Binding Corporate Rules

Binding Corporate Rules (BCRs) are a tool that can be used by a a group of undertakings, or a group of enterprises engaged in a joint economic activity, to ensure appropriate safeguards for the transfer of personal data to third countries.  
The register provides an overview of approved BCRs. For BCRs approved after the application of the GDPR (25 May 2018), links to the EDPB Opinion and to the national decision of the supervisory authority are provided.
This overview list is provided for information purposes only. Companies have a responsibility to inform the competent supervisory authorities of changes to the BCR. The list is updated based on information provided by the companies to the competent supervisory authorities.
For categories of data subjects in the case of BCR-P, the categories of data relate to data processed on behalf of the controllers outside of the group. Companies relying on BCR for data transfers are obliged to give data subjects easy access to their BCR. For further information on the BCR, please contact the company concerned.

  • 253 items
Filter on
Filter on competent SA
Filter on type of BCR
Filter on data subjects

FrieslandCampina

Type of BCR
Controller
Categories of data subjects
Employees
Contractors
Clients, customers
Suppliers
Suppliers, service providers
Other third parties as part of the Group’s regular business activities

Fujikura Automotive Europe Group (FAE Group)

Type of BCR
Controller
Categories of data subjects
Employees and business contacts

GENERAL ELECTRIC HEALTHCARE (GEHC)

fr
Type of BCR
Processor
Categories of data subjects
Employees
Contractors
Clients, customers
Suppliers
Suppliers, service providers
Other third parties as part of the Group’s respective regular business activities

General Electric Vernova

fr
Type of BCR
Controller
Categories of data subjects
Employees
Contractors
Clients, customers
Suppliers
Suppliers, service providers
Other third parties as part of the Group’s respective regular business activities

Genpact

Type of BCR
Processor
Categories of data subjects
Employees
Contractors
Clients, customers
Suppliers
Suppliers, service providers
Other third parties as part of the Group’s respective regular business activities

Giesecke + Devrient GmbH

Type of BCR
Controller
Categories of data subjects
Employees
Clients, customers
Suppliers
Suppliers, service providers

Giesecke + Devrient GmbH

Type of BCR
Processor
Categories of data subjects
Employees
Clients, customers
Suppliers
Suppliers, service providers

GlaxoSmithKline Plc

Type of BCR
Controller
Categories of data subjects
Employees
Contractors

Groupon International Limited

Type of BCR
Controller
Categories of data subjects
Employees
Clients, customers
Suppliers
Suppliers, service providers

Heineken

Type of BCR
Controller
Categories of data subjects
Employees
Contractors
Clients, customers
Suppliers
Suppliers, service providers
Other third parties as part of the Group’s regular business activities