Interoperability: The Foundation for Achieving Compliance with Global Privacy Laws

Jun 15, 2021 by Cobun Zweifel-Keegan, Deputy Director, Privacy Initiatives

Data privacy laws, not just in the U.S. but around the world, are proliferating at a breakneck pace. From Colorado to Colombia, emerging state and global rules for the handling of personal information are challenging business leaders.  

Despite what you may hear about global privacy laws, exceeding minimum standards with a unified privacy program is feasible for most businesses. Many turn to accountability markers like a privacy program certification delivered by independent organizations such as ours, BBB National Programs. These privacy certifications help make global privacy best practices achievable by businesses of any size, even if you are just getting started.  

While there is not one common global data privacy law, there are standard privacy practices common across jurisdictions. This idea can be summed up in one word: interoperability. Standard data privacy practices, when properly documented and certified, are recognized as a baseline around the world.  

Interoperability does not mean equivalency. Privacy laws around the world are often different in scope, operation, or enforcement. For example, though all data privacy or data protection laws cover “personal information” (information about individuals), the types of individuals covered differ from consumers to employees to general “data subjects.” 

Interoperability stands for the idea that baseline standards can be recognized among many different jurisdictions. If you achieve recognizable baseline standards—and demonstrate your achievement through mechanisms of transparency and accountability—you have taken many of the critical steps toward achieving global privacy compliance.  

Building on this foundation lets you focus on the gaps created by individual local laws, rather than starting from scratch for every market. 


How to Achieve Interoperability 

A certification such as BBB National Programs’ based on the Cross-Border Privacy Rules (CBPR) system—or, for vendors, the more streamlined Privacy Recognition for Processors (PRP)—not only provides an independent annual review of privacy practices, but also includes a formal report and public seal of approval, ongoing monitoring, and dispute resolution services, all of which help businesses keep up with global privacy norms. 

The eight guiding principles included in the CBPR framework are universally acknowledged as fundamental to good privacy practices: 

  • Notice. Individuals should be provided with notice of privacy practices at the time of collection. 
  • Collection Limitation. Collection of personal information should be relevant to the purposes disclosed at the time of collection.
  • Uses of Personal Information. Uses should be limited to fulfilling the purposes of collection and other compatible or related purposes.
  • Choice. Where appropriate, individuals should be provided with choice in relation to the collection, use, and disclosure of their personal information.
  • Integrity of Personal Information. Procedures should be in place to maintain the accuracy and completeness of personal information.
  • Security Safeguards. Reasonable security safeguards should be implemented to protect personal information from loss, unauthorized access or disclosure, or other misuses.
  • Access and Correction. Procedures should be in place to permit individuals to access and correct their personal information.
  • Accountability. Procedures are in place to ensure compliance and accountability, even when data shared with third parties. 


Though the privacy standards built into the CBPR and PRP system were first established by the group of economies known as the Asia-Pacific Economic Cooperation (APEC), many CBPR-certified companies extend the scope of their certification to include their entire global operations. These companies recognize the value of adopting recognized privacy standards as a firm foundation for their global operations, and others may want to consider doing the same. 


How do CBPRs relate to global privacy laws? 

This table provides an overview of the correspondence between CBPRs and a selection of global privacy laws. For each principle, the table indicates whether the law:  

  • Aligns with the requirements for CBPR certification, 
  • Adds some details to the CBPR requirements (+), or
  • Does not include corresponding requirements (-).  

Cross Border Privacy Rules Matrix


The CBPR framework provides a strong foundation on which to build a business that meets global privacy standards. Demonstrating that your program meets these interoperable requirements is a proactive step in preparing for global compliance. 

Our role at BBB National Programs as a third-party provider of privacy certifications, assessments, and independent dispute resolution is to help companies confidently demonstrate that their privacy practices are built upon the principles that form the building blocks for global privacy standards.  

We can help make privacy achievable and accountable for businesses of all sizes. Reach out to to get started. 

Suggested Articles


AI And Machine Learning In The Workplace: Preparing For 2023

In recent years, government scrutiny over the use of artificial intelligence (AI) tools in the recruiting and hiring process has risen. A better understanding of these actions can help business leaders reduce their risk of legal liability and better understand how to use AI and machine learning responsibly in their organizations.
Read more

CFBAI and CCAI Published the 2021 Annual Report on Participant Compliance and Program Progress

BBB National Programs has released the CFBAI and CCAI 2021 Annual Report, which provides details on the significant events of 2021 and an evaluation of participants’ compliance, which was excellent.
Read more

Shifting Global Privacy Demands For Business: What Leaders Need To Know

As businesses continue to develop new and innovative technologies, they are also collecting more data from consumers. While we await for additional guidance on the future of Privacy Shield, business and nonprofit leaders can take some lessons from Schrems I to help them prepare for what is to come.
Read more

Two Peas in a Privacy Pod: Global CBPR and the EU-U.S. Data Privacy Framework

One of the unique benefits of the Global CBPR System is the substantial overlap with the EU-U.S. Data Privacy Framework (EU-U.S. DPF). The nearly 78% alignment in key requirement areas means that certifying through one system will help an organization comply with requirements of the other, saving time, money, and valuable resources while pursuing both certifications.
Read more