Privacy & Cybersecurity Law Blog

The Centre for Information Policy Leadership (“CIPL”) at Hunton has published a report examining the extent to which the European Union’s General Data Protection Regulation (“GDPR”) aligns with the newly updated Program Requirements of the Global Cross-Border Privacy Rules (“Global CBPR”) System.

The Global CBPR System is a certified compliance program that facilitates personal data flows from and between participating jurisdictions and organizations. It is based on formal third-party assessments affirming that certified organizations operating as data controllers adhere to a common set of approved standards, called “Program Requirements.”  The Global Privacy Recognition for Processors (“Global PRP”) System provides analogous certifications for private sector organizations operating as data processors.

The Global CBPR Forum, which administers the Global CBPR and Global PRP Systems, formally adopted a number of revisions to the Global CBPR Program Requirements in March 2026. These revisions addressed topics commonly found in privacy laws but not previously covered by the Global CBPR System, such as sensitive data, children’s data, risk assessments and breach notification.

According to CIPL’s report, there is significant alignment between the GDPR and the Systems’ Program Requirements with more than 70% of Global CBPR Program Requirements, as revised, aligning with provisions of the GDPR, and more than 75% of the Global PRP doing the same. CIPL concludes that inasmuch as the remainder of the Program Requirements appear to find implicit support in the GDPR, EU supervisory authorities would likely be able to enforce the Program Requirements through the GDPR.

GDPR Art. 42 encourages the “establishment of data protection certification mechanisms,” and GDPR Art. 46(2)(f) permits the use of an approved certification mechanism as an “appropriate safeguard” for international transfers. In light of those provisions, CIPL’s report encourages the EU to explore the benefits of participation in the Global CBPR/Global PRP Systems.

CIPL’s full report is available here.

For additional information regarding the Global CBPR and Global PRP Systems, CIPL has published an explanatory Playbook available here.