Binding corporate rules

What it means

Binding corporate rules are data protection rules approved by a supervisory authority that allow a multinational group to transfer personal data between its companies, including outside the EU. They are one of the tools the GDPR permits for international data transfers.

The rules must be legally binding on all group companies and their employees and must guarantee a level of protection comparable to the GDPR. They contain processing principles, data subject rights, accountability mechanisms, training, audits and a complaints procedure.

They are an alternative to other transfer tools such as standard contractual clauses, signed for individual transfers, or transfers based on an adequacy decision, where the European Commission recognises the protection in the destination country as sufficient.

How it works in practice

Getting binding corporate rules approved is demanding and slow, often taking more than a year. The group must prepare extensive documentation and go through a procedure with the lead supervisory authority, which cooperates with other EU authorities. They are therefore used mainly by large multinational groups.

For smaller companies and groups it is usually more practical to use standard contractual clauses or, for transfers to the US, the EU-US Data Privacy Framework if the recipient is certified. These tools can be put in place faster and more cheaply.

If a Slovak company belongs to a group with approved rules, it must comply with them, build them into its internal procedures and train staff. In an inspection by the Office for Personal Data Protection, it should be able to show how it applies the rules in practice.

What to watch out for

Approved rules cover only intra-group transfers. Transfers to external suppliers outside the EU, such as cloud providers, require another tool, usually standard contractual clauses, together with an assessment of risks in the recipient's country.

Even with approved rules, it must be assessed whether the law of the destination country undermines data protection, for example through access by public authorities. Court of Justice case law has stressed the need for such assessments and, where necessary, supplementary measures.