# BCR Approval Workflow Reference

## Pre-Application Preparation Workflow

### Step 1: Scoping and Feasibility (Weeks 1-4)

1. **Determine BCR type**: BCR-C (controller) under WP256 or BCR-P (processor) under WP257, based on the group's role in the relevant transfers.
2. **Map the corporate group**: Document all legal entities, including subsidiaries, affiliates, joint ventures, and branch offices. Determine which entities will be bound.
3. **Map intra-group data flows**: For each pair of transferring entities, document the data categories, data subject types, transfer frequency, processing purposes, and destination countries.
4. **Assess feasibility**: Evaluate whether BCRs are the appropriate mechanism (vs. SCCs or other Art. 46 safeguards) based on: number of entities, volume and complexity of transfers, and long-term strategic value.
5. **Obtain executive sponsorship**: Present BCR business case to the board, including estimated timeline (12-18 months), resource requirements, and long-term compliance benefits.

### Step 2: Gap Analysis (Weeks 5-8)

1. **Benchmark against WP256/WP257 referential**: For each element in the referential table, assess the current state of compliance within the group.
2. **Identify policy gaps**: Missing or inadequate data protection policies, procedures, or governance structures.
3. **Identify technical gaps**: Security controls that do not meet the minimum standards required for BCR Annex C.
4. **Identify organisational gaps**: Absence of a DPO network, insufficient training programmes, or lack of audit capability.
5. **Prioritise remediation**: Create a remediation plan with responsible owners, deadlines, and dependencies.

### Step 3: BCR Drafting (Weeks 8-16)

1. **Draft the BCR policy document**: Core BCR text covering all Art. 47(2)(a)-(n) elements, structured per WP256/WP257 referential.
2. **Draft Annex A — Entity List**: Complete list of bound entities with legal names, jurisdictions, and roles.
3. **Draft Annex B — Transfer Scope**: Detailed description of covered transfers per the requirements of Art. 47(2)(b).
4. **Draft Annex C — Security Standards**: Minimum technical and organisational measures applicable to all bound entities.
5. **Draft the Intra-Group Agreement (IGA)**: Legal instrument creating binding obligations between all group members.
6. **Prepare the complaint handling procedure**: Detailed process for data subject complaints about BCR transfers.
7. **Prepare the training programme description**: Curriculum, delivery method, frequency, and tracking mechanisms.
8. **Prepare the audit programme description**: Scope, frequency, methodology, and reporting structure.

### Step 4: Internal Approval (Weeks 16-18)

1. Submit BCR package to the DPO for review against referential compliance.
2. Legal review by internal or external counsel for enforceability in all relevant jurisdictions.
3. Board approval of the BCR policy and intra-group agreement.
4. Subsidiary board approvals (may proceed in parallel).

## Formal Approval Workflow

### Step 5: Lead SA Submission (Week 18)

1. Complete the standard application form (WP263 rev.01).
2. Compile the submission package: BCR text, all annexes, gap analysis results, remediation evidence, entity list, data flow maps, training programme, audit programme, board resolution.
3. Submit to the lead SA (BlnBDI for Athena Global Logistics) via their designated channel.
4. Record the submission date and reference number.

### Step 6: Lead SA Review (Weeks 18-40)

1. Acknowledge receipt and confirm completeness within 2 weeks.
2. Lead SA conducts substantive review against the referential.
3. Expect 2-4 rounds of questions and requested amendments.
4. For each round: receive SA questions, prepare responses and amendments within 3 weeks, resubmit.
5. Maintain a detailed correspondence log with SA reference numbers, questions, responses, and amendment tracking.
6. Target: lead SA positive preliminary assessment by Week 40.

### Step 7: Cooperation Procedure (Weeks 40-52)

1. Lead SA circulates the reviewed BCR to all concerned SAs.
2. Concerned SAs have 2 months to review and submit comments or objections.
3. Lead SA consolidates feedback.
4. If objections arise: lead SA mediates between the applicant and objecting SA; prepare additional amendments if needed.
5. If no objections or objections are resolved: lead SA confirms consensus.
6. Target: cooperation procedure complete by Week 52.

### Step 8: EDPB Consistency Mechanism (Weeks 52-60, if triggered)

1. If unresolved objections remain, the lead SA refers the matter to the EDPB.
2. EDPB issues an opinion within 8 weeks (extendable by 6 weeks for complex cases).
3. Lead SA must take the EDPB opinion into account in the final decision.
4. This step is not always triggered; many BCR approvals complete at the cooperation stage.

### Step 9: Formal Approval Decision (Weeks 56-72)

1. Lead SA issues the formal approval decision, potentially with conditions.
2. Review any conditions and implement required changes.
3. Confirm implementation of conditions in writing to the lead SA.
4. Receive the final unconditional approval.

## Post-Approval Implementation Workflow

### Step 10: Group-Wide Rollout (Weeks 72-80)

1. Execute the intra-group agreement with all bound entities.
2. Distribute the approved BCR to all entity-level DPOs or privacy officers.
3. Publish the BCR summary on the corporate website and the EDPB BCR register.
4. Update all privacy notices to reference the BCR as the transfer mechanism.
5. Update the transfer register to reflect BCR as the safeguard for covered transfers.

### Step 11: Training Deployment (Weeks 72-84)

1. Deploy mandatory BCR training to all employees with access to transferred data.
2. Deliver role-specific training to DPOs, IT administrators, HR staff, and customer service representatives.
3. Record training completion in the centralised learning management system.

### Step 12: Audit Programme Activation (Post-Rollout)

1. Develop the three-year rolling audit plan covering all bound entities.
2. Conduct the first BCR compliance audit within 12 months of approval.
3. Report audit findings to the BCR Lead management and, upon request, to the lead SA.
4. Track remediation of audit findings to closure.

## Change Management Workflow

1. **Entity changes**: When a new entity joins the group, update Annex A, execute the IGA accession, deploy training, and notify the lead SA.
2. **Transfer scope changes**: When new data categories or transfer purposes are added, update Annex B, conduct a purpose compatibility assessment, and notify the lead SA if the change is material.
3. **Security standard changes**: When minimum security standards are revised, update Annex C, communicate to all bound entities, and update the audit checklist.
4. **Legal environment changes**: When a third country enacts legislation adversely affecting BCR protections, assess impact, implement supplementary measures or suspend affected transfers, and notify the lead SA.