BCR (Binding Corporate Rules)
Article 47 GDPR — binding data protection rules for a corporate group
TL;DR
BCRs are a safeguard instrument for third-country transfers within a corporate group or group of undertakings. They replace SCCs and must be approved by a supervisory authority.
What are BCRs (Binding Corporate Rules)?
Mandatory content of BCRs (Article 47(2)):
- Structure of the group + member undertakings
- Categories of data + purposes of processing
- Safeguards for data subject rights
- Liability and sanction rules
- Complaints procedure
- Training obligations
- Audit mechanisms
The approval procedure runs with the lead supervisory authority — in practice it often takes 18-36 months (experience value, not a statutory time limit).
Practical example
A global group with 40 subsidiaries wants to process HR data worldwide on a central basis. SCCs for each recipient would be laborious. Once approved by the lead supervisory authority, the BCRs provide a single basis for transfers to the group companies in third countries.
Frequently asked questions
What do BCRs cost?
There is no reliable flat figure. The effort depends mainly on the number of group companies and countries involved, the scope of the data flows, the existing state of documentation and whether external advisers are brought in. On top of this come the ongoing obligations arising from the BCRs themselves, such as training and audit mechanisms (Article 47(2) GDPR). For smaller groups, standard contractual clauses (SCCs) are, in our practical assessment, usually the simpler route.
Are they enough for a third country?
Yes, BCRs replace SCCs for intra-group transfers.
Fines for an infringement?
Art. 83(5)(c) — up to EUR 20 million or 4%.
See also
Practitioner note: This article is practice-oriented compliance documentation, not legal advice. We are compliance specialists, not a law firm. For legally binding advice, consult a qualified lawyer.