Defined in the law · GDPR Art. 4(20)
Binding corporate rules
In plain English
Internal data protection policies that a group of companies, or companies in a joint economic activity, follow so they can transfer personal data to their members outside the EU.
The definition in the law
‘binding corporate rules’ means personal data protection policies which are adhered to by a controller or processor established on the territory of a Member State for transfers or a set of transfers of personal data to a controller or processor in one or more third countries within a group of undertakings, or group of enterprises engaged in a joint economic activity
The competent supervisory authority shall approve binding corporate rules in accordance with the consistency mechanism set out in Article 63 …
1 decisions on Fino cite Article 47 GDPR. See them →
Related
The official text is quoted word for word from the English version of the source named under it; only the version published in the Official Journal of the EU is legally binding. The plain-English line is Fino’s own summary, not legal advice.