Binding corporate rules (BCRs) are internal
data protection rules that govern transfers of personal data within
a group from EEA entities to entities located outside the EEA
(third countries).
These rules contain general data protection principles and allow
for a right of action by a data subject against the group for
failure to comply with the rules. As a package, BCRs can provide
the appropriate safeguards to govern all data transfers in a group
pursuant to the GDPR.
There are two types of applications: (1) BCRs for controllers
suitable for transfers of data that the group is ultimately
responsible for and (2) BCRs for processors suitable for transfers
within a group where the group is acting as processor for other
controllers – generally customers.
