Global and APEC Cross-Border Privacy Rules (CBPR) System
The Global and APEC Cross-Border Privacy Rules (CBPR) certification shows that a data controller protects personal data when it moves across borders. In Singapore, IMDA is the Accountability Agent and certifies organisations after an assessment by an appointed body. ICFC prepares you for that assessment.
Cybersecurity, IT and Data Protection
- Standard or scheme
- CBPR
- Global CBPR Forum; certified in Singapore by IMDA
- Type
- Scheme
- Awarded under the scheme owner's rules
- Funding
- IMDA scheme, check funding
- Check IMDA's information kit and Enterprise Singapore
What is CBPR?
CBPR is a voluntary, enforceable certification for organisations that control personal data moving across borders.
The Global CBPR System launched on 2 June 2025 alongside the APEC system; IMDA certifies Singapore organisations using appointed assessment bodies.
Who is CBPR for?
Data controllers that transfer personal data between Singapore and other participating economies.
IMDA indicates possible support - Check IMDA's information kit and Enterprise Singapore
IMDA indicates that funding support may be available for part of the consultancy and certification costs. Check the IMDA information kit and Enterprise Singapore before you apply.
Impartiality
Impartiality comes first. Every engagement begins with a conflict-of-interest check. We keep consulting and auditing roles separate, and our auditors never audit, on behalf of a certification body, an organisation that ICFC has consulted on the same scope within the period set by that body.
Our certification role
We do not certify organisations ourselves; certificates are issued by accredited certification bodies or scheme owners.
How we help
Third-party assessments
Certification is awarded under the scheme run by IMDA as Singapore's recognised Accountability Agent. Where appointed, our auditors carry out assessments on behalf of the certification body; the certificate or mark is never issued by ICFC.
Second-party audits
Supplier and partner checks against the scheme requirements, on behalf of your organisation.
Readiness and internal audits
A pre-assessment that shows exactly what the formal assessment will look for, with a prioritised action list.
Funding
We explain which scheme, if any, applies and what it requires before you commit.
Non-grant
A fixed-scope engagement: gap assessment, documentation, implementation coaching, internal audit and management review, and support through the formal audit or assessment.
How we work
Practical, proportionate systems that your staff can run after we leave.
Classroom
Public and in-house classroom courses on CBPR: awareness, implementation and internal auditor levels.
Online LMS
Self-paced and live-online courses on the ICFC Digital LMS, with progress tracking and certificates of completion.
Funding
Funding depends on each course's approval status, shown on the course page in the LMS.