Binding corporate rules, or BCRs, are internal data protection rules that bind every member of a corporate group and are approved by a supervisory authority. They let the group move personal data between its entities worldwide. Article 47 of the GDPR lists what the rules must contain, from structure and liability to training and complaints.
Who approves them
The competent supervisory authority approves BCRs through the consistency mechanism in Article 63. That involves several authorities, so expect a long process. The article also says the rules must be legally binding on and enforced by every member of the group, including employees, and must expressly confer enforceable rights on individuals.
What they must contain
Article 47(2) lists the content. In plain words:
- The group's structure and contact details.
- The transfers covered: data categories, processing, purposes, people affected and countries.
- How the rules bind members internally and externally.
- How core principles apply, such as purpose limitation, minimisation, storage limits, accuracy, security and onward transfers.
- Individual rights and how to use them, including complaints and redress.
- Liability: an EU based group member accepts liability for breaches by members outside the EU, unless it proves it was not responsible.
- How individuals get information about the rules.
- The role of the data protection officer or other monitoring body.
- Complaint procedures.
- Internal audits and corrective actions, with results available to the authority.
- How changes are recorded and reported.
- Cooperation with the authority.
- Reporting to the authority any third country legal requirement likely to undermine the rules.
- Training for staff with regular access to personal data.
What BCRs do not do
They cover transfers within the group. They do not cover sending data to outside vendors. A multinational that uses BCRs internally still needs a tool such as standard clauses for each external processor outside the EEA.
What it means for engineers
If you work in a group with BCRs, you may be asked to implement them in practice:
- Keep an inventory of internal systems by country and the data they hold.
- Support audits with exportable access and configuration evidence.
- Provide data for complaint handling and rights requests across entities.
- Flag any local law demand for data to the privacy team.
Item four matters because the rules require reporting such demands to the authority.
Should a smaller company bother?
Usually not. The time and cost of approval suit large groups with many internal flows. Most software companies start with standard clauses and revisit if they grow into multiple entities. See Article 46 tools compared.
How BCRs sit next to other tools
A group with BCRs can move data between its own entities without signing clauses for each pair. The price is the approval effort and the ongoing duties: audits, training, complaint handling and keeping the rules current. Many groups run BCRs for intra group flows and clauses for outside vendors at the same time.
A question for your architects
If your group has BCRs, ask whether the rules describe the transfers you actually make. Article 47 requires the rules to specify the categories of data, the purposes and the countries. A new product line sending new data categories to a new country may need the rules to be updated and reported.
Quick check
Do BCRs cover our cloud vendor?
No. They cover transfers inside the group. External vendors need another tool.
Sources
This is educational content, not legal advice. The article text can be amended; check the current version.
Last reviewed: 19 October 2026.
