Previous updates
-
Due to the Data (Use and Access) Act coming into law on 19 June 2025, this guidance is under review and may be subject to change. The Plans for new and updated guidance page will tell you about which guidance will be updated and when this will happen.
On 25 July 2022 new guidance on binding corporate rules was issued. The new guidance supersedes all previous guidance and documents.
Binding Corporate Rules from 1 January 2021
From 1 January 2021 the ICO will accept UK BCRs Controller and UK BCRs Processor applications.
New applications for UK BCRs must be submitted to the ICO using the UK BCR application forms and referential tables referenced below. The ICO will work with you, your legal team or external lawyers in the review of your UK BCR application. When the ICO is satisfied that the requirements have been met the Information Commissioner will approve the UK BCR.
Organisations with existing authorised EU BCRs do not need to complete a UK BCR application form or referential table. However they must still provide ICO with a UK version of their BCRs.
The Information Commissioner has created the following guidelines for UK BCRs applications whilst complying with the requirements of UK GDPR: