What are binding corporate rules?
-
Due to the Data (Use and Access) Act coming into law on 19 June 2025, this guidance is under review and may be subject to change. The Plans for new and updated guidance page will tell you about which guidance will be updated and when this will happen.
What are binding corporate rules?
Binding corporate rules (BCRs) are intended for use by:
- multinational corporate groups;
- franchise groups;
- joint ventures;
- professional partnerships; or
- any other group of undertakings or group of enterprises engaged in a joint economic activity.
You can choose to create a UK BCR by using:
- the UK BCR Addendum, which incorporates an approved EU BCR; or
- bespoke UK BCR documentation.
Once we approve your UK BCR, both options are a safeguard under the UK GDPR.
You can make a restricted transfer within your group if:
- both you and the receiver are part of your group’s approved UK BCR; and
- you’ve completed a TRA to make sure the standard of protection for people’s information is not materially lower after you transfer it.
In practice, your group may have completed a TRA that covers your restricted transfer.
For further information on UK BCRs and the approval process, see our Guide to binding corporate rules.