Interoperability: The Foundation for Achieving Compliance with Global Privacy Laws

Jun 15, 2021 by Cobun Zweifel-Keegan, Deputy Director, Privacy Initiatives

Data privacy laws, not just in the U.S. but around the world, are proliferating at a breakneck pace. From Colorado to Colombia, emerging state and global rules for the handling of personal information are challenging business leaders.  

Despite what you may hear about global privacy laws, exceeding minimum standards with a unified privacy program is feasible for most businesses. Many turn to accountability markers like a privacy program certification delivered by independent organizations such as ours, BBB National Programs. These privacy certifications help make global privacy best practices achievable by businesses of any size, even if you are just getting started.  

While there is not one common global data privacy law, there are standard privacy practices common across jurisdictions. This idea can be summed up in one word: interoperability. Standard data privacy practices, when properly documented and certified, are recognized as a baseline around the world.  

Interoperability does not mean equivalency. Privacy laws around the world are often different in scope, operation, or enforcement. For example, though all data privacy or data protection laws cover “personal information” (information about individuals), the types of individuals covered differ from consumers to employees to general “data subjects.” 

Interoperability stands for the idea that baseline standards can be recognized among many different jurisdictions. If you achieve recognizable baseline standards—and demonstrate your achievement through mechanisms of transparency and accountability—you have taken many of the critical steps toward achieving global privacy compliance.  

Building on this foundation lets you focus on the gaps created by individual local laws, rather than starting from scratch for every market. 


How to Achieve Interoperability 

A certification such as BBB National Programs’ based on the Cross-Border Privacy Rules (CBPR) system—or, for vendors, the more streamlined Privacy Recognition for Processors (PRP)—not only provides an independent annual review of privacy practices, but also includes a formal report and public seal of approval, ongoing monitoring, and dispute resolution services, all of which help businesses keep up with global privacy norms. 

The eight guiding principles included in the CBPR framework are universally acknowledged as fundamental to good privacy practices: 

  • Notice. Individuals should be provided with notice of privacy practices at the time of collection. 
  • Collection Limitation. Collection of personal information should be relevant to the purposes disclosed at the time of collection.
  • Uses of Personal Information. Uses should be limited to fulfilling the purposes of collection and other compatible or related purposes.
  • Choice. Where appropriate, individuals should be provided with choice in relation to the collection, use, and disclosure of their personal information.
  • Integrity of Personal Information. Procedures should be in place to maintain the accuracy and completeness of personal information.
  • Security Safeguards. Reasonable security safeguards should be implemented to protect personal information from loss, unauthorized access or disclosure, or other misuses.
  • Access and Correction. Procedures should be in place to permit individuals to access and correct their personal information.
  • Accountability. Procedures are in place to ensure compliance and accountability, even when data shared with third parties. 


Though the privacy standards built into the CBPR and PRP system were first established by the group of economies known as the Asia-Pacific Economic Cooperation (APEC), many CBPR-certified companies extend the scope of their certification to include their entire global operations. These companies recognize the value of adopting recognized privacy standards as a firm foundation for their global operations, and others may want to consider doing the same. 


How do CBPRs relate to global privacy laws? 

This table provides an overview of the correspondence between CBPRs and a selection of global privacy laws. For each principle, the table indicates whether the law:  

  • Aligns with the requirements for CBPR certification, 
  • Adds some details to the CBPR requirements (+), or
  • Does not include corresponding requirements (-).  

Cross Border Privacy Rules Matrix


The CBPR framework provides a strong foundation on which to build a business that meets global privacy standards. Demonstrating that your program meets these interoperable requirements is a proactive step in preparing for global compliance. 

Our role at BBB National Programs as a third-party provider of privacy certifications, assessments, and independent dispute resolution is to help companies confidently demonstrate that their privacy practices are built upon the principles that form the building blocks for global privacy standards.  

We can help make privacy achievable and accountable for businesses of all sizes. Reach out to to get started. 

Suggested Articles


Are used cars covered under lemon laws?

Do your homework to make sure the used car you plan to buy is not a lemon, and if it is, does the lemon law cover it? The answer may depend on where you purchased the vehicle or where you live.
Read more

Case Study: Getting to Compliance with CARU and COPPA

In a recent case, CARU worked with TickTalk to help them achieve compliance with CARU’s Privacy Guidelines and the Children’s Online Privacy Protection Act (COPPA). CARU sat down with TickTalk once the case had closed to discuss their experience as well as some of the privacy challenges many companies face in the children’s space.
Read more

What to Know About the Georgia Lemon Law

BBB AUTO LINE provides an overview of each state’s lemon laws. In our ongoing blog series, we offer further insights on the laws for select states, and how BBB AUTO LINE can support consumers with lemon law disputes. Florida, California, and Texas have been covered. This post reviews the nuances of the lemon law in the Peachtree State – Georgia.
Read more

The TAPP Roadmap: Helping U.S. Companies Responsibly Collect and Manage Teenager Data

The TeenAge Privacy Program (TAPP) Roadmap was designed to assist any business that wishes to engage proactively with teen consumers, providing an operational framework to map the broad spectrum of potential harms impacting teens onto a concrete set of operational considerations.
Read more