Criteria #1 
Is your organization seeking certification for personal data you process on behalf of others (as a data processor, service provider, or vendor)?  

• If the answer is no because your organization is seeking certification for personal data you collect and process for your own purposes (as a data controller), visit our page on How to Apply for CBPR Certification. 

Criteria #2 
Is your organization headquartered in the U.S.? Your organization must be headquartered in the U.S. to be eligible for PRP certification with BBB National Programs. 

• NOTE: If your organization is headquartered outside the United States, you may instead by eligible for our Vendor Privacy Program. 

Criteria #3 
Does your organization fall under the jurisdiction of the Federal Trade Commission (FTC)? Only U.S. legal entities subject to the investigatory and enforcement jurisdiction of the FTC are eligible for this certification.  

• Generally, the FTC's jurisdiction covers acts or practices in or affecting commerce by any "person, partnership, or corporation." The FTC does not have jurisdiction over most depository institutions (banks, federal credit unions, and savings & loan institutions), telecommunications and interstate transportation common carrier activities, air carriers, labor associations, most non-profit organizations, and most packer and stockyard activities. In addition, the FTC's jurisdiction with regard to insurance activities is limited to certain circumstances. If you are uncertain as to whether your organization falls under the jurisdiction of the FTC, you will need to seek legal counsel. 

Before submitting the application, review the PRP Program Requirements and Dispute Resolution Procedures. Also be sure to gather the following information: 

• Legal name of your organization and its state of incorporation 

• Legal names of any subsidiaries that will be covered under the certification, and their locations 

• Full contact information for an officer (or designated representative) with power to bind your organization contractually and attest to the final certification 

• Full contact information for a billing contact at your organization 

• A designated contact for privacy complaints under this certification 

• A description of the service you wish to cover under your PRP certification 

After receiving your application, a member of BBB National Programs’ Global Privacy Division will be in touch to complete the intake process before you meet with a certification specialist. During intake, you will finalize payment of your application and participation fee and submit your signed Participation Agreement.