Binding Corporate Rules (BCRs)

What are binding corporate rules (BCRs)?

Binding corporate rules (BCRs) are a company group's own data protection rulebook for sending personal data out of the EU. Once a data protection authority approves them, the group's companies can move EU personal data between themselves, even to countries without an adequacy decision.

They are one of the "appropriate safeguards" listed in GDPR Article 46(2)(b), next to standard contractual clauses (SCCs). SCCs are a contract between the companies that sign them. BCRs cover transfers inside one corporate group only.

Article 47 sets the bar. The rules must:

• Be legally binding on every group member concerned, including its employees.
• Give the people whose data is transferred rights they can enforce.
• Name a group company in the EU that accepts liability for breaches by members outside the EU.
• Set up complaint handling, audits, staff training and a way to report foreign laws that could undercut the rules.

The lead authority (the "BCR Lead") approves them after an opinion from the European Data Protection Board (EDPB). Under the EDPB's controller BCR recommendations, the group must report changes to the BCR Lead in a yearly update. In the UK, the ICO approves UK BCRs under the UK GDPR.

Controller BCRs and processor BCRs

Controller BCRs (BCR-C) cover data the group uses for its own purposes, such as staff records. Processor BCRs (BCR-P) cover data the group handles for its customers, as a SaaS vendor does.

In January 2026 the EDPB put a draft update of its processor guidance out for consultation. As of October 2026 there was no final version. The draft says processor BCRs let a vendor's group companies act as subprocessors for each other without separate contracts, but do not cover a transfer straight from you to one of its companies outside the EU, which needs another tool such as SCCs.

What it looks like in a vendor's terms

A vendor with processor BCRs ties them into its data processing agreement (DPA). A typical clause reads like this:

Where Customer Personal Data is transferred to a Group Member outside the EEA, the transfer is governed by our Processor Binding Corporate Rules, the current version of which is available on our website and incorporated by reference. Customer may enforce the BCRs against the Group. Where the BCRs do not apply, the Standard Contractual Clauses apply.

• "Group Member": only companies inside the vendor's group are covered.
• "The current version ... incorporated by reference": the rules live on a web page and can be updated without your signature.
• "Customer may enforce": the EDPB's draft guidance expects the DPA to make processor BCRs enforceable by the customer against the group.
• "Where the BCRs do not apply": the fallback for services and transfers the BCRs do not cover.

The Salesforce Data Processing Addendum follows this pattern. It applies its processor BCRs to the services listed in an appendix, incorporates "the most current versions" of the BCRs by reference, and says the BCRs "shall prevail" if they conflict with the DPA.

Why it matters to you

If a vendor relies on BCRs, part of its transfer promise sits in a document you did not negotiate. Changes that could weaken the rules go to the authorities first, but your signed DPA will not show them.

BCRs also stop at the edge of the group. Outside subprocessors, such as a cloud host or an AI model provider, need SCCs, the Data Privacy Framework or another route. And approval does not end your own duty. The EDPB says each data exporter must still check, case by case, whether the destination's laws call for extra safeguards. That check is a transfer impact assessment.

When your own customers ask how their data leaves the EU, "our vendor has BCRs" is only part of the answer.

What to check

• Which BCRs: controller or processor BCRs, which authority approved them, and whether UK BCRs exist for UK data.
• Which services: whether the products you buy are on the covered list.
• Which companies: the group members bound by the rules, and where they are.
• Your right to enforce: whether the DPA lets you enforce the BCRs against the group.
• The fallback: which tool covers transfers outside the group. Compare it with the subprocessor list.
• Updates: whether the DPA points to "the current version" on a website, and how the vendor tells you when it changes.

How Venpo helps

A vendor's BCRs work together with its DPA and subprocessor list. Venpo watches your vendors' DPAs, subprocessor lists and other public legal pages and emails you a plain-English alert when one changes, such as a new subprocessor outside the group. Each vendor's change history keeps a redline of every version, so you can show which rules applied when.