Criteria #1 Is your organization seeking certification for personal data you collect and process for your own purposes (as a data controller)?
If the answer is no because your organization is seeking certification for personal data you process on behalf of others (as a data processor or vendor), visit our page on How to Apply for PRP Certification.
Criteria #2 Is your organization headquartered in the U.S.? Although your subsidiaries may be located anywhere, the organization seeking CBPR certification with BBB National Programs must be headquartered in the U.S.
Criteria #3 Does your organization fall under the jurisdiction of the Federal Trade Commission (FTC)? Only U.S. legal entities subject to the investigatory and enforcement jurisdiction of the FTC are eligible for this certification.
Generally, the FTC's jurisdiction covers acts or practices in or affecting commerce by any "person, partnership, or corporation." The FTC does not have jurisdiction over most depository institutions (banks, federal credit unions, and savings & loan institutions), telecommunications and interstate transportation common carrier activities, air carriers, labor associations, most non-profit organizations, and most packer and stockyard activities. In addition, the FTC's jurisdiction with regard to insurance activities is limited to certain circumstances. If you are uncertain as to whether your organization falls under the jurisdiction of the FTC, you will need to seek legal counsel.
Legal name of your organization and its state of incorporation
Legal names of any subsidiaries that will be covered under the certification, and their locations
Full contact information for an officer (or designated representative) with power to bind your organization contractually and attest to the final certification
Full contact information for a billing contact at your organization
Gross global annual revenue for your organization and all covered subs
A designated contact for privacy complaints under this certification
After receiving your application, a member of BBB National Programs’ Global Privacy Division will be in touch to complete the intake process before you meet with a certification specialist. During intake, you will finalize payment of your application and participation fee and submit your signed Participation Agreement.
Once your application is processed and approved, your organization will work with a BBB National Programs certification specialist to complete the CBPR Certification questionnaire through our secure online portal. Throughout the process, you will provide evidence of your privacy policies and practices to demonstrate that they meet or exceed the minimum requirements for program participation.