Binding Corporate Rules (BCR)

A multinational often needs to share staff and customer data among its own companies worldwide. Instead of signing contracts for every transfer, the group writes one set of rules covering how all its entities handle personal data. The rules must be legally enforceable, apply to every group member and staff, give individuals rights they can use, and set out training, audit and complaint handling. A lead supervisory authority reviews the draft and, under the GDPR, approves it through the GDPR consistency procedure involving other authorities. Approval can take a long time, so BCRs suit large groups with steady internal flows rather than one-off projects. They cover transfers inside the group only, not to outside suppliers. A group with approved rules can bring in a new subsidiary without negotiating fresh transfer contracts.

A global logistics group with offices in 20 countries wants staff records held in one central system. Rather than sign hundreds of intragroup contracts, it drafts binding corporate rules, has its lead European regulator approve them, and adopts them across every subsidiary. A new office opening later signs up to the rules and is covered.