Skip to content

Binding Corporate Rules (BCRs)

What is Binding Corporate Rules (BCRs)?

Internal rules adopted by a multinational group of companies that define their global policy regarding international transfers of personal data within the group. BCRs must be approved by the relevant data protection authority.

Privacy

Terms that appear alongside binding corporate rules (bcrs)

Each of these is named in at least one of the same controls as binding corporate rules (bcrs). The number is how many controls name both.

Frameworks that govern binding corporate rules (bcrs)

GDPRView framework →ISO 27001:2022View framework →

What the standards actually require on binding corporate rules (bcrs)

Requirements naming binding corporate rules (bcrs) across 6 standards, quoted from the control text.

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)1 control

Article 22 (CROSS-BORDER TRANSFER) - personal data may be transferred OUTSIDE the UAE only where: (a) ADEQUACY - the UAE Data Office determines that the third country provides an adequate level of protection;

UAE-PDPL-Art.22_23_24 · Cross-border data transfers (UAE PDPL Articles 22-24) →
Iceland Data Protection and Processing of Personal Data Act (Act No. 90/2018)1 control

Chapter V (Articles 27-30) Transfer of Personal Data Abroad. Articles 27 + 28 + 29 + 30 govern cross-border transfers per GDPR Articles 44-49 transposition.

ICELAND-Act90-Chap5-CrossBorder-EEA-AdequacyDecisions-SCC-BCR · Iceland Act 90/2018 - Chapter V Cross-Border Transfer of Personal Data + EEA + Adequacy + SCCs + BCRs + Article 30 Privacy Policy →
Indonesia PDP Law1 control

Articles 47-56 of UU PDP govern relationships with processors and cross-border transfers. Article 47-50 Personal Data Processor: Processor (Prosesor Data Pribadi) shall (a) process personal data based on instructions from Personal Data Controller;

IDPdp-Processor-Contracts-DPA-Vendor-Art51-Subprocessor-Audit-Confidentiality-EndOfContract · Indonesia PDP Articles 47-56 + Personal Data Processor + DPA Contracts + Subprocessor Approval + Cross-Border Transfer Adequacy/BCR/Consent + Indonesian Representative →
Italy Personal Data Protection Code (Legislative Decree No. 196/2003, amended 2018)1 control

Cross-border transfer of personal data from Italy is governed by GDPR Chapter V + Italian Codice + Italian Garante guidance. (1) GDPR Chapter V Transfer Mechanisms: (a) Adequacy decisions per Commission - Andorra + Argentina + Canada (commercial organisations)...

ItalyCodice-CrossBorder-Transfer-Adequacy-SCCs-BCRs-Retention-ItalianSectorRules-EUDataAct · Italy Codice Cross-Border Transfer + EU Adequacy + Standard Contractual Clauses + Binding Corporate Rules + EU Data Act + Italian Sector Retention Rules + Schrems II + Transfer Impact Assessment →
Jamaica Data Protection Act 20201 control

Standard 8 per Section 27 + the Schedule of the Jamaica Data Protection Act 2020: Personal data shall not be transferred outside Jamaica unless adequate protection is provided.

JM-DPA2020-Standard8-Transfers-Outside-Jamaica-Sec27-Adequacy-Decisions-Standard-Contractual-Clauses-BCR-Derogations · Jamaica DPA 2020 Standard 8 - Transfers Outside Jamaica + Section 27 + Adequacy Decisions + Standard Contractual Clauses + Binding Corporate Rules + Derogations + Cross-Border Data Flows + Caribbean Community + International Data Privacy →
Jordan Draft Personal Data Protection Law (2022)1 control

Articles 20-21 of the Jordan PDPL govern cross-border transfers of personal data closely modelled on EU GDPR Chapter V. (1) Article 20 General Prohibition: Cross-border transfer prohibited unless one of these grounds applies (a) Adequacy Determination by Counc...

JO-PDPL-Cross-Border-Transfer-Article20-21-Adequacy-Consent-Public-Interest-Performance-Council-Approval · Jordan PDPL Cross-Border Transfer + Articles 20-21 + Adequacy + Consent + Public Interest + Performance + Council Approval + Standard Contractual Clauses + Binding Corporate Rules + Derogations + GCC Coordination →

Questions people ask about binding corporate rules (bcrs)

What is Binding Corporate Rules (BCRs)?
Internal rules adopted by a multinational group of companies that define their global policy regarding international transfers of personal data within the group. BCRs must be approved by the relevant data protection authority.
Why is Binding Corporate Rules (BCRs) important for compliance?
Binding Corporate Rules (BCRs) is a key concept in Privacy. Understanding binding corporate rules (bcrs) helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 686 frameworks with 311K cross-framework control mappings.
Which compliance frameworks address Binding Corporate Rules (BCRs)?
Binding Corporate Rules (BCRs) appears in the requirement text of Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL), Iceland Data Protection and Processing of Personal Data Act (Act No. 90/2018), Indonesia PDP Law, Italy Personal Data Protection Code (Legislative Decree No. 196/2003, amended 2018), Jamaica Data Protection Act 2020. Across these standards we have identified 6 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Binding Corporate Rules (BCRs)?
Explore our compliance framework pages to see how binding corporate rules (bcrs) applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 686 frameworks.

See how Binding Corporate Rules (BCRs) applies across compliance frameworks

Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.