# EDPB Document Setting Forth a Co-Operation procedure for the approval of Binding Corporate Rules for controllers and processors

- Type: Guidance
- Source: EDPB
- Identifier: edpb-document-procedure-approval-bcr-en-0
- Date: 2025-03-19
- Original: https://www.edpb.europa.eu/documents/procedure/edpb-document-setting-forth-a-co-operation-procedure-for-the-approval-of_en
- Canonical: https://overview.legal/posts/50655
- Topics: Supervisory Authorities, International Transfer, Codes of Conduct, Controllers, Supervision, Territorial scope (GDPR), Processors, Processing, Public Sector, Consent

## Summary

EDPB, EDPB Document Setting Forth a Co-Operation procedure for the approval of Binding Corporate Rules for controllers and processors, 2025.

## Full text

1 EDPB Document Setting Forth a Co - Operation procedure for the approval of Binding Corporate Rules for controllers and processors Adopted on 13 March 2025 2 Contents 1. Preface ................................ ................................ ................................ ................................ .............. 3 2. Introduction ................................ ................................ ................................ ................................ ...... 3 3. Identification of the BCR Lead Supervisory Authority ................................ ................................ ..... 4 4. Approval procedure for BCR ................................ ................................ ................................ ............ 5 4.1. BCR Lead review phase ................................ ................................ ................................ ............ 5 4.2 Co - review phase ................................ ................................ ................................ ............................. 5 4.3 Cooperation phase ................................ ................................ ................................ ......................... 5 4.4 BCR session ................................ ................................ ................................ ................................ ..... 6 4.5 EDPB Opinion phase ................................ ................................ ................................ ....................... 6 4.6 Approval procedure by BCR Lead ................................ ................................ ................................ ... 6 ANNEX 1 – BCR approval procedure ................................ ................................ ................................ ......... 8 Figure 1: BCR approval procedure ................................ ................................ ................................ ........ 9 What is considered to be a “round” during different phases of the BCR approval procedure? ....... 10 What is the role of the BCR Lead during different phases of the BCR approval procedure? ............ 11 ANNEX 2 – Procedure for informal “BCR sessions” ................................ ................................ ............... 12 1. INTRODUCTION ................................ ................................ ................................ .............................. 13 2. PROCEDURE FOR BCR SESSIONS ................................ ................................ ................................ ..... 13 3. NATURE OF THE BCR SESSIONS ................................ ................................ ................................ ...... 14 4. AGREEMENTS DURING THE BCR SESSIONS ................................ ................................ .................... 15 5. PERIODICITY OF THE BCR SESSIONS ................................ ................................ ............................... 15 6. ROLE OF THE EDPB SECRETARIAT ................................ ................................ ................................ .. 16 7. AFTER THE BCR SESSION ................................ ................................ ................................ ................ 16 3 1. Preface 1. On 14 April 2005 the Article 29 Working Party adopted the Working Document Setting Forth a Cooperation Procedure for Issuing Common Opinions on Adequate Safeguards, WP 107. 1 This document was updated by the Article 29 Working Party Document Setting Forth a procedure for the approval of “Binding Corporate Rules” for controllers and processors under Regulation 2016/679, which was adopted on 11 April 2018 and endorsed by the European Data Protection Board (hereinafter “EDPB”), WP 263rev.01. 2 2. Having regard to the WP263rev.01, the EDPB has adopted this document which is an updated version of the aforementioned Working Party 29 document. Any reference to the WP 263rev.01 document should from now on be interpreted as a reference to this EDPB docum ent Setting Forth a procedure for the approval of “Binding Corporate Rules” for controllers and processors. 3. The aim of this document is to update the WP263rev.01 based on the practical experience gained through its application, and identify smooth and effective cooperat ion procedures in line with Regulation (EU) 2016/679 (hereinafter, “GDPR”) whilst taking full advantage of the previous fruitful experience of the Supervisory Authorities in dealing with the approval of BCR . 3 2. Introduction 4. The procedure for approving Binding Corporate Rules ( hereinafter, “ BCR ” ) for controllers and processors is laid out by prov isions contained in Articles 47( 1 ) , 63, 64 and (only if necessary) 65 GDPR. 5. As a result, BCR are to be approved by the competent supervisory authority 4 in the relevant jurisdiction in accordance with the consistency mechanism set out in Article 63, under which the EDPB will issue a non - binding opinion on the draft decision submitted by the competent Supervisory Authority (Article 64 GDPR). 6. As the group applying for approval of its BCR may have entities in more than one Member State, this procedure will involve all the concerned Supervisory Authorities ( hereinafter, “ SAs ” ) , 5 e.g. in those countries from where the transfers are to take place. However, the GDPR does not lay down specific rules for the cooperation phase which should take place among the concerned SAs in advance of referral to the EDPB. It also does not set out s pecific rules for identifying the competent SA – which 1 Article 29 Data Protection Working Party, “Working Document Setting Forth a Co - Operation Procedure for Issuing Common Opinions on Adequate Safeguards Resulting From “Binding Corporate Rules” , adopted 14 April 2005. 2 Article 29 Data Protection Working Party, Working Document Setting Forth a Co - Operation Procedure for the approval of “Binding Corporate Rules” for controllers and processors under the GDPR ”, adopted 11 April 2018. 3 See, for example, Section 4.4 and Annex II. 4 Article 57(1)( s ) GDPR states that “without prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory […] approve binding corporate rules pursuant to Article 47” and Article 58.3.j GDPR according to which each supervisory aut hority shall have the “authorisation and advisory powers […] to approve binding corporate rules pursuant to Article 47”. 5 Pursuant to Article 4(22)(a) and (b), a “supervisory authority concerned” means a supervisory authority which is concerned by the processing of personal data because the controller or processor is established on the territory of the Member State of that supervisory authority or because “data subjects residing in the Member Stat e of that supervisory authority are substantially affected or likely to be substantially affected by the processing”. As for the BCR approval procedure, the concerned SAs are all SAs, considering that approved BCR may be used in all M ember S tates without any additional authorisation. 4 will act as Lead Authority for the BCR (“BCR Lead” ) . 6 The role of such BCR Lead includes acting as a single point of contact with the applicant organization or group during the approval process and managing the application procedure in its cooperation phase. 3. Identification of the BCR Lead Supervisory Authority 7. A group of undertakings, or group of enterprises engaged in a joint economic activity (“Group” ), interested in submitting draft binding corporate rules for the approval of the competent Authority according to Articles 47, 63 and 64 GDPR should propose a SA as the BCR Lead. The decision as to which SA should act as BCR Lead is based upon the criteri a contained in this document (see next paragraph). It is for the organisation to justify the reasons why a given SA should be considered as the BCR Lead. 8. An applicant Group should justify the proposal of the BCR Lead on the basis of relevant criteria such as: a. the location(s) of the Group’s European headquarters; b. the location of the company within the Group with delegated data protection responsibilities ; 7 c. the location of the company which is best placed (in terms of management function, administrative burden, etc.) to deal with the application and to enforce the binding corporate rules in the Group; d. the place where most decisions in terms of the purposes and the means of the processing (i.e. transfer) are taken; and e. the member state within the EU from which most or all transfers outside the EEA will take place. 9. Particular attention will be given to factor described under paragraph 8 (a) above. 10. These are not formal criteria. The SA to which the application is sent (as prospective BCR Lead SA) will exercise its discretion in deciding whether it is in fact the most appropriate lead SA and, in any event, the SAs among themselves may decide to allocate the application to a SA other than the one to which the Group applied (see next paragraph), in particular if it would be possible and worth for speeding up the procedure (e.g. taking into account the workload of the originally requested SA). 11. The applicant should also provide the proposed BCR Lead (the entry point) with all appropriate information which justifies its proposal, inter alia , the nature and general structure of the processing activities in the EU with particular attention to the place/s where decisions are made, the location and 6 The “BCR Lead” is generally distinct from the “OSS Lead” considering that BCR transfers will not as a rule meet the definition/criteria of a cross - border processing operation. However, there could be cases in which the same SA could be the BCR Lead and th e OSS Lead. This might e.g. be the case if a transfer performed by one establishment substantially affects data subjects in more than one MS (i.e. if personal data are first sent from member states A, B and C to the controller’s establishment in member sta te A, and subsequently transferred by this establishment in A to a third country or, in case of BCR - P, where the processor carries out the same transfers for all their clients in the different member states). In any case, the BCR approval procedure would b e the specific one settled by Article 64 GDPR. 7 According to Article 47(2)( f ) GDPR, there should always be an EU based member of the group established on the territory of a Member State accepting liability for any breaches of the binding corporate rules by any member concerned not established in the Union. If the headquarters of th e group is somewhere else, the headquarters should delegate these responsibilities to a member based in the EU. 5 nature of affiliates in the EU, the number of employees or persons concerned, the means and purposes of the processing, the places from where the transfers to third countries do take place and the third countries to which those data are transferred. 4. Approval procedure for BCR 4.1. BCR Lead review phase 12. The proposed BCR Lead will forward the information received as to why that SA has been selected by the company to be the lead authority for the BCR to all SAs 8 with an indication of whether or not it agrees to be the BCR Lead. If the entry point agrees to be the lead authority, the other SAs will be asked, under Article 57(1)( g ) GDPR, to raise any objections within two weeks (period extendable to two additional weeks if requested by any SA). Silence is deemed as consent. In the event that the entry point is of the view that it should not act as the BCR Lead, it should explain the reasons for its decision as well as its recommendations (if any) as to which other SA would be the appropriate lead authority. The SAs will endeavour to reach a decision within one month from the date that the papers w ere first circulated. 13. Once a decision on the BCR Lead has been made, the latter will start the discussions with the applicant and review the draft BCR documents. 4.2 Co - review phase 14. In order to foster a more consistent approach, i t will send, under Article 57(1)( g ) GDPR, a first revised draft of the BCR and the related documents to one or two SAs (depending on the number of Member States from whose territories the transfers will take place) 9 which will act as co - reviewers and will help the BCR Lead in the assessment. 15. In case there is no response from a SA acting as co - reviewer within one month from the date the draft and the related documents were sent to it (deadline extendable under justified circumstances), that SA will be deemed to have agreed with them. There may need to be several different drafts or exchanges, i.e. rounds 10 between the applicant and the relevant SAs before a satisfactory draft is produced. 4.3 Cooperation phase 15. The result of these discussions should be a “consolidated draft” sent by the applicant to the BCR Lead which will circulate it among all SAs (via the EDPB S ecretariat), under Article 57(1)( g ) GDPR for comments. According to this procedure, the period for comments on the consolidated draft will not exceed one month. An SA which has not presented a reasoned objection within this period shall be deemed to be in agreement with the consolidated draf t. 16. The BCR Lead will send any further comments on the “consolidated draft” to the applicant and may resume discussions, if necessary. 8 See above , footnote 6 . 9 As a rule, the BCR Lead will consult 2 co - reviewers whenever from 14 Member States or more transfers take place. Under this threshold it is possible to have one or two co - reviewers depending on the specific case and the availability of SAs. 10 See Annex 1 for a clarification of the term “round”. 6 4.4 BCR session 17. If necessary, the BCR Lead can initiate a “BCR Session” 11 at any stage of the BCR approval procedure, to discuss with all partic ipants (i.e., SAs and the EDPB S ecretariat) controversial or remaining issues raised during the assessment of the BCR and come to an agreement, and if necessary consolidate the comments received . 18. When the BCR Lead is of the view that the applicant is in a position to address satisfactorily all comments received, it will invite the applicant to send a “final draft” to it. 4.5 EDPB Opinion phase 19. Pursuant to Article 64.1 and 64.4 GDPR, the BCR Lead will submit the dra ft decision to the EDPB on the “final draft” of the BCR along with all relevant information, documentation and the views of the SAs. 12 The EDPB will adopt an Opinion on the matte r in accordance with Article 64( 3 ) GDPR and its Rules of Procedure will apply. 4.6 Approval procedure by BCR Lead 20. Where the Opinion handed down by the EDPB under Article 64.3 endorses the draft decision on the draft BCR in the form submitted, the BCR Lead will adopt its decision approving the draft BCR. 21. Where the opinion handed down by the EDPB according to Article 64.3 requires any amendment to the draft BCR, the BCR Lead will communicate to the Chair of the Board within the two - week period set out in Article 64.7 whether it intends to maintain its draft decision (i.e. not to follow the Opinion of the EDPB) or whether it intends to amend it in accordance with the EDPB Opinion . 13 In the first case, pursuant to Article 64.8 GDPR, Article 65.1 GDPR shall apply . 14 22. If the BCR Lead communicates to the Chair of the Board that it intends to amend its draft decision in accordance with the EDPB Opinion, the BCR Lead will contact the applicant immediately in order to request the amendments to the draft BCR to be made in ac cordance with the EDPB Opinion so that the draft BCR can be finalized. When the draft BCR have been finalized in accordance with the EDPB Opinion, the BCR Lead will amend its initial draft decision accordingly, notify the EDPB pursuant Article 64.7 of its amended decision and approve the BCR. 11 The general aim is to speak with one voice to the applicant. To this end, the “BCR sessions” addresses controversial or remaining issues that were not solved during the assessment of the BCR, in order to work out consensus of what to demand from the appli cants. In short, the aim of the sessions is to discuss and find consensus on the standards and expectations for the BCR. See Annex 2 for the procedure regarding the “BCR sessions”. 12 Prior to submitting a ‘final draft’ of the BCR, the BCR Lead initiates finding co - rapporteurs to be part of the drafting team, together with the EDPB secretariat. The drafting team shall consist out of: 1) EDPB Secretariat, 2) an SA that acted as co - reviewer, 3) a neutral SA (a supervisory authority that did not partake in the co - review phase). The BCR Lead will participate in the drafting team to provide clarification and or additional information, where necessary. 13 According to Article 64( 5 ) , the Chair of the Board will, without undue delay, inform by electronic means the members of the Board and the Commission of this information. 14 In particular , in accordance with Article 65(1)(c) “in order to ensure the correct and consistent application of this Regulation in individual cases, the Board shall adopt a binding decision in the following cases: […] (c) where a competent supervisory authority […] does not follow the opinion of the Boar d issued under Article 64. In that case, any supervisory authority concerned or the Commission may commun icate the matter to the Board”. 7 23. Once the BCR Lead approves the BCR, it will inform other SAs and make the BCR available . In accordance with Article 46(2)( b ) GDPR, the approved BCR will provide for the appropriate safegua rds referred to in paragraph 46( 1 ) without requiring any specific authorisation from other supervisory authorities . 15 24. Translations: as a general rule and without prejudice to other translations where necessary or required by law, all documents including the consolidated draft of the BCR should be provided by the applicant in the language of the BCR Lead and also in Englis h when possible in accordance with national law. The final draft and the approved BCR must be translated by the applicant into the languages of those SAs from which the transfers take place . 16 25. Once the BCR have been approved, the BCR Lead will inform the SAs of any updates to the BCR. 15 This also applies to the situation where the Group extends the scope of the BCR to an additional EU member state e.g. establishment of a new BCR member in this EU member state. 16 See also on this Recommendation 1/2022, Section 1.7., and WP 257, Section 1.3., according to which the data subject must have easy access to the BCR. 8 ANNEX 1 – BCR approval procedure The objective of this annex is to clarify the BCR approval procedure in a simplified and easy - to - read format. Together with Figure 1 portraying the BCR approval procedure, a clarification is given about what is considered to be a “round” and what the role of the BCR Lead is regarding the BCR approval procedure. Figure 1: BCR approval procedure 10 What is considered to be a “round” during different phases of the BCR approval procedure? 1. The round starts with the BCR Lead sending the BCR to the applicant to address the comments that the BCR Lead and, where this is the case, relevant SAs 17 have on the BCR. The applicant addresses these comments and sends it back to the BCR Lead. In the BCR Lead review phase, the BCR Lead reviews whether the comments have been addressed appropriately by the applicant. This also marks the end of this round. If the BCR Lead finds that the comments have not been appropriately addressed then a new round is triggered by sending the BCR back to the applicant with the request to amend the BCR according to the last comments. This continues until the BCR Lead is satisfied with the BCR which is the preliminary draft BCR. The BCR Lead sends the draft BCR to the co - reviewers thus triggering th e co - review phase. After the BCR Lead receives the comments from the co - reviewers, the BCR Lead will send the BCR with comments to the applicant triggering the first round of the co - review phase. 2. In the co - review and cooperation phase the round starts when the BCR Lead sends out the BCR with the comments of the relevant SAs to th e applicant and the applicant addresses the comments. The applicant sends back the updated BCR to the BCR Lead and the BCR Lead sends this to the relevant SAs. The relevant SAs review whether their comments have been addressed appropriately by the applicant. This also marks the end of this round. If the relevant SAs find that their comments have not been addressed appropriat ely by the applicant then supporting comments are made and send to the BCR Lead. A new round starts when the BCR Lead sends the BCR with the new comments made by the relevant SAs to the applicant. This continues until the relevant SAs find that their comments have been addressed appropriately and the BCR Lead is satisfied with the preliminary draft BCR. 3. In particular for the cooperation phase: when necessary, between the third and the fourth round of the BCR approval procedure , the BCR Lead, together with the relevant SAs, identify any controversial issue(s) 18 or remaining issue(s) which need to be discussed in a BCR session. The results of the BCR session will be sent to the applicant by the BCR Lead, which will trigger the fourth “round” meaning that the applicant shall address the agreed upon solutions 19 . When the BCR Lead receives the BCR draft back it shall check whether all provided solutions have been addressed in full. The BCR Lead shall inform the SAs of the addressed points and provide the new preliminary BCR draft for the assessment by all SAs. If not all the controversial or remaining issues have been addressed, then a new BCR session, if needed, shall address those issues. This means that the fourth and (if necessary) fifth “round” wi ll be carried out mainly in a format of a BCR session and will be an opportu nity for the applicant to address the remaining and/ or controversial issues accordingly. 4. Any clarifications on the already provided comments by the BCR Lead and/or relevant SAs to the applicant and/or typos that ne ed to be amended in the BCR, do not trigger a new round. 17 In the co - review phase the relevant SAs are addressed as “co - reviewers” and in the cooperation phase the relevant SAs are the SAs that are assessing the BCR. 18 Controversial issues are to be understood as issues related to the assessment between the BCR Lead and the relevant SA(s) or between the applicant and the BCR Lead and/or relevant SAs. 19 See for more on the BCR Session in Annex 2. 11 What is the role of the BCR Lead during different phases of the BCR approval procedure? The BCR Lead: 1. Provides information to the applicant regarding the transfer instrument BCR and assesses whether a BCR is the suitable instrument to frame the transfers of the applicant and advises the applicant regarding this matter; 2. Explains the BCR approval procedure to the applicant and provides transparency regarding the number of rounds and deadlines f or the round(s); 3. Is the contact point for the applicant, co - reviewers, BCR session participants, ITS members (for the scope of the BCR), the EDPB Secretariat, and if necessary, in the plenary regarding the BCR; 4. Starts and ends the BCR Lead review phase; 5. Launches the co - review and cooperation phase by sending the preliminary draft BCR; 6. Starts a round in the co - review phase and cooperation phase; 7. Ends the co - review and cooperation phase (in consultation with the co - reviewers); 8. May launch, if necessary, a BCR session during the BCR Lead review phase and the co - review phase, and when at the end of the third round in the cooperation phase not all controversial or remaining issues have been resolved; 9. In case a BCR session is needed , will follow the BCR session procedure as set forth in Annex 2 and will provide all necessary documents for the approval of the BCR to the EDPB Secretariat while keeping in mind the window of submissions for the EDPB plenary. 12 ANNEX 2 – Procedure for informal “BCR sessions” The objective of this annex is to provide information on the BCR sessions procedure as described in Section 4 .4 above and Annex 1. 13 1 . INTRODUCTION 1. The aim of the informal procedure below is to develop the procedural aspects of the approval proce ss for BCR and determine the best forum to have discussions regarding controversial issues 20 or remaining issues regarding the BCR which have not yet been submitted to the EDPB for an Opinion. In accordance with Article 70(1)(u) GDPR, the Board shall promote the cooperation and the effective bilateral and multilateral exchange of information and best practices b etween supervisory authorities . To this effect, the present procedure aims at facilitating such cooperation between SAs by envisaging the organization of BCR Sessions before the formal procedure is triggered under Article 64 GDPR. 2. In particular the informal procedure is carried out on the basis of WP 263rev.01 on the approval procedure of Binding Corporate Rules for controllers and processors, and BCR are assessed in accordance with Recommendations 1/2022 on the application for appr oval and on the elements and principles to be found in Controller Binding Corporate Rules or WP 265 Recommendation on the approval of the Processor Binding Corporate Rules. 2 . PROCEDURE FOR BCR SESSIONS 3. As stated in Article 46(1)(2)(b) and Article 47 GDPR, the use of BCR shall be encouraged by the SAs and the Board. The time needed to reach a positive Opinion for the BCR that are satisfactory for the SAs involved and for the Board, may be deterrent for so me applicants. At the same time, consistency must be observed when assessing and approving BCR. To this end, discussions among the SAs on controversial or remaining issues are necessary. 4. Therefore, the objectives of the sessions should be clear. Determining the aim of the sessions is important not only to frame the discussions but also with regard to the communication with the BCR applicant. 5. The general aim is to speak with one voice to the applicant. To this end the BCR sessions shall address controversial or remaining issues before the article 64 procedure is triggered 21 in order to work out consensus of what to demand from the applicants. In short, the aim of the sessions is to discuss and find consensus on the standards and expectations for the BCR. 6. Due to this and the impact that the discussions and agreements reached may have for future BCR, all SAs shall take part in the BCR sessions. 22 For more details regarding the agreements reached at the sessions, see section 4 below. 20 Controversial issues are to be understood as issues related to the assessment between the BCR Lead and the relevant SA(s) or between the applicant and the BCR Lead and/or relevant SAs. 21 See for more information on the BCR approval procedure in WP 263, in par ticular section 2, available at: https://ec.europa.eu/newsroom/article29/items/623056 . 22 In light of the cooperation duty set forth in Article 57(1)(g) GDPR, all SAs shall partake in the BCR sessions. 14 3 . NATURE OF THE BCR SESSIONS 7. The BCR sessions are part of the “phases” 23 of the BCR approval procedure and intend to address, before submitting the BCR for an Opinion of the Board, any controversial or remaining issues that may arise during the informal procedure for the approval. 8. Organizing a BCR session is not mandatory but highly recommended, in order to expedite the approval procedure of the BCR. Furthermore, it is a best practice to put the BCR up for discussion at a session, where necessary, in order to facilitate the smooth a doption of the Opinion by the Board. 9. In this spirit, the BCR Lead should provide, in the relevant context and evolution of the BCR, the identified issues for discussion in the BCR session. 10. The BCR sessions do not take place as an expert subgroup meeting of the EDPB. 11. This entails the following: 12. The BCR Lead is responsible to liaise with the ITS ESG coordinators and the EDPB Secretariat without undue delay in order to request that the SAs are informed of the BCR session and provide them with the necessary information (i.e. contentious main elements for discussion), including the appropriate timing for the BCR session. If needed, and suitable from an organiz ational point of view, it would be possible to have one BCR session to discuss multiple BCRs. 13. The BCR session will be coordinated by the BCR Lead(s) in order to streamline the discussion(s) to facilitate reaching a consensus. 24 14. The BCR Lead shall: a Share, in accordance with section 5, before the BCR session , the updated version of the BCR that addresses the comments received; and b The list of identified issues including the comments of the SAs on these issues for which discussion is needed. c Present during the BCR session: the BCR(s) , the identified (controversial ) issue(s) or remaining issues and the latest comments of SAs on these issues. 15. Each BCR Lead is responsible to keep track of the comments and discussions regarding to the BCR presented by the BCR Lead. 16. Comments, clarifications and/or any agreements reached in the BCR session, will be shared by the BCR Lead with all SAs and the EDPB Secretariat, see for more in section 4 below. 17. The BCR session(s) participants shall be staff members of the SAs. The EDPB Secretariat will also take part in the meetings, see for more on the role of the EDPB Secretariat in section 6. 23 The BCR approval procedure c onsists out of different phases : the BCR Lead review phase, the co - review phase, the cooperation phase and the EDPB Opinion phase. After a positive Opinion is given by the Board the BCR Lead can take a decision of approval regarding the submitted BCR, see in this regard WP 263rev.01, se ction 2. 24 The BCR Lead shall aim to reach a consensus during the BCR session on controversial or remaining is sues. See for more: section 4 below . 15 4 . AGREEMENTS DURING THE BCR SESSIONS 18. The BCR Lead will share the comments, clarifications and/or any agreements reached in the BCR session without undue delay with the ITS ESG members. All SAs shall take this information into account and raise at the latest five (5) workdays after the results have been shared by the BCR Lead , objections regarding the material content of the agreements reached during the BCR session. 19. If no objections have been made within the aforementioned period, the BCR Lead shall send , without undue delay, the agreed upon comments and/or clarifications to the applicant. 25 20. In case an agreement cannot be reached during the BCR session on (some) controversial issues or there are still remaining issues, the relevant aspect shall then be discussed at an ITS ESG meeting. 26 21. At the ITS ESG meeting, the ITS ESG members will discuss the unsolved (controversial or remaining) issues and will decide upon a suitable solution by a majority of votes. When an agreement involves elements that have a substantial impact on the assessment of the future BCRs, the ITS ESG may decide, after discussion at the ESG level, to bring the matter to the Plenary, for guidance. Additionally, from the discussions during the BCR sessions it might be necessary to find agreements regarding substantial eleme nts of the BCR. In those cases, the specific questions may be brought for discussion at the ITS ESG and, ultimately and if necessary, to the Plenary for a decision. 27 22. The BCR Lead shall send, without undue delay , the agreed upon comments and/ or clarifications based on the outcome of the ITS ESG or Plenary level discussion to the applicant. 5 . PERIODICITY OF THE BCR SESSIONS 23. The periodicity of the sessions depends on the BCR(s) that are ready for discussion. 24. The BCR Lead shall liaise with the coordinators of the ITS ESG and/or with the EDPB Secretariat to find a suitable time for the session. The notification of the time and place for the session are sent to all SAs as soon as possible and at least 14 days before the session . 25. The BCR Lead shall provide the relevant information as soon as possible, preferably together with the aforementioned notification, but at the latest ten (10) workdays prior to the BCR session . 28 The relevant information for the BCR session will be provided to all SAs. 25 It is advised that the results reached in the BCR session include specific wording which can be then forwarded by the BCR Lead to the applicant without a redraft. The solutions will be shared with all SAs and forwarded to the applicant by the BCR Lead. Th e BCR Lead will mention to the applicant that the solutions are the result of the discussions with all SAs and shall, if necessary, discuss with the applicant, the possible consequences if the solutions are not implemented into the BCR. 26 The scope of the discussion in the ITS ESG shall only pertain to the disagreement of the aspect/ objections raised. The BCR Lead shall request time on the ITS ESG agenda to present the BCR issue and provide possible solutions. SAs shall discuss in order to reach a suitable solution. If there is no ITS ESG planned within a week after the deadline , the BCR Lead will contact the ITS ESG coordinators and EDPB Secretariat to discuss the appropriate next steps in order to be able to address the objection(s) raised by the relevant SA(s). If no solution is found, the issue shall, if necessary, and in acc ordance with paragraph 21, be brought before the plenary. 27 BCR Lead will discuss with the EDPB Secretariat whether the EDPB Secretariat or the BCR Lead, solely or together with the EDPB Secretariat, will present the discussion points during the plenary. This may differ on a case by case basis. 28 The BCR Lead shall endeavour to provide the necessary i nformation for the BCR session to all SAs, as soon as possible, and preferably with the notification. See section 3, para. 14 above. 16 26. The number of sessions devoted to a BCR will depend on the discussion(s) and the possible need to address remaining issues. 6 . ROLE OF THE EDPB SECRETARIAT 27. The BCR session does not take place as an expert subgroup meeting of the EDPB. This being said, for practical reasons: - The EDPB Secretariat facilitates the BCR session by providing the logistical support (e.g. meeting room, shared platform, etc); - The EDPB Secretariat ensures that the agenda for the BCR session is available in time and that the participants receive the BCR draft (including the identified controversial or remaining issues and, if relevant to the phase, the comments of the reviewing S As) that will be discussed during the BCR session; and - When the BCR Lead circulates the draft BCR including identified controversial or remaining issues (incl. comments of the co - reviewers), the Secretariat will be able to send comments, which can be taken on board by any SA. Likewise, the Secretariat will be able to participate in the BCR session. The aim is to advance any possible comment that may arise at a later stage, once the formal procedure has been triggered. The involvement of the EDPB Secretariat should be as early as possible in order to facilitate the assessment and to achieve a speedy BCR approval procedure. 7 . AFTER THE BCR SESSION 28. If changes to the BCR are necessary, the BCR Lead will get back to the applicant requesting the changes which are agreed upon during the BCR session, ITS ESG or Plenary. 29. Once the changes are made, the BCR Lead circulates without undue delay the new version of the BCR in track changes. When the BCR Lead and the relevant SAs, in the particular phase, agree that the issues that were raised are appropriately addressed by the applicant then the approval procedure will move onto the next round or phase of the BCR approval procedure.

## Cited law provisions (14)

### GDPR — gdpr-art-4-par-22-pnt-a-en

the controller or processor is established on the territory of the Member State of that supervisory authority;

### GDPR — gdpr-art-46-par-1-en

In the absence of a decision pursuant to Article 45(3), a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.

### GDPR — gdpr-art-46-par-2-en

The appropriate safeguards referred to in paragraph 1 may be provided for, without requiring any specific authorisation from a supervisory authority, by:

### GDPR — gdpr-art-47-par-2-en

The binding corporate rules referred to in paragraph 1 shall specify at least:

### GDPR — gdpr-art-57-par-1-en

Without prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory:

### GDPR — gdpr-art-57-par-1-pnt-g-en

cooperate with, including sharing information and provide mutual assistance to, other supervisory authorities with a view to ensuring the consistency of application and enforcement of this Regulation;

### GDPR — gdpr-art-65-par-1-pnt-c-en

where a competent supervisory authority does not request the opinion of the Board in the cases referred to in Article 64(1), or does not follow the opinion of the Board issued under Article 64. In that case, any supervisory authority concerned or the Commission may communicate the matter to the Board.

### GDPR — gdpr-art-70-par-1-pnt-u-en

promote the cooperation and the effective bilateral and multilateral exchange of information and best practices between the supervisory authorities;

### GDPR — gdpr-art-29-en

The processor and any person acting under the authority of the controller or of the processor, who has access to personal data, shall not process those data except on instructions from the controller, unless required to do so by Union or Member State law.

### GDPR — gdpr-art-47-en

Binding corporate rules

### GDPR — gdpr-art-58-en

Powers

### GDPR — gdpr-art-63-en

In order to contribute to the consistent application of this Regulation throughout the Union, the supervisory authorities shall cooperate with each other and, where relevant, with the Commission, through the consistency mechanism as set out in this Section.

### GDPR — gdpr-art-64-en

Opinion of the Board

### GDPR — gdpr-art-65-en

Dispute resolution by the Board

---
Generated by overview.legal · https://overview.legal/posts/50655 · 2026-08-22