bcr-establishment

Establishing Binding Corporate Rules

Overview

Binding Corporate Rules (BCRs) are internal data protection policies adopted by a multinational group of undertakings or enterprises to permit transfers of personal data from EU/EEA entities to group members in third countries under GDPR Article 47. BCRs provide a legally binding framework that ensures an essentially equivalent level of protection for personal data transferred within the corporate group, regardless of the destination country. The approval process involves a lead supervisory authority, a cooperation procedure among concerned SAs, and typically spans 12 to 18 months from initial submission to final approval.

Art. 47(2) Content Requirements

(a) Structure and Contact Details of the Group

The BCR must specify the structure of the group of undertakings or enterprises, including the identity and contact details of each member bound by the BCR.

Athena Global Logistics implementation:

• Group parent entity: Athena Global Logistics GmbH, Friedrichstrasse 112, 10117 Berlin, Germany
• Group DPO: Elisa Brandt, elisa.brandt@athenalogistics.eu, +49 30 1234 5678
• Bound entities: All wholly-owned subsidiaries and majority-controlled affiliates listed in BCR Annex A (currently 47 entities across 31 jurisdictions)
• Structure chart: Updated annually and annexed to the BCR as Annex A, reflecting the legal entity hierarchy from the parent to each subsidiary

(b) Data Transfers Covered

The BCR must describe the data transfers or set of transfers, including the categories of personal data, the type of processing and its purposes, the type of data subjects affected, and the identification of the third country or countries.

Implementation requirements:

• Scope document specifying all intra-group transfer categories: HR data (employee records, payroll, benefits), customer data (shipment records, billing, communications), supplier data (contact details, contractual records), and operational data (vehicle tracking, warehouse access logs)
• Purpose register linking each transfer category to one or more specified purposes: employment administration, freight operations, financial reporting, regulatory compliance, IT support
• Data subject taxonomy: employees, contractors, temporary workers, customers (individual and corporate contacts), suppliers, business partners, website visitors
• Destination country register: all non-EEA jurisdictions where bound group entities operate

(c) Legally Binding Nature

The BCR must establish the legally binding nature of the rules, both internally and externally.

Implementation elements:

• Intra-group agreement signed by all bound entities, creating contractual obligations enforceable between group members
• BCR adopted as a binding corporate policy by resolution of the board of the parent company, with cascading adoption resolutions by each subsidiary board
• Employee handbook incorporation: BCR summary and compliance obligations included in all employment contracts and data handling procedures
• External enforceability: explicit third-party beneficiary clause granting data subjects the right to enforce the BCR provisions directly against any bound entity

(d) Application of the General Data Protection Principles

The BCR must demonstrate the application of all general data protection principles under Article 5, including purpose limitation, data minimisation, limited storage periods, data quality, data protection by design and by default, legal basis, special category data processing, and measures to ensure data security.

Required content:

• Purpose limitation: data transferred under the BCR may be processed only for the purposes specified in the BCR scope document; any new purpose requires a compatibility assessment under Art. 6(4) and BCR amendment procedure
• Data minimisation: transfers limited to data adequate, relevant, and necessary for the specified purpose; group-wide data classification policy mandating review of data elements before transfer
• Storage limitation: retention schedules specified per data category and jurisdiction; automated deletion or anonymisation upon expiry
• Accuracy: procedures for data subjects to request correction; data quality checks at transfer points
• Security: minimum security standards applicable to all bound entities per BCR Annex C (aligned with ISO 27001:2022)

(e) Third-Party Beneficiary Rights

Data subjects must be able to enforce the BCR as third-party beneficiaries and have the right to:

• Receive compensation for material and non-material damages resulting from BCR violations
• Lodge complaints with the competent supervisory authority
• Exercise all data subject rights (access, rectification, erasure, restriction, portability, objection) against any bound entity

(f) Acceptance of Liability

The BCR must include acceptance of liability by the entity established in the EU (the BCR Lead) for any breach committed by a non-EU bound entity, with the burden of proof on the BCR Lead to demonstrate the non-EU entity was not responsible.

Athena Global Logistics implementation:

• BCR Lead: Athena Global Logistics GmbH (Berlin)
• Liability clause: The BCR Lead accepts liability for breaches by any non-EU bound entity and agrees to take necessary action to remedy the breach and pay compensation
• Insurance: professional indemnity insurance covering BCR-related claims with a minimum coverage of EUR 10,000,000 per claim

(g) Information Provided to Data Subjects

The BCR must specify the information provided to data subjects about the BCR and their rights, including:

• The BCR and a summary in plain language published on the company website
• Information about the complaints procedure and the right to lodge a complaint with the SA
• Information about the right to seek judicial remedies
• The identity and contact details of the BCR Lead and the DPO

(h) DPO Tasks

The BCR must describe the tasks of the Data Protection Officer (or equivalent responsible person/entity), including:

• Monitoring BCR compliance across all bound entities
• Conducting or overseeing BCR audits
• Handling data subject complaints related to BCR transfers
• Serving as the contact point for supervisory authorities
• Reporting to the board on BCR compliance status

(i) Complaint Procedures

The BCR must establish a complaints mechanism enabling data subjects to:

• Submit complaints to any bound entity or the BCR Lead
• Receive a response within 30 calendar days
• Escalate unresolved complaints to the DPO, then to the competent SA
• Access mediation or arbitration as an alternative dispute resolution mechanism

(j) Compliance Verification Mechanisms

The BCR must describe mechanisms for ensuring compliance:

• Internal BCR audit programme: conducted by the internal audit function, with at least one full-cycle audit every three years covering all bound entities
• Annual compliance self-assessments by each bound entity, reported to the DPO
• Monitoring tools: data transfer logging, access reviews, policy adherence metrics
• Results reported to the BCR Lead's management and, upon request, to the competent SA

(k) Change Reporting Mechanisms

The BCR must establish reporting and recording mechanisms for changes:

• Amendment procedure: any change to the BCR requires approval by the BCR Lead, notification to the lead SA, and communication to all bound entities
• Annual update cycle for the entity list (Annex A) and security standards (Annex C)
• Material changes (new countries, new data categories, structural changes) must be notified to the SA before implementation

(l) Cooperation with the Supervisory Authority

The BCR must establish a cooperation mechanism with the SA:

• The BCR Lead will submit to the jurisdiction of the competent SA
• The BCR Lead will make audit results available to the SA upon request
• The BCR Lead will comply with SA advice regarding BCR interpretation and application
• Annual BCR compliance report submitted to the lead SA

(m) Local Law Reporting

The BCR must require any bound entity to report to the BCR Lead any legal requirement in its jurisdiction that is likely to have a substantial adverse effect on the guarantees provided by the BCR.

Implementation:

• Annual local law survey conducted by outside counsel in each jurisdiction
• Immediate escalation procedure for new legislation or government access demands that conflict with BCR commitments
• Assessment protocol: evaluate whether the local law requirement materially undermines BCR protections and, if so, notify the SA and suspend affected transfers

(n) Training

The BCR must describe appropriate data protection training for personnel with access to transferred data:

• Mandatory onboarding training for all new employees with data access
• Annual refresher training on BCR requirements, data subject rights, and breach reporting
• Role-specific training for IT administrators, HR staff, and customer-facing personnel
• Training records maintained centrally and available for SA audit

BCR Approval Process

Step 1: Preparation (Months 1-3)

1. Draft the BCR document against the WP256 rev.01 referential (BCR for controllers) or WP257 rev.01 referential (BCR for processors).
2. Map all intra-group data flows to identify the transfers covered by the BCR.
3. Prepare the Annex A entity list, Annex B transfer scope, and Annex C security standards.
4. Conduct a gap analysis against the referential checklist.
5. Prepare the BCR application form for the lead SA.

Step 2: Lead SA Identification (Month 3)

1. Identify the lead SA per the EDPB criteria: the SA of the Member State where the BCR Lead (typically the parent or the entity with delegated data protection responsibility) is established.
2. For Athena Global Logistics: the lead SA is the Berliner Beauftragte fuer Datenschutz und Informationsfreiheit (BlnBDI).
3. Identify concerned SAs: all SAs of Member States where bound entities are established.

Step 3: Formal Submission (Month 4)

1. Submit the BCR application to the lead SA with all supporting documentation.
2. Include: BCR text, entity list, data flow maps, gap analysis results, evidence of internal approval, DPO contact details.

Step 4: Lead SA Review (Months 4-9)

1. The lead SA reviews the BCR for completeness and compliance with Art. 47(2).
2. Expect multiple rounds of questions and amendments.
3. Maintain a correspondence log and amendment tracker.
4. Typical duration: 4-6 months of iterative review.

Step 5: Cooperation Procedure (Months 9-12)

1. The lead SA circulates the reviewed BCR to all concerned SAs.
2. Concerned SAs have a defined period (typically 2 months) to raise objections or comments.
3. The lead SA consolidates feedback and works with the applicant to address concerns.
4. If consensus is reached, the lead SA provides a positive opinion.

Step 6: Consistency Mechanism (Months 12-14)

1. Under Art. 63-64 GDPR, the lead SA may submit the draft approval to the EDPB for an opinion if there are unresolved objections.
2. The EDPB issues an opinion within 8 weeks (extendable by 6 weeks).

Step 7: Formal Approval (Months 14-18)

1. The lead SA issues the formal BCR approval decision.
2. The approval may include conditions or recommendations.
3. The BCR Lead must implement any conditions before relying on the BCR for transfers.
4. Publish the approved BCR summary on the EDPB BCR register and the company website.

Step 8: Implementation and Rollout (Post-Approval)

1. Communicate the approved BCR to all bound entities.
2. Execute the intra-group agreement binding all entities.
3. Deploy the training programme.
4. Activate the audit programme.
5. Begin the monitoring and reporting cycle.

WP256 Rev.01 Referential (BCR for Controllers) — Key Elements Checklist

Element	WP256 Section	Status
Binding nature of the BCR	Section 1	Required
Scope — data, transfers, entities	Section 2	Required
Application of GDPR principles	Section 3	Required
Rights of data subjects and enforcement	Section 4	Required
Liability and jurisdiction	Section 5	Required
Cooperation duty with SAs	Section 5.4	Required
How to handle requests from authorities	Section 5.5	Required
Complaint handling	Section 6	Required
Training programme	Section 7	Required
Audit programme	Section 7	Required
Network of privacy officers	Section 7.3	Required
Update and change management	Section 8	Required
Local law conflicts	Section 5.5	Required
Description of conflict resolution	Section 6	Required

WP257 Rev.01 Referential (BCR for Processors) — Additional Elements

Element	Description
Instructions-based processing	Processor BCR must confirm processing only on documented instructions
Sub-processor management	Procedures for sub-processor authorisation, due diligence, and contractual flow-down
Controller notification	Obligation to inform the controller of any inability to comply
Data return/deletion	Procedures upon termination of the processing relationship
Audit facilitation	Obligation to make available all information necessary to demonstrate compliance

Post-Approval Ongoing Obligations

1. Annual compliance audit: At least one comprehensive BCR audit per year, with each bound entity audited within a three-year rolling cycle.
2. Entity list maintenance: Annex A updated whenever entities join or leave the group; SA notified of material changes.
3. Incident reporting: Any breach involving BCR-covered data reported to the BCR Lead and, where required, to the competent SA per Art. 33.
4. Local law monitoring: Continuous monitoring of legal developments in third countries that may affect BCR protections.
5. Training records: Maintained and available for SA review at all times.
6. BCR review and amendment: Full BCR review at least every three years, with interim amendments as needed for material changes.