Recommendations 1/2026 on the Application for Approval and on the elements and principles to be found in Processor Binding Corporate Rules (Art. 47 GDPR)

What it covers

This is a consultation-stage recommendation setting out the standard application form and the elements and principles required for Processor Binding Corporate Rules (BCR-P) under Article 47 GDPR, including their scope, their interplay with Article 28 processing agreements, and the approval procedure before the BCR Lead supervisory authority. It repeals and replaces the earlier WP257 rev.01 and WP265 documents.

Why it matters

It is the current reference for organisations seeking to use processor BCR as an appropriate safeguard for international transfers within a corporate group, though it remains at the public consultation stage and should not be treated as current.

Refer to it when

• preparing an application for approval of processor BCR
• distinguishing BCR-P from BCR-C
• understanding what must be included in a BCR-P versus a processing agreement
• identifying the role of the BCR Lead supervisory authority

Questions this document addresses

• What must be included in an application for approval of BCR-P?
• How do BCR-P interact with the Article 28 processing agreement?
• What is the scope of transfers that BCR-P can cover?
• Who approves BCR-P and what is the role of the EDPB in that process?

Topics

• International transfers
• Binding corporate rules
• Controller & processor