meta_id 3009529

On March 23, 2026, the Global Cross-Border Privacy Rules (CBPR) Forum, comprising 14 jurisdictions including Japan, updated its Program Requirements to facilitate broader participation by additional jurisdictions and establish the Global CBPR System as a global standard. The Program Requirements are the set of questions and assessment criteria used by accountability agents to examine whether applicant organisations seeking certification comply with the Global CBPR Privacy Framework. The updated requirements introduce three key areas: procedures for handling sensitive personal information and children's personal information; procedures for assessing and mitigating the risk of personal information leakage; and procedures for notifying affected individuals of data breaches. These additions aim to strengthen privacy protections and standardise certification assessments across participating jurisdictions. The update reflects the Forum's commitment to creating a harmonised approach to cross-border privacy governance that can accommodate new member jurisdictions while maintaining consistent standards. From April 1, 2027, onward, all applicant organisations seeking new certification or recertification under the Global CBPR System will be subject to certification assessments based on the updated Program Requirements. Organisations currently certified under the previous requirements will need to comply with the new standards upon recertification. The full text of the updated Program Requirements and related documentation are available on the Global CBPR Forum website. This update represents a significant development in international privacy regulation, enabling the Global CBPR System to serve as a more inclusive and comprehensive global privacy framework.