# Standards and Regulatory References — Group Structure RoPA

## Primary Legislation

### GDPR Articles on Group Processing

- **Art. 4(19) — Definition of "group of undertakings"**: A controlling undertaking and its controlled undertakings.
- **Art. 30(1)-(2)**: Records obligations apply to each controller and each processor individually. There is no group exemption.
- **Art. 26 — Joint controllers**: Where two or more controllers jointly determine the purposes and means of processing, they shall in a transparent manner determine their respective responsibilities by means of an arrangement between them.
- **Art. 28 — Processor**: Where processing is to be carried out on behalf of a controller, including within a corporate group where one entity processes on behalf of another.
- **Art. 47 — Binding Corporate Rules**: BCRs provide a transfer mechanism for intra-group transfers to third countries. The BCR application must include the structure of the corporate group and a list of members.
- **Art. 56 — Competence of the lead supervisory authority**: The SA of the main establishment has competence as lead SA for cross-border processing by a group of undertakings.
- **Recital 48**: References to legitimate interests of a controller include processing within a group of undertakings for internal administrative purposes, including processing of personal data of clients or employees. This does not create an automatic lawful basis but recognises that intra-group transfers may constitute a legitimate interest.

### GDPR Articles on Transfers

- **Art. 44-49 — Chapter V**: Intra-group transfers to entities outside the EEA are subject to the same transfer mechanism requirements as transfers to external third parties. Being part of the same corporate group does not exempt from Chapter V.

## Regulatory Guidance

### EDPB

- **EDPB Guidelines 07/2020 on controller and processor concepts (adopted 7 July 2021)**: Clarifies that within a corporate group, each entity must be assessed individually to determine whether it acts as controller, processor, or joint controller. The parent company is not automatically a controller for all subsidiaries' processing.
- **EDPB Guidelines 2/2018 on derogations of Article 49 (adopted 25 May 2018)**: Clarifies that intra-group transfers cannot routinely rely on Art. 49 derogations; systematic transfers require a Chapter V mechanism (SCCs, BCRs, or adequacy).
- **EDPB Recommendations 01/2020 on supplementary measures (adopted 18 June 2021)**: Applies equally to intra-group transfers; Transfer Impact Assessments are required for intra-group transfers relying on SCCs.
- **WP29 Guidelines on BCRs (WP256 rev.01, adopted 6 February 2018)**: Specifies the content requirements for BCR applications, including the corporate group structure, processing activities covered, and internal compliance mechanisms.

### National Supervisory Authorities

- **CNIL (France)**: The CNIL RoPA template accommodates multi-entity structures with fields for the responsible entity and joint controller identification per processing activity.
- **BfDI (Germany)**: Guidance on Art. 30 records for corporate groups (Konzern-Datenschutz) emphasises that each German entity must maintain its own records even if processing is coordinated at group level.
- **ICO (United Kingdom)**: Post-Brexit, the ICO's guidance on international transfers explicitly addresses intra-group transfers between UK and EEA entities, requiring UK GDPR Chapter V safeguards for transfers from UK to non-adequate countries.

## Enforcement Precedents

- **Hamburg DPA — H&M (2020)**: The EUR 35.3 million fine was imposed on the German entity H&M Hennes & Mauritz Online Shop A.B. & Co. KG, not on the parent company. This demonstrates that enforcement targets the specific entity responsible for the processing, reinforcing the need for entity-level RoPA.
- **CNIL — Google LLC (EUR 150 million, 2022)**: Fine for cookie consent violations was imposed on the specific entity operating the service in France, not on Alphabet Inc. Entity-level records are essential for demonstrating which entity is responsible for which processing.
- **Luxembourg DPA (CNPD) — Amazon Europe Core SARL (EUR 746 million, 2021)**: The fine was directed at the specific Luxembourg-established entity, not at Amazon.com Inc., underscoring that group-level compliance does not substitute for entity-level accountability.

## ISO/IEC Standards

- **ISO/IEC 27701:2019**: Section 5.2.1 requires the organisation to determine the scope of the PIMS, including which entities within a group are covered. Section 7.2.8 requires records per entity within scope.
- **ISO 27001:2022**: Clause 4.3 (Determining the scope of the ISMS) requires defining which organisational units are in scope, directly relevant to multi-entity group structure.