Cloudflare Completes Audits for Global CBPR and Privacy Processor Standards

Cloudflare says it has completed audits against two new international privacy standards: the Global Cross-Border Privacy Rules (Global CBPRs) for data controllers and the Global Privacy Recognition for Processors (Global PRP). The company expects formal certifications to become available when the programs launch, which it anticipates later in 2025. Its audits cover both personal information Cloudflare controls and data it processes for customers.

The milestone adds to Cloudflare’s existing privacy validations. The company certified to ISO 27701:2019, an international privacy standard, and ISO 27018:2019, a cloud privacy certification. In 2023, an independent monitoring body in the European Union reviewed Cloudflare’s practices under the EU Cloud Code of Conduct, which the company describes as the first formal GDPR code of conduct.

What the new standards cover

The Global CBPR System is a voluntary, enforceable, accountability-based framework for privacy-respecting transfers of personal information among participating economies. It sets a shared baseline for how organizations handle personal information, while allowing each participant to retain its own data protection laws. The system was established on April 30, 2024.

The framework was developed by the Global CBPR Forum, whose members are Australia, Canada, Japan, the Republic of Korea, Mexico, the Philippines, Singapore, Chinese Taipei, and the United States. The United Kingdom is an associate member. Bermuda, Mauritius, and the Dubai International Finance Centre are also associate participants, indicating their intention to join as full members.

Cloudflare applied to join on May 1, 2024, the first day after the system’s establishment. It says it has now passed the required audits and expects to be the first organization certified under both the Global CBPRs and the related Global PRP once certification formally opens. That timing remains tied to the programs’ anticipated launch later in 2025.

Together with its other privacy validations, Cloudflare says the new standards will cover 39 jurisdictions. Four more—the United Kingdom, Bermuda, Mauritius, and the Dubai International Finance Centre—are in the process of joining and recognizing the certifications. For customers, the practical value is a common, independently assessed reference for the company’s privacy practices across participating jurisdictions.

Controller and processor responsibilities

The Global CBPR certification applies to personal information an organization controls. That can include information about customers, employees, and job applicants. Cloudflare says its scope also includes network information: observations about how its cloud platform handles server, network, and traffic data generated while providing services.

Its 18 requirements focus on two principles—Security Safeguards and Accountability. For Cloudflare, this scope includes processing under the Data Processing Addendum signed with customers, especially Customer Content that flows across its network and Customer Logs generated by those data flows. An organization must meet all 18 requirements to qualify for the PRP certification.

The controller standard is broader in its principles and requirements. It sets out 50 requirements based on nine Global CBPR Privacy Principles, which align with core concepts in the Organisation for Economic Co-operation and Development’s Guidelines on the Protection of Privacy and Trans-Border Flows of Personal Data. Organizations must meet all 50 requirements. The principles cover preventing harm, notice, collection limits, uses of personal information, choice, integrity, security safeguards, access and correction, and accountability.

Examples of the audit requirements

Notice is one of the clearest requirements. The first CBPR question asks whether an organization provides clear, accessible statements about its practices and policies for personal information. The point is practical: people need to understand how information will be collected and used when they are deciding whether to provide it. The article links this principle to Article 13 of the EU’s GDPR, which sets out information that must be provided when personal information is collected.

Cloudflare says it makes its privacy notice available from the footer of every page on its website and provides a link when collecting personal information through forms. The standard’s question is about the availability and clarity of an organization’s notice; the company’s description gives examples of where it presents that information.

Another requirement asks organizations to limit their use of collected personal information to the purposes identified in their privacy statement. Cloudflare says it uses the information it collects to provide its services, which help customers protect network applications and improve their speed, security, reliability, and privacy. Its Privacy Policy says personal information will be shared or disclosed as needed to provide services or as otherwise described in the policy, with notice and an opportunity to consent in other cases. Cloudflare also says it keeps internal records of the information it processes and the purposes for that processing, supporting the accountability principle.

Security is assessed in both programs. CBPR question 27 asks organizations to describe physical, technical, and administrative safeguards that protect personal information from risks such as loss, unauthorized access, destruction, modification, disclosure, or misuse. The related PRP question asks how those types of safeguards implement the organization’s information security policy.

Cloudflare says its information security program follows the ISO/IEC 27000 family of standards. Its Customer Data Processing Addendum describes the safeguards in Annex 2, titled “Technical and Organizational Security Measures.” That documentation covers the physical, technical, and administrative measures the company uses to protect personal information.

Accountability also extends to service providers. CBPR question 46 asks whether an organization has mechanisms to ensure that processors, contractors, agents, and other providers meet its obligations to individuals. Cloudflare says vendors that handle its information or customer information must sign a Data Processing Addendum. The company says this passes relevant commitments, including security requirements, through to vendors.

What customers can check

The audits are complete, but formal certification depends on the programs’ launch. Customers assessing the standards should therefore distinguish the reported audit result from the certifications that Cloudflare expects to receive once the schemes officially open. The article does not describe the audit methods, identify the auditing body, or provide a detailed report of findings.

The standards’ practical reach will depend on which jurisdictions join and recognize them, and on how organizations maintain compliance across the full set of requirements. For organizations moving personal information across borders or processing it for customers, the controller and processor scopes offer separate ways to assess responsibilities. Cloudflare directs readers to globalcbpr.org for program details and requirements, and to its Trust Hub for certification information. Customers can access certifications and reports through the Cloudflare dashboard.