consent of, the individual concerned.
- Identify the type of data collected, the economies where data is collected, the source (i.e., the individual or a third party) and the corresponding purposes and use of collection for each type of data.
Use
- Personal information collected must be used only to fulfill the purposes of collection and other compatible or related purposes as identified in the privacy statement and/or in the notice provided at the time of collection except for one of the following:
- With the consent of the individual whose personal information is collected;
- Consent must be a documented description or documentation that consent was obtained
- When necessary to provide a service or product requested by the individual; or
- A description must be documented of how the disclosure and/or transfer of collected personal information is necessary to provide a service or product requested by the individual
- By the authority of law and other legal instruments, proclamations and pronouncements of legal effect.
- A description must be documented of how collected information shared, used or disclosed as compelled by law including the legal requirements under which it is compelled to share the personal information, unless the client is bound by confidentiality requirements for the purposes of this Principle, uses of personal information include the transfer or disclosure of personal information.
- With the consent of the individual whose personal information is collected;
- If personal information is disclosed to other personal information controllers or transferred to processors, such disclosure and/or transfer must be undertaken to fulfill the original purpose of collection or another compatible or related purpose, unless based upon the express consent of the individual necessary to provide a service or product requested by the individual or compelled by law.
- Identify the type of data disclosed or transferred, the economies where data was transferred, the corresponding purpose of collection for each type of disclosed data, and the manner in which the disclosure fulfills the identified purpose (e.g. order fulfillment etc.).
Choice
- A mechanism* must be provided for individuals to exercise choice in relation to the collection of their personal information.
- A mechanism* must be provided for individuals to exercise choice in relation to the use of their personal information. Subject to the qualifications* outlined below, the opportunity to exercise choice should be provided to the individual at the time of collection, for subsequent uses of personal information. The opportunity to exercise choice may be provided to the individual after collection, but before:
- Being able to make use of the personal information, when the purposes of such use is not related or compatible to the purpose for which the information was collected, and
- Personal information may be disclosed or distributed to third parties, other than Service Providers.
- A mechanism* must be provided for individuals to exercise choice in relation to the disclosure of their personal information. Subject to the qualifications outlined below, the opportunity to exercise choice should be provided to the individual at the time of collection, for subsequent disclosures of personal information. The opportunity to exercise choice may be provided to the individual after collection, but before:
- Disclosing the personal information to third parties, other than Service Providers.
- Choices must be displayed or provided in a clear and conspicuous manner, clearly worded and easily understandable, and easily accessible and affordable.
*The following are situations in which the application of the APEC Choice Principle may not be necessary or practical. Justification for any of the following will be required.
Obviousness: Personal Information controllers do not need to provide a mechanism for individuals to exercise choice in the collection, use or third-party sharing of personal information in those circumstances where consent by the individual can be inferred from the provision of the individual’s information.
Collection of Publicly-Available Information: Personal information controllers do not need to provide a mechanism for individuals to exercise choice in relation to the collection and use of publicly available information.
Technological Impracticability: Personal Information controllers do not need to provide a mechanism for individuals to exercise choice in relation to those cases where electronic technology automatically collects information when a prospective customer initiates contact [e.g. use of cookies]. However, a mechanism to exercise choice as to use and disclosure should be provided after collection of the information.
Third-Party Receipt: Where personal information is received from a third party, the recipient personal information controller does not need to provide a mechanism for individuals to exercise choice in relation to the collection of the information. However, if the personal information controller engages a third party to collect personal information on its behalf, the personal information controller should instruct the collector to provide such choice when collecting the personal information.
Disclosure to a government institution which has made a request for the information with lawful authority: Personal Information controllers do not need to provide a mechanism for individuals to exercise choice in relation to disclosure to law enforcement agencies for investigation purposes where the provision of such mechanism to the individual will likely prejudice the investigation.
Disclosure to a third party pursuant to a lawful form of process: Personal information controllers do not need to provide a mechanism for individuals to exercise choice in relation to the disclosure to a third party when such disclosure was requested pursuant to a lawful form of process such as a discovery request made in the course of civil litigation.
For legitimate investigation purposes: When providing a mechanism for individuals to exercise choice would compromise the availability or accuracy of the personal information and its collection, use and disclosure are reasonable for purposes relating to an internal or external investigation of a violation of a code of conduct, breach of contract or a contravention of domestic law.
Action in the event of an emergency: Personal Information controllers do not need to provide a mechanism for individuals to exercise choice in emergency situations that threaten the life, health or security of an individual.
Integrity of Personal Information
- Personal information must be accurate, complete and kept up-to date to the extent necessary for the purposes of use.
- Provide individuals the ability to challenge the accuracy of their personal information and to have it rectified, completed, amended and/or deleted and ensure procedures are in place to complete the request including communication and confirmation of the request to processors, agent, or other service providers to whom the personal information was transferred. Access and correction mechanisms must be presented in a clear and conspicuous manner. The request should be completed within a reasonable time frame following the request and a confirmation should be provided that the request has been completed.
- If correction is denied, an explanation should be provided, together with contact information for further inquiries about the denial of access or correction
- Require processors, agents, or other service providers acting on your behalf to inform you when they become aware of information that is inaccurate, incomplete, or out-of-date and ensure procedures are in place to complete the correction.
Security Safeguards
- Maintain a written information security policy.
- Implement physical, technical and administrative safeguards to protect personal information against risks such as loss or unauthorized access, destruction, use, modification or disclosure of information or other misuses. Such safeguards should be proportional to the likelihood and severity of the harm threatened, the sensitivity of the information and the context in which it is held, and should be subject to periodic review and reassessment.
- Communicate to employees their obligations and the importance of maintaining the security of personal information.
- Require information processors, agents, contractors, or other service providers to whom personal information is transferred to protect against leakage, loss or unauthorized access, destruction, use, modification or disclosure or other misuses of the information. Such requirement should include:
- Implementing an information security program that is proportionate to the sensitivity of the information and services provided
- Notifying you promptly when they become aware of an occurrence of breach of the privacy or security of the personal information
- Taking immediate steps to correct/address the security failure which caused the privacy or security breach
- Maintain a policy for secure disposal of personal information.
- Implement procedures to detect, prevent, and respond to attacks, intrusions, or other security failures.
- Perform tests on a periodic basis on the effectiveness of the implemented physical, technical and administrative safeguards.
- Perform risk assessments or third-party validations on a periodic basis that include the implemented physical, technical and administrative safeguards and review the results of the assessment or third-party validation for remediation.
Access*
-
Provide individuals the ability to obtain confirmation of whether or not personal information is held about the requesting individual.
-
If requested, provide individuals access to their personal information. Prior to providing access, confirm the identity of the individual requesting access. Provide access within a reasonable time frame following the request and communicate the information in a reasonable manner that is generally understandable, in a legible format and compatible with the regular form of interaction with the individual.
-
If a fee is charged for providing access, the fees should not be excessive.
-
If the individual is denied access, an explanation must be provided as to why access was denied and provide the appropriate contact information for challenging the denial of access where appropriate.
*Although organizations should always make good faith efforts to provide access, there are some situations, described below, in which it may be necessary for organizations to deny access requests. Justification for any of the following will be required.
Disproportionate Burden: Personal information controllers do not need to provide access and correction where the burden or expense of doing so would be unreasonable or disproportionate to the risks to the individual's privacy in the case in question, as for example when claims for access are repetitious or vexatious by nature.
Protection of Confidential Information: Personal information controllers do not need to provide access and correction where the information cannot be disclosed due to legal or security reasons or to protect confidential commercial information (i.e. information that you have taken steps to protect from disclosure, where such disclosure would facilitate a competitor in the market to use or exploit the information against your business interest causing significant financial loss). Where confidential commercial information can be readily separated from other information subject to an access request, the personal information controller should redact the confidential commercial information and make available the non-confidential commercial information to the extent that such information constitutes personal information of the individual concerned. Other situations would include those where disclosure of information would benefit a competitor in the market place, such as a particular computer or modeling program. Furthermore, a denial of access may also be considered acceptable in situations where, for example providing the information would constitute a violation of laws or would compromise security.
Third Party Risk: Personal information controllers do not need to provide access and correction where the information privacy of persons other than the individual would be violated. In those instances where a third party’s personal information can be severed from the information requested for access or correction, the personal information controller must release the information after redaction of the third party’s personal information.
Accountability
- Implement measures to ensure compliance the APEC Information Privacy Principles.
- Appoint an individual(s) to be responsible for overall compliance with the Privacy Principles.
- Implement procedures to receive, investigate, and respond to privacy-related complaints as well as an explanation of any remedial action where applicable. The procedures should include:
- A description of how individuals may submit complaints,
- A designated employee(s) to handle complaints related to the Applicant’s compliance with the APEC Privacy Framework and/or requests from individuals for access to personal information, and
- A formal complaint-resolution process.
- Procedures should ensure individuals receive a timely response to their complaints.
- Complete formal training with employees that are responsible for carrying out the privacy-related complaints as well as responding to judicial or other government subpoenas, warrants or orders.
- Implement procedures for responding to judicial or other government subpoenas, warrants or orders, including those that require the disclosure of personal information.
Accountability When Personal Information is Transferred
-
Implement mechanisms with processors, agents, contractors, or other service providers pertaining to personal information they process on your behalf, to ensure that obligations to the individual will be met. The mechanisms should require the following:
- Abide by the APEC-compliant privacy policies and practices as stated in the Privacy Notice or Statement,
- Implement privacy practices that are substantially similar to your policies or privacy practices as stated in the Privacy Notice or Statement,
- Follow instructions provided relating to the manner in which personal information must be handled,
- Impose restrictions on subcontracting unless with your consent,
- CBPRs should be certified by an APEC accountability agent in their jurisdiction,
- Provide self-assessments to ensure compliance with your instructions and/or agreements/contracts.
- Perform regular spot checking or monitoring the processors, agents, contractors or other service providers to ensure compliance with your instructions and/or agreements/contracts.
PRP Minimum Requirements
Schellman’s Global PRP Certification program evaluates a United States based organization that serves in the role of a processor, processes personal information on behalf of controllers, and assists the controller in complying with relevant privacy requirements. Processors completing this certification are more visible to controllers looking for a processor certified against the Global PRP.
The organization is assessed against the PRP minimum certification requirements noted below.
Security Safeguards
- Implement an information security policy that covers personal information processed on behalf of a controller.
- Implement physical, technical and administrative safeguards that may include the following and periodically review and reassess the implemented measures to evaluate their relevance and effectiveness:
- Authentication and access control (e.g. password protections)
- Encryption
- Boundary protection (e.g. firewalls, intrusion detection)
- Audit logging
- Monitoring (e.g. external and internal audits, vulnerability scans)
- Implement regular training and oversight of employees to ensure they are aware of the importance of, and obligations for, respecting and maintaining the security of personal information. Procedures may include the following:
- Documented training program for employees
- Regular staff meetings or other documented communications
- Security policy signed by employees
- Implement measures to detect, prevent, and respond to attacks, intrusions, or other security failures related to personal information. The measures implemented should be tested on a periodic basis and measures should be adjusted to reflect the results of the tests.
- Implement a notification process to notify the controller of occurrences of a breach of the privacy or security of their organization’s personal information.
- Implement procedures for the secure disposal or return of personal information when instructed by the controller or upon termination of the relationship with the controller.
- Perform periodic third-party certifications or other risk assessments and adjust the security safeguards to reflect the results of these certifications or risk assessments.
Accountability Measures
- Implement policies to ensure that processing of personal information is limited to the purposes specified by the controller.
- Implement procedures to delete, update, and correct information upon request from the controller where necessary and appropriate.
- Implement measures to ensure compliance with the controller’s instructions related to the activities of personal information processing.
- Appoint an individual(s) to be responsible for the overall compliance with the requirements of the PRP.
- Implement procedures to forward privacy-related individual requests or complaints to the controller or to handle them when instructed by the controller.
- Implement procedures to notify controllers, except where prohibited by law, of judicial or other government subpoenas, warrants or orders that require the disclosure of personal information.
- Notify the controller of your engagement of subprocessors.
- Implement mechanisms with subprocessors to ensure that personal information is processed in accordance with your obligations under the PRP. Mechanisms should require subprocessors to perform the following:
- Follow-instructions provided by your organization relating to the manner in which personal information must be handled
- Impose restrictions on further subprocessing
- Have their PRP recognized by an APEC Accountability Agent in their jurisdiction
- Provide your organization with self-assessments or other evidence of compliance with your instructions and/or agreements/contracts
- Allow your organization to carry out regular spot checking or other monitoring activities
Regularly train employees on the organization’s privacy policies and procedures and related client instructions.
PRP Minimum Requirements
Schellman’s Global PRP Certification program evaluates a United States based organization that serves in the role of a processor, processes personal information on behalf of controllers, and assists the controller in complying with relevant privacy requirements. Processors completing this certification are more visible to controllers looking for a processor certified against the Global PRP.
The organization is assessed against the PRP minimum certification requirements noted below.
Security Safeguards
- Implement an information security policy that covers personal information processed on behalf of a controller.
- Implement physical, technical and administrative safeguards that may include the following and periodically review and reassess the implemented measures to evaluate their relevance and effectiveness:
- Authentication and access control (e.g. password protections)
- Encryption
- Boundary protection (e.g. firewalls, intrusion detection)
- Audit logging
- Monitoring (e.g. external and internal audits, vulnerability scans)
- Implement regular training and oversight of employees to ensure they are aware of the importance of, and obligations for, respecting and maintaining the security of personal information. Procedures may include the following:
- Documented training program for employees
- Regular staff meetings or other documented communications
- Security policy signed by employees
- Implement measures to detect, prevent, and respond to attacks, intrusions, or other security failures related to personal information. The measures implemented should be tested on a periodic basis and measures should be adjusted to reflect the results of the tests.
- Implement a notification process to notify the controller of occurrences of a breach of the privacy or security of their organization’s personal information.
- Implement procedures for the secure disposal or return of personal information when instructed by the controller or upon termination of the relationship with the controller.
- Perform periodic third-party certifications or other risk assessments and adjust the security safeguards to reflect the results of these certifications or risk assessments.
Accountability Measures
- Implement policies to ensure that processing of personal information is limited to the purposes specified by the controller.
- Implement procedures to delete, update, and correct information upon request from the controller where necessary and appropriate.
- Implement measures to ensure compliance with the controller’s instructions related to the activities of personal information processing.
- Appoint an individual(s) to be responsible for the overall compliance with the requirements of the PRP.
- Implement procedures to forward privacy-related individual requests or complaints to the controller or to handle them when instructed by the controller.
- Implement procedures to notify controllers, except where prohibited by law, of judicial or other government subpoenas, warrants or orders that require the disclosure of personal information.
- Notify the controller of your engagement of subprocessors.
- Implement mechanisms with subprocessors to ensure that personal information is processed in accordance with your obligations under the PRP. Mechanisms should require subprocessors to perform the following:
- Follow-instructions provided by your organization relating to the manner in which personal information must be handled
- Impose restrictions on further subprocessing
- Be Global PRP-certified by a Global CBPR Forum-recognized Accountability Agent in their jurisdiction
- Provide your organization with self-assessments or other evidence of compliance with your instructions and/or agreements/contracts
- Allow your organization to carry out regular spot checking or other monitoring activities
- Regularly train employees on the organization’s privacy policies and procedures and related client instructions.
CBPR Minimum Requirements
Schellman’s Global CBPR Certification program evaluates a United States based organization that serves in the role of a controller and collects personal information that is transferred between participating economies.
The organization is assessed against the CBPR minimum certification requirements noted below.
Notice
The privacy notice or statement must provide clear and easily accessible statements about your practices and policies that govern personal information and must include the following:
- Outline the services provided by the notice or statement;
- Be available on the client’s Website, such as text on a Web page, link from URL, attached document, pop-up windows, or included in frequently asked questions (FAQs);
- Be easy to find and be accessible;
- Include an effective date;
- Name of the organization and location;
- Include information on how to contact the organization about the practices and handling of personal information upon collection;
- Apply to all personal information, whether collected online or offline;
- Describe the collection practices and policies applied to all covered personal information collected by the client (i.e., how your organization collects personal information);
- Indicate what types of personal information, whether collected directly or through a third party or agent, are collected;
- Report the categories or specific sources of all categories of personal information collected;
- Describe the purpose(s) for which personal information is collected;
- Inform individuals as to whether information is shared with third parties and for what purpose you make personal information available to third parties including the identification of the categories or specific third parties;
- Include information regarding the use and disclosure of an individual’s personal information;
- Include information regarding whether and how an individual can access and correct their personal information including the following:
- The process through which the individual may access his or her personal information (including electronic or traditional non-electronic means);
- The process that an individual must follow in order to correct his or her personal information;
- Provide notice to the individual at the time of collection of personal information, whether directly or through the use of third parties acting on your behalf, that such information is being collected*;
- Indicate the purpose(s) for which personal information is being collected at the time of collection of personal information, whether directly or through the use of third parties acting on your behalf*(the communication must be in writing, for example on the Applicant’s website, such as text on a website link from URL, attached documents, pop-up window, or other);
- Provide notice to the individual at the time of collection of personal information, that their personal information may be shared with third parties.*
* The following are situations in which the application at the time of collection of the Global CBPR Notice Principle may not be necessary or practical. Justification for any of the following will be required.
Obviousness: Personal Information controllers do not need to provide notice of the collection, use or third-party sharing of personal information in those circumstances where consent by the individual can be inferred from the provision of the individual’s information (e.g. if an individual gives his or her business card to another individual in the context of a business relationship, the individual would not expect that notice would be provided regarding the collection and normal use of that information).
Collection of Publicly-Available Information: Personal information controllers do not need to provide notice regarding the collection and use of publicly available information.
Technological Impracticability: Personal Information controllers do not need to provide notice at or before the time of collection in those cases where electronic technology automatically collects information when a prospective customer initiates contact (e.g. through the use of cookies). However, the notice should be provided to the individuals as soon after as is practicable.
Disclosure to a government institution which has made a request for the information with lawful authority: Personal information controllers do not need to provide notice of disclosure to law enforcement agencies for investigation purposes where the provision of such notice to the individual will likely prejudice the investigation.
Disclosure to a third party pursuant to a lawful form of process: Personal information controllers do not need to provide notice of disclosure to a third party when such disclosure was requested pursuant to a lawful form of process such as a discovery request made in the course of civil litigation.
Third-Party Receipt: Where personal information is received from a third party, the recipient personal information controller does not need to provide notice to the individuals at or before the time of collection of the information.
For legitimate investigation purposes: When providing notice would compromise the availability or accuracy of the information and the collection, use and disclosure are reasonable for purposes relating to an internal or external investigation of a violation of a code of conduct, breach of contract or a contravention of domestic law.
Action in the event of an emergency: Personal Information controllers do not need to provide notice in emergency situations that threaten the life, health or security of an individual.
Collection
- The collection of personal information must be limited to information that is relevant to the purposes of collection, consistent with the requirements of the jurisdiction where data was collected, and any such information should be obtained by lawful and fair means, and where appropriate, with notice to, or consent of, the individual concerned.
- Identify the type of data collected, the economies where data is collected, the source (i.e., the individual or a third party) and the corresponding purposes and use of collection for each type of data.
Use
- Personal information collected must be used only to fulfill the purposes of collection and other compatible or related purposes as identified in the privacy statement and/or in the notice provided at the time of collection except for one of the following:
- With the consent of the individual whose personal information is collected;
- Consent must be a documented description or documentation that consent was obtained
- When necessary to provide a service or product requested by the individual; or
- A description must be documented of how the disclosure and/or transfer of collected personal information is necessary to provide a service or product requested by the individual
- By the authority of law and other legal instruments, proclamations and pronouncements of legal effect.
- A description must be documented of how collected information shared, used or disclosed as compelled by law including the legal requirements under which it is compelled to share the personal information, unless the client is bound by confidentiality requirements for the purposes of this Principle, uses of personal information include the transfer or disclosure of personal information.
- With the consent of the individual whose personal information is collected;
- If personal information is disclosed to other personal information controllers or transferred to processors, such disclosure and/or transfer must be undertaken to fulfill the original purpose of collection or another compatible or related purpose, unless based upon the express consent of the individual necessary to provide a service or product requested by the individual or compelled by law.
- Identify the type of data disclosed or transferred, the economies where data was transferred, the corresponding purpose of collection for each type of disclosed data, and the manner in which the disclosure fulfills the identified purpose (e.g. order fulfillment etc.).
Choice
- A mechanism* must be provided for individuals to exercise choice in relation to the collection of their personal information.
- A mechanism* must be provided for individuals to exercise choice in relation to the use of their personal information. Subject to the qualifications* outlined below, the opportunity to exercise choice should be provided to the individual at the time of collection, for subsequent uses of personal information. The opportunity to exercise choice may be provided to the individual after collection, but before:
- Being able to make use of the personal information, when the purposes of such use is not related or compatible to the purpose for which the information was collected, and
- Personal information may be disclosed or distributed to third parties, other than Service Providers.
- A mechanism* must be provided for individuals to exercise choice in relation to the disclosure of their personal information. Subject to the qualifications outlined below, the opportunity to exercise choice should be provided to the individual at the time of collection, for subsequent disclosures of personal information. The opportunity to exercise choice may be provided to the individual after collection, but before:
- Disclosing the personal information to third parties, other than Service Providers.
- Choices must be displayed or provided in a clear and conspicuous manner, clearly worded and easily understandable, and easily accessible and affordable.
*The following are situations in which the application of the Global CBPR Choice Principle may not be necessary or practical. Justification for any of the following will be required.
Obviousness: Personal Information controllers do not need to provide a mechanism for individuals to exercise choice in the collection, use or third-party sharing of personal information in those circumstances where consent by the individual can be inferred from the provision of the individual’s information.
Collection of Publicly-Available Information: Personal information controllers do not need to provide a mechanism for individuals to exercise choice in relation to the collection and use of publicly available information.
Technological Impracticability: Personal Information controllers do not need to provide a mechanism for individuals to exercise choice in relation to those cases where electronic technology automatically collects information when a prospective customer initiates contact [e.g. use of cookies]. However, a mechanism to exercise choice as to use and disclosure should be provided after collection of the information.
Third-Party Receipt: Where personal information is received from a third party, the recipient personal information controller does not need to provide a mechanism for individuals to exercise choice in relation to the collection of the information. However, if the personal information controller engages a third party to collect personal information on its behalf, the personal information controller should instruct the collector to provide such choice when collecting the personal information.
Disclosure to a government institution which has made a request for the information with lawful authority: Personal Information controllers do not need to provide a mechanism for individuals to exercise choice in relation to disclosure to law enforcement agencies for investigation purposes where the provision of such mechanism to the individual will likely prejudice the investigation.
Disclosure to a third party pursuant to a lawful form of process: Personal information controllers do not need to provide a mechanism for individuals to exercise choice in relation to the disclosure to a third party when such disclosure was requested pursuant to a lawful form of process such as a discovery request made in the course of civil litigation.
For legitimate investigation purposes: When providing a mechanism for individuals to exercise choice would compromise the availability or accuracy of the personal information and its collection, use and disclosure are reasonable for purposes relating to an internal or external investigation of a violation of a code of conduct, breach of contract or a contravention of domestic law.
Action in the event of an emergency: Personal Information controllers do not need to provide a mechanism for individuals to exercise choice in emergency situations that threaten the life, health or security of an individual.
Integrity of Personal Information
- Personal information must be accurate, complete and kept up-to date to the extent necessary for the purposes of use.
- Provide individuals the ability to challenge the accuracy of their personal information and to have it rectified, completed, amended and/or deleted and ensure procedures are in place to complete the request including communication and confirmation of the request to processors, agent, or other service providers to whom the personal information was transferred. Access and correction mechanisms must be presented in a clear and conspicuous manner. The request should be completed within a reasonable time frame following the request and a confirmation should be provided that the request has been completed.
- If correction is denied, an explanation should be provided, together with contact information for further inquiries about the denial of access or correction
- Require processors, agents, or other service providers acting on your behalf to inform you when they become aware of information that is inaccurate, incomplete, or out-of-date and ensure procedures are in place to complete the correction.
Security Safeguards
- Maintain a written information security policy.
- Implement physical, technical and administrative safeguards to protect personal information against risks such as loss or unauthorized access, destruction, use, modification or disclosure of information or other misuses. Such safeguards should be proportional to the likelihood and severity of the harm threatened, the sensitivity of the information and the context in which it is held, and should be subject to periodic review and reassessment.
- Communicate to employees their obligations and the importance of maintaining the security of personal information.
- Require information processors, agents, contractors, or other service providers to whom personal information is transferred to protect against leakage, loss or unauthorized access, destruction, use, modification or disclosure or other misuses of the information. Such requirement should include:
- Implementing an information security program that is proportionate to the sensitivity of the information and services provided
- Notifying you promptly when they become aware of an occurrence of breach of the privacy or security of the personal information
- Taking immediate steps to correct/address the security failure which caused the privacy or security breach
- Maintain a policy for secure disposal of personal information.
- Implement procedures to detect, prevent, and respond to attacks, intrusions, or other security failures.
- Perform tests on a periodic basis on the effectiveness of the implemented physical, technical and administrative safeguards.
- Perform risk assessments or third-party validations on a periodic basis that include the implemented physical, technical and administrative safeguards and review the results of the assessment or third-party validation for remediation.
Access*
-
Provide individuals the ability to obtain confirmation of whether or not personal information is held about the requesting individual.
-
If requested, provide individuals access to their personal information. Prior to providing access, confirm the identity of the individual requesting access. Provide access within a reasonable time frame following the request and communicate the information in a reasonable manner that is generally understandable, in a legible format and compatible with the regular form of interaction with the individual.
-
If a fee is charged for providing access, the fees should not be excessive.
-
If the individual is denied access, an explanation must be provided as to why access was denied and provide the appropriate contact information for challenging the denial of access where appropriate.
*Although organizations should always make good faith efforts to provide access, there are some situations, described below, in which it may be necessary for organizations to deny access requests. Justification for any of the following will be required.
Disproportionate Burden: Personal information controllers do not need to provide access and correction where the burden or expense of doing so would be unreasonable or disproportionate to the risks to the individual's privacy in the case in question, as for example when claims for access are repetitious or vexatious by nature.
Protection of Confidential Information: Personal information controllers do not need to provide access and correction where the information cannot be disclosed due to legal or security reasons or to protect confidential commercial information (i.e. information that you have taken steps to protect from disclosure, where such disclosure would facilitate a competitor in the market to use or exploit the information against your business interest causing significant financial loss). Where confidential commercial information can be readily separated from other information subject to an access request, the personal information controller should redact the confidential commercial information and make available the non-confidential commercial information to the extent that such information constitutes personal information of the individual concerned. Other situations would include those where disclosure of information would benefit a competitor in the market place, such as a particular computer or modeling program. Furthermore, a denial of access may also be considered acceptable in situations where, for example providing the information would constitute a violation of laws or would compromise security.
Third Party Risk: Personal information controllers do not need to provide access and correction where the information privacy of persons other than the individual would be violated. In those instances where a third party’s personal information can be severed from the information requested for access or correction, the personal information controller must release the information after redaction of the third party’s personal information.
Accountability
- Implement measures to ensure compliance the Global CBPR Privacy Principles.
- Appoint an individual(s) to be responsible for overall compliance with the Privacy Principles.
- Implement procedures to receive, investigate, and respond to privacy-related complaints as well as an explanation of any remedial action where applicable. The procedures should include:
- A description of how individuals may submit complaints,
- A designated employee(s) to handle complaints related to the Applicant’s compliance with the Global CBPR Framework and/or requests from individuals for access to personal information, and
- A formal complaint-resolution process.
- Procedures should ensure individuals receive a timely response to their complaints.
- Complete formal training with employees that are responsible for carrying out the privacy-related complaints as well as responding to judicial or other government subpoenas, warrants or orders.
- Implement procedures for responding to judicial or other government subpoenas, warrants or orders, including those that require the disclosure of personal information.
Accountability When Personal Information is Transferred
-
Implement mechanisms with processors, agents, contractors, or other service providers pertaining to personal information they process on your behalf, to ensure that obligations to the individual will be met. The mechanisms should require the following:
- Abide by the Global CBPR-compliant privacy policies and practices as stated in the Privacy Notice or Statement,
- Implement privacy practices that are substantially similar to your policies or privacy practices as stated in the Privacy Notice or Statement,
- Follow instructions provided relating to the manner in which personal information must be handled,
- Impose restrictions on subcontracting unless with your consent,
- Be Global CBPR-certified by a Forum-recognized Accountability Agent in their jurisdiction,
- Provide self-assessments to ensure compliance with your instructions and/or agreements/contracts.
- Perform regular spot checking or monitoring the processors, agents, contractors or other service providers to ensure compliance with your instructions and/or agreements/contracts.
PRP Minimum Requirements
Schellman’s Global PRP Certification program evaluates a United States based organization that serves in the role of a processor, processes personal information on behalf of controllers, and assists the controller in complying with relevant privacy requirements. Processors completing this certification are more visible to controllers looking for a processor certified against the Global PRP.
The organization is assessed against the PRP minimum certification requirements noted below.
Security Safeguards
- Implement an information security policy that covers personal information processed on behalf of a controller.
- Implement physical, technical and administrative safeguards that may include the following and periodically review and reassess the implemented measures to evaluate their relevance and effectiveness:
- Authentication and access control (e.g. password protections)
- Encryption
- Boundary protection (e.g. firewalls, intrusion detection)
- Audit logging
- Monitoring (e.g. external and internal audits, vulnerability scans)
- Implement regular training and oversight of employees to ensure they are aware of the importance of, and obligations for, respecting and maintaining the security of personal information. Procedures may include the following:
- Documented training program for employees
- Regular staff meetings or other documented communications
- Security policy signed by employees
- Implement measures to detect, prevent, and respond to attacks, intrusions, or other security failures related to personal information. The measures implemented should be tested on a periodic basis and measures should be adjusted to reflect the results of the tests.
- Implement a notification process to notify the controller of occurrences of a breach of the privacy or security of their organization’s personal information.
- Implement procedures for the secure disposal or return of personal information when instructed by the controller or upon termination of the relationship with the controller.
- Perform periodic third-party certifications or other risk assessments and adjust the security safeguards to reflect the results of these certifications or risk assessments.
Accountability Measures
- Implement policies to ensure that processing of personal information is limited to the purposes specified by the controller.
- Implement procedures to delete, update, and correct information upon request from the controller where necessary and appropriate.
- Implement measures to ensure compliance with the controller’s instructions related to the activities of personal information processing.
- Appoint an individual(s) to be responsible for the overall compliance with the requirements of the PRP.
- Implement procedures to forward privacy-related individual requests or complaints to the controller or to handle them when instructed by the controller.
- Implement procedures to notify controllers, except where prohibited by law, of judicial or other government subpoenas, warrants or orders that require the disclosure of personal information.
- Notify the controller of your engagement of subprocessors.
- Implement mechanisms with subprocessors to ensure that personal information is processed in accordance with your obligations under the PRP. Mechanisms should require subprocessors to perform the following:
- Follow-instructions provided by your organization relating to the manner in which personal information must be handled
- Impose restrictions on further subprocessing
- Be Global PRP-certified by a Global CBPR Forum-recognized Accountability Agent in their jurisdiction
- Provide your organization with self-assessments or other evidence of compliance with your instructions and/or agreements/contracts
- Allow your organization to carry out regular spot checking or other monitoring activities
- Regularly train employees on the organization’s privacy policies and procedures and related client instructions.
Certification Process
Schellman performs each assessment with your end goals and preparation for future key compliance initiatives in mind. Effective communication and timely coordination of project activities are central to our methodology.
Planning
The planning phase occurs at least two months in advance of fieldwork in accordance with the timing outlined in the job arrangement letter (JAL) executed with the client. Planning includes the completion of an intake questionnaire, confirming timing of interviews with key points of contact, and deployment of and evidence gathering for the information request list provided via AuditSource 2.0. Schellman will be available to the client to answer any questions associated with the assessment to ensure both parties are aligned on scope and expectations.
Fieldwork
Schellman will hold a kickoff meeting to start fieldwork. Fieldwork consists of various testing procedures to evidence the certification minimum requirements are met. The testing procedures may include one or more of the following:
- Inquiry of relevant personnel with the requisite knowledge and experience regarding the performance and application of the related requirement
- Observation of the relevant processes or procedures that includes, but is not limited to, witnessing the performance of controls or evidence of control performance with relevant personnel
- Inspection of the relevant audit records that include, but is not limited to, policies, documented procedures, system configurations, or the existence of sampling attributes such as logged events or acknowledgements
Schellman has a no surprises policy and regular contact with the client during fieldwork, allowing clients to be apprised at all times of conformance status. Non-compliant areas must be remediated within the timeframe provided by Schellman in order to obtain certification.
Reporting
Schellman's assessment is focused on creating a deliverable that is clear, concise, and accurate. The draft report and draft certificate are provided within 2-3 weeks of the last day of fieldwork. The final deliverables, including the applicable certification seal, are available within 5 business days of the client approving the draft versions. Schellman will submit the client's registration to the CBPR System directory for official participation in the framework.
Ongoing Monitoring and Compliance Review
Schellman’s testing methodology ends with reporting, but the entire assessment is focused on creating a deliverable that is clear, concise, and accurate.
Schellman’s report takes into account the entire process and customizes a report for each Client. The draft report will be provided within 2 weeks of the last day of testing and gathering phase, and a final report will be provided within 30 days. This timing is unsurpassed by the industry.
Re-certification and Annual Assessment
Annual recertifications must take place in order for participants to maintain their certification. The recertification process includes:
- An updated intake questionnaire outlining any changes since the initial certification
- An assessment of the participant's compliance with the minimum certification requirements
- A revised audit report and certificate will be provided to reflect modifications to the scope of certification
- A renewed registration within the CBPR System directory
Certification shall be suspended in cases when, for example:
- The participant was found to be in breach of the program’s requirements and the findings have not been resolved within the required time frames, which shall not exceed a period of six (6) months or upon the due date of the annual recertification;
- The participant does not allow re-certification audits to be conducted at the required frequencies;
- Where there are reasonable grounds to believe that a participant has engaged in a practice that may constitute a breach of the program requirements; or
- The participant has voluntarily requested a suspension.
Schellman will communicate with the client the suspension status along with the remediation requirements. Schellman is required to make publicly accessible the suspended status of certifications
Certification Process
Schellman performs each assessment with your end goals and preparation for future key compliance initiatives in mind. Effective communication and timely coordination of project activities are central to our methodology.
1. Planning
The planning phase typically occurs at least two months in advance of fieldwork in accordance with the timing outlined in the job arrangement letter (JAL) or statement of work (SOW) executed with the client. Planning includes the completion of an intake questionnaire, confirming timing of interviews with key points of contact, and deployment of and evidence gathering for the information request list provided via AuditSource 2.0. Schellman will be available to the client to answer any questions associated with the assessment to ensure both parties are aligned on scope and expectations.
2. Fieldwork
Schellman will hold a kickoff meeting to start fieldwork. Fieldwork consists of various testing procedures to evidence the certification minimum requirements are met. The testing procedures may include one or more of the following:
- Inquiry of relevant personnel with the requisite knowledge and experience regarding the performance and application of the related requirement
- Observation of the relevant processes or procedures that includes, but is not limited to, witnessing the performance of controls or evidence of control performance with relevant personnel
- Inspection of the relevant audit records that include, but is not limited to, policies, documented procedures, system configurations, or the existence of sampling attributes such as logged events or acknowledgements
Schellman has a no surprises policy and regular contact with the client during fieldwork, allowing clients to be apprised at all times of conformance status. Non-compliant areas must be remediated within the timeframe provided by Schellman in order to obtain certification.
3. Reporting
Schellman's assessment is focused on creating a deliverable that is clear, concise, and accurate. The draft report and draft certificate are typically provided within 2-3 weeks of the last day of fieldwork. The final deliverables, including the applicable certification seal, are available within 5 business days of the client approving the draft versions. Schellman will submit the client's registration to the CBPR System directory for official participation in the framework.
4. Ongoing Monitoring and Compliance Review
Participants in the framework are monitored throughout the certification period to confirm compliance with the program. The monitoring activities may include, but are not limited to, periodic reviews of the participant's privacy notice for updates or investigations into any disputes received by Schellman. Documentation or onsite visits may be requested of the participant by Schellman to validate compliance. Schellman will notify the participant in advance to allow for documentation collection and scheduling of the onsite visit.
5. Re-certification and Annual Assessment
Annual recertifications must take place in order for participants to maintain their certification. The recertification process includes:
- An updated intake questionnaire outlining any changes since the initial certification
- An assessment of the participant's compliance with the minimum certification requirements
- A revised audit report and certificate will be provided to reflect modifications to the scope of certification
- A renewed registration within the CBPR System directory
Certification shall be suspended in cases when, for example:
- The participant was found to be in breach of the program’s requirements and the findings have not been resolved within the required time frames, which shall not exceed a period of six (6) months or upon the due date of the annual recertification;
- The participant does not allow re-certification audits to be conducted at the required frequencies;
- Where there are reasonable grounds to believe that a participant has engaged in a practice that may constitute a breach of the program requirements; or
- The participant has voluntarily requested a suspension.
Schellman will communicate with the client the suspension status along with the remediation requirements. Schellman is required to make publicly accessible the suspended status of certifications.
Featured Learning Center Content
Global CBPR & PRP Specialist
Chris Lippert
Chris Lippert, Director and Privacy Practice Lead with Schellman, is based out of Atlanta, GA. With more than 12 years of experience in information assurance across numerous industries, regulations and frameworks, Chris developed a passion for and concentration in data privacy. He is an active member of the International Association of Privacy Professionals (IAPP), holding his Fellow of Information Privacy (FIP) designation, and advocates for privacy by design and the adequate protection of personal data in today’s business world.
- Fixed-Fee Using an outcome-based, fixed-fee pricing model based on our extensive experience
- Scope Creep We see less than 5% of our clients that see amendments and are often the result of a scope expansion
- Low Overhead Low overhead means a flexible financial structure
How much will your audit cost?
Whether it is an ISO 27001 certification, SOC 2 examination or a FedRAMP assessment, companies are often challenged by the need to address customer requirements while ensuring a return on compliance investment.
The most important factor in scoping a potential assessment is understanding what deliverable the recipient (i.e. your customer or partner) is expecting.
Once we have scoped your environment and needs, there are several factors that contribute to Schellman’s pricing:
- Fixed-Fee Using an outcome-based, fixed-fee pricing model based on our extensive experience
- Scope Creep We see less than 5% of our clients that see amendments and are often the result of a scope expansion
- Low Overhead Low overhead means a flexible financial structure
Schellman Statistics
Schellman includes statistics on the types of complaints received and the outcomes of such complaints publicly accessible on this website. You can learn more on our Statistics and Case Notes page.
Certificate Directory
Check the certification status of our CBPR/PRP clients by using our Certificate Directory.
Complaints or Disputes
Schellman takes complaints against itself or its clients seriously. Complaints about Schellman should be submitted using this form.