# Standards and Regulatory References

## Primary Legislation

### GDPR Article 47 — Binding Corporate Rules
- **Art. 47(1)**: Competent supervisory authority shall approve BCRs provided they are legally binding, apply to every member of the group, and expressly confer enforceable rights on data subjects.
- **Art. 47(2)(a)-(n)**: Exhaustive list of required BCR content elements including group structure, data transfers covered, legally binding nature, data protection principles, third-party beneficiary rights, liability acceptance, data subject information, DPO tasks, complaint procedures, compliance mechanisms, change reporting, SA cooperation, local law reporting, and training.
- **Art. 47(3)**: Commission empowered to specify the format and procedures for BCR approval.

### GDPR Article 46 — Transfers Subject to Appropriate Safeguards
- **Art. 46(2)(b)**: BCRs pursuant to Art. 47 constitute appropriate safeguards for international transfers.

### GDPR Articles 63-64 — Consistency Mechanism
- **Art. 63**: Consistency mechanism applies to BCR approvals to ensure consistent application across the EU.
- **Art. 64(1)(f)**: EDPB shall issue an opinion on draft decisions of competent SAs regarding BCR approval.

### GDPR Article 58 — Powers of Supervisory Authorities
- **Art. 58(1)(j)**: SAs have the power to order the suspension of data flows to a recipient in a third country, including flows authorised under BCRs, where the SA considers that the BCRs are not being complied with.

## Article 29 Working Party / EDPB Guidance

### WP256 Rev.01 — Working Document Setting Up a Table with the Elements and Principles to be Found in BCR (Controller BCRs)
- **Adopted**: 6 February 2018 (last revised by the EDPB)
- **Content**: Detailed referential table specifying all mandatory elements of BCR for controllers, organised into eight sections: binding nature, scope, principles, rights, liability, complaints, training/audit, and updates.
- **Application**: Primary checklist for drafting and reviewing BCR-C applications.

### WP257 Rev.01 — Working Document Setting Up a Table with the Elements and Principles to be Found in Processor BCR
- **Adopted**: 6 February 2018 (last revised by the EDPB)
- **Content**: Processor-specific referential adding elements on instructions-based processing, sub-processor management, controller notification, data return/deletion, and audit facilitation.
- **Application**: Supplementary checklist for BCR-P applications.

### WP263 Rev.01 — Recommendation on the Standard Application for Approval of BCR for Controllers and Processors
- **Adopted**: 6 February 2018
- **Content**: Standard application form specifying the documentation package to be submitted to the lead SA, including entity list, data flow maps, compliance evidence, and training programme description.

### WP264 Rev.01 — Working Document on the Approval Procedure for BCR
- **Adopted**: 6 February 2018
- **Content**: Describes the cooperation procedure between lead SA and concerned SAs, including timelines, objection mechanisms, and the role of the EDPB consistency mechanism.

### EDPB Recommendations 01/2022 on the Application for Approval and on the Elements and Principles to be Found in BCR (Art. 47 GDPR)
- **Adopted**: 20 June 2023
- **Content**: Updated guidance consolidating WP256/WP257/WP263/WP264, reflecting post-Schrems II requirements including supplementary measures obligations and enhanced transparency for government access.

## Enforcement and Precedent

### Approved BCR Register (EDPB)
- The EDPB maintains a public register of approved BCRs. As of early 2026, approximately 180 BCR-C and 30 BCR-P approvals have been granted.
- Notable approved BCR holders include multinational corporations across financial services, technology, pharmaceuticals, and logistics sectors.

### National SA Enforcement
- **French CNIL**: Approved Societe Generale BCR (2019); required amendments to strengthen government access transparency obligations.
- **Belgian DPA**: Led the cooperation procedure for several financial services BCR approvals, typically with a 14-16 month timeline.
- **ICO (UK pre-Brexit)**: Served as lead SA for several UK-headquartered multinationals; post-Brexit, these BCRs required re-approval under UK GDPR mechanisms.
- **BlnBDI (Berlin)**: Serves as lead SA for Berlin-headquartered groups; typical review timeline of 5-7 months before entering the cooperation procedure.

## ISO/IEC Standards

- **ISO/IEC 27701:2019**: Sections 7.5 (data sharing, transfer, and disclosure) and 8.5 (processor obligations) align with BCR content requirements for security and processing standards.
- **ISO/IEC 27001:2022**: Provides the baseline security framework commonly referenced in BCR Annex C for minimum technical and organisational measures.
- **ISO 19600:2014 / ISO 37301:2021**: Compliance management systems standards supporting the BCR governance, monitoring, and audit programme requirements.