# Opinion 18/2025 on the draft decision of the Irish Supervisory Authority regarding the Processor Binding Corporate Rules of the Shopify Group - Type: Guidance - Source: EDPB - Identifier: edpb-opinion-202518-bcr-p-shopify-en - Date: 2025-09-11 - Original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-182025-on-the-draft-decision-of-the-irish-supervisory_en - Canonical: https://overview.legal/posts/51183 - Topics: Processors, Social Media, Controllers, International Transfer, Codes of Conduct, Personal Data, Processing, Supervisory Authorities, Supervision, Data Processor ## Summary Adopted Opinion 18 /2025 on the draft decision of the Irish Supervisory Authority regarding the Processor Binding Corporate Rules of the Shopify Group Adopted on 11 September 2025 2 Adopted 3 Adopted The European Data Protection Board Having regard to Article 63, Article 64(1)(f) and Article 47 of the Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement… ## Full text Adopted Opinion 18 /2025 on the draft decision of the Irish Supervisory Authority regarding the Processor Binding Corporate Rules of the Shopify Group Adopted on 11 September 2025 2 Adopted 3 Adopted The European Data Protection Board Having regard to Article 63, Article 64(1)(f) and Article 47 of the Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter “ GDPR ”), Having regard to the European Economic Are a ( hereinafter “ EEA ” ) Agreement and in particular to Annex XI and Protocol 37 thereof, as amended by the Decision of the EEA joint Committee No 154/2018 of 6 July 2018 1 , Having regard to the decision of the Court of Justice of the European Union Data Prote ction Commissioner v. Facebook Ireland Ltd and Maximillian Schrems , C - 311/18 of 16 July 2020, Having regard to EDPB Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data of 18 June 2021, Having regard to Article s 10 and 22 of its Rules of Procedure . Whereas: (1) The main role of the European Data Protection Board (hereinafter the “ EDPB ” ) is to ensure the consistent application of the GDPR throughout the EEA . To this effect, it follows from A rticle 64(1)(f) GDPR that the EDPB shall issue an opinion where a supervisory authority ( hereinafter “ SA ” ) aims to approve binding corporate rules ( hereinafter “ BCRs ” ) within the meaning of A rticle 47 GDPR. (2) The EDPB w elcomes and acknowledges the efforts the companies make to uphold the GDPR standards in a global environment. Building on the experience under Directive 95/46/EC , the EDPB affirms the important role of BCRs to frame international transfers and its commitme nt to support the companies in setting - up their BCRs. This opinion aims towards this objective and takes into account that the GDPR strengthened the level of protection, as reflected in the requirements of A rticle 47 GDPR , and conferred to the EDPB the tas k to issue an opinion on the competent SA ’s draft decision aiming to approve BCRs. This task of the EDPB aims to ensure the consistent application of the GDPR, including by the SAs , controllers , and processors. (3) Pursuant to Article 46(1) GDPR, in the absence of a decision pursuant to Article 45(3) GDPR , a controller or processor may transfer personal data to a third country or international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enfor ceable data subject rights and effective legal remedies for data subjects are available. A group of undertakings or group of enterprises engaged in a joint economic activity may provide such safeguards by the use of legally binding BCRs, which expressly co nfer enforceable rights on data subjects and fulfil a series of requirements ( A rticle 46 GDPR). The implementation and adoption of BCRs by a group of undertakings is intended to provide guarantees that apply uniformly in all third countries and, consequent ly, 1 References to “Member States” made throughout this opinion should be understood as references to “EEA Member States”. 4 Adopted independently of the level of protection guaranteed in each third country. The specific requirements listed in the GDPR are the minimum items BCRs shall specify ( A rticle 47(2) GDPR). The BCRs are subject to approval from the competent SA (hereinafter “ the BCR Lead ”) , in accordance with the consistency mechanism set out in A rticle 63 and Article 64(1)(f) GDPR, provided that the BCRs meet the conditions set out in Article 47 GDPR, together with the requirements set out in the relevant working documents of the Article 29 Working Party 2 , endorsed by the EDPB. (4) This opinion only covers the EDPB’s consideration that the BCRs submitted for the required opinion afford appropriate safeguards in that they meet all requirements of Article 47 GDPR and WP25 7 rev . 0 1 of the Article 29 Working Party, as endorsed by the EDPB 3 . Accordingly, this opinion and the SAs’ review do not address elements and obligations of the GDPR mentioned in the BCRs at issue other than those related to Article 47 GDPR. This also applies to any supplementary measures that an exporter subject to the GDPR may be required to adopt, depending on the circumstances of the transfer , in order to ensure compliance with the commitments taken in the BCRs. (5) The EDPB recalls that , in accordance with the judgment of the Court of Justice of the European Union C - 311/18 , it is the responsibility of the data exporter subject to the GDPR, if needed with the help of the data importer, to assess whether the level of protection required b y EU law is respected in the third country concerned, in order to determine if the guarantees provided by BCRs can be complied with in practice, taking into consideration the possible interference created by the third country legislation with the fundament al rights. If this is not the case, the data exporter subject to the GDPR, if needed with the help of the data importer, should assess whether they can provide supplementary measures to ensure an essentially equivalent level of protection as provided in th e EU. (6 ) The WP25 7 rev.01 of the Article 29 Working Party , as endorsed by the EDPB, provides for the required elements for BCRs for processors (hereinafter “ BCR - P ”) , including the Intra - Company Agreement where applicable, and the application form. The WP2 6 5 of the Article 29 Working Party 4 , as endorsed by the EDPB, provides for recommendations to the applicants to help them demonstrate how to meet the requirements of A rticle 47 GDPR and WP25 7 rev . 01. Additionally, the EDPB highlights tha t any documentation submitted may be subject to access to documents requests in accordance with the SAs’ national laws and with Regulation 1049/2001 5 , applicable to the EDPB pursuant to Article 76(2) GDPR . ( 7 ) Taking into account the specific characteristi cs of BCRs provided for by Article 47(1) and (2 ) GDPR , each application should be addressed individually and is without prejudice to the assessment of any other BCRs . The EDPB recalls that BCRs should be customised to take account of the structure of the 2 The Working Party on the Protection of Individuals with regard to the Processing of Personal Data instituted by Article 29 of Directive 95/46/EC. 3 Article 29 Working Party, Working Document setting up a table with the elements and principles to be found in Processor Binding Corporate Rules, as last revised and adopted on 6 February 2018, WP 25 7 rev.01. 4 Article 29 Working Party, Recommendations on the Standard Application for Approval of Processor Binding Corporate Rules for the Transfer of Personal Data, adopted on 11 April 2018, WP26 5 . 5 Regulation (EC) No 1049/2001 of the European Parliament and of th e Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents. 5 Adopted g roup of companies that they apply to, the processing they undertake , and the policies and procedures that they have in place to protect personal data 6 . (8 ) The opinion of the EDPB shall be adopted, pursuant to Article 64(3) GDPR in conjunction with Article 10(2) of the EDPB Rules of Procedure, within eight weeks after the Chair has decided that the file is complete. Upon decision of the EDPB Chair, this period may be extended by a further six weeks, taking into account the complexity of the subject m atter. HAS ADOPTED THE FOLLOWING OPINION: 1 SUMMARY OF THE FACTS 1. In accordance with the cooperation procedure as set out in WP263 rev.01, the draft BCR - P of Shopify International Limited and the g roup entities (hereinafter the “Shopify Group ”) was reviewed by the Irish SA as the BCR Lead. 2. The BCR Lead has submitted its draft decision regarding the draft BCR - P of the Shopify Group , requesting an opinion of the EDPB pursuant to Article 64(1)(f) GDPR on 3 July 2025 . The decision on the complete ness of the file was taken on 4 July 2025 . 2 ASSESSMENT 3. The draft BCR - P of the Shopify Group covers intra - group transfers among Shopify G roup entities legally bound by the BCR, when they act as processor s and sub - processors on behalf of controllers outside of the Group, with respect of personal data originally subject to the GDPR 7 . 4. Concerned data subjects include customers of the controller and any personal data shared with Shopify Group by the controller 8 . 5. The draft BCR - P of the Shopify Group has been scrut inised according to the procedures set up by the EDPB. The SAs assembled within the EDPB have concluded that the draft BCR - P of the Shopify Group contains all the elements required under Article 47 GDPR and WP257 rev.01, in accordance with the draft decisi on of the BCR Lead submitted to the EDPB for an opinion. Therefore, the EDPB does not have any concerns that need to be addressed. 3 CONCLUSIONS 6. Taking into account the above and the commitments that the group members will undertake by signing the Shopify G roup ’s Intra - Group Agreement, the EDPB considers that the draft decision of the BCR Lead may be adopted as it is , since the draft BCR - P of the Shopify Group contains appropriate safeguards to ensure that the level of protection of natural persons guarantee d by the GDPR is not undermined when personal data is transferred to and processed by the group members based in third 6 This view was expressed by the Article 29 Working party in Working Document Setting up a framework for the structure of Binding Corporate Rules, ad opted on 24 June 2008, WP154. 7 Specified in the BCR Part 1 and Part V Appendix 1 . 8 Specified in the BCR Part 1 and Part V Appendix 12. 6 Adopted countries. The EDPB recalls that the approval of BCRs by the BCR Lead does not entail the approval of specific transfers of personal data to be carried out on the basis of the BCRs. Accordingly, the approval of BCRs may not be construed as the approval of transfers to third countries included in the BCRs for which an essentially equivalent level of protection to that guaranteed within the E U cannot be ensured. 7. Finally, the EDPB also recalls the provisions contained within Article 47(2)(k ) GDPR and WP25 7 rev . 01 providing the conditions under which the applicant may modify or update the BCRs, includi ng updates to the list of BCRs g roup m embers. 4 FINAL REMARKS 8. This opinion is addressed to the BCR Lead and will be made public pursuant to A rticle 64(5 )( b) GDPR. 9. According to Article 64 (7) and (8) GDPR, the BCR Lead shall communicate its response to this opinion to the Chair within two weeks af ter receiving the opinion . 10. Pursuant to A rticle 70(1)(y) GDPR, the BCR Lead shall communicate the final decision to the EDPB for inclusion in the register of decisions which have been subject to the consistency mechanism. For the European Data Protection Board The Chair ( Anu Talus ) ## Cited law provisions (12) ### GDPR — gdpr-art-45-par-3-en The Commission, after assessing the adequacy of the level of protection, may decide, by means of implementing act, that a third country, a territory or one or more specified sectors within a third country, or an international organisation ensures an adequate level of protection within the meaning of paragraph 2 of this Article. The implementing act shall provide for a mechanism for a periodic review, at least every four years, which shall take into account all relevant developments in the third country or international organisation. The implementing act shall specify its territorial and sectoral application and, where applicable, identify the supervisory authority or authorities referred to in point (b) of paragraph 2 of this Article. The implementing act shall be adopted in accordance with the examination procedure referred to in Article 93(2). ### GDPR — gdpr-art-46-par-1-en In the absence of a decision pursuant to Article 45(3), a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available. ### GDPR — gdpr-art-47-par-1-en The competent supervisory authority shall approve binding corporate rules in accordance with the consistency mechanism set out in Article 63, provided that they: ### GDPR — gdpr-art-47-par-2-en The binding corporate rules referred to in paragraph 1 shall specify at least: ### GDPR — gdpr-art-64-par-1-pnt-f-en aims to approve binding corporate rules within the meaning of Article 47. ### GDPR — gdpr-art-64-par-3-en In the cases referred to in paragraphs 1 and 2, the Board shall issue an opinion on the matter submitted to it provided that it has not already issued an opinion on the same matter. That opinion shall be adopted within eight weeks by simple majority of the members of the Board. That period may be extended by a further six weeks, taking into account the complexity of the subject matter. Regarding the draft decision referred to in paragraph 1 circulated to the members of the Board in accordance with paragraph 5, a member which has not objected within a reasonable period indicated by the Chair, shall be deemed to be in agreement with the draft decision. ### GDPR — gdpr-art-76-par-2-en Access to documents submitted to members of the Board, experts and representatives of third parties shall be governed by Regulation (EC) No 1049/2001 of the European Parliament and of the Council (21). ### GDPR — gdpr-art-10-en Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority. ### GDPR — gdpr-art-29-en The processor and any person acting under the authority of the controller or of the processor, who has access to personal data, shall not process those data except on instructions from the controller, unless required to do so by Union or Member State law. ### GDPR — gdpr-art-47-en Binding corporate rules ### GDPR — gdpr-art-63-en In order to contribute to the consistent application of this Regulation throughout the Union, the supervisory authorities shall cooperate with each other and, where relevant, with the Commission, through the consistency mechanism as set out in this Section. ### GDPR — gdpr-art-64-en Opinion of the Board --- Generated by overview.legal · https://overview.legal/posts/51183 · 2026-08-22