Recommendations 1/2022 on the Application for Approval and on the elements and principles to be found in Controller Binding Corporate Rules (Art. 47 GDPR)

What it covers

This document sets out a standard application form and the required elements and principles for controller binding corporate rules (BCR-C) under Article 47 GDPR, replacing prior WP29 guidance WP256 rev.01 and WP264, and clarifying the approval process led by a BCR Lead supervisory authority.

Why it matters

It is the operative reference for corporate groups seeking to use BCR-C as an appropriate safeguard for intra-group international transfers and for supervisory authorities assessing such applications.

Refer to it when

• preparing or updating a controller BCR application
• identifying the required content and elements of BCR-C
• determining which supervisory authority is the BCR Lead
• assessing onward transfer and processor obligations within a corporate group's BCR

Questions this document addresses

• What must be included in an application for approval of controller BCR?
• What elements and principles must BCR-C contain under Article 47?
• How is the BCR Lead supervisory authority determined?
• What is the relationship between BCR-C and Article 28 processor contracts within a Group?

Topics

• International transfers
• Binding corporate rules
• Controller & processor