This page was updated on 25 July 2022.
The UK BCRs and corresponding referential table, together with any additional guidance that may be published from time to time, are subject and without prejudice to, further amendments as may be required pursuant to Section 58.3(b) UK GDPR.
Applicants should ensure they read the updated Guidance before completing the referential table and the UK BCR documentation pack.
Introduction
- References to Articles are to the provisions of the United Kingdom General Data Protection Regulations (UK GDPR).
- References to DPA 2018 are to the Data Protection Act 2018 (as amended).
- References to the Commissioner are to the Information Commissioner appointed under Part 2, Schedule 12, DPA 2018.
The UK GDPR allows personal data to be transferred to a third country outside the UK only when there are adequacy regulations in place for that third country (Article 45) or when the Controller or Processor making the transfer ensures appropriate safeguards are in place with respect to the protection of privacy (Article 46) or where specific derogations apply (Article 49). Binding Corporate Rules (BCRs) are one of the ways of ensuring such appropriate safeguards are in place.
UK BCRs must comply with Article 47 and any guidelines and requirements published by the Commissioner from time to time. The Commissioner approves UK BCRs (Articles 57 & 58).
BCRs are appropriate for use by a group of undertakings, or group of enterprises engaged in a joint economic activity.
The following form is for use by those seeking approval of their UK BCRs for Controllers (BCR-C) and it is intended to help applicants demonstrate how to meet the requirements. When completing this form and drafting their UK BCRs, applicants should consider and also complete ICO UK BCR Referential Table v.2.0 which sets out the requirements in more detail.
Instructions
- If you are unsure whether a UK BCR-C is suitable for your organisation, please first contact the ICO to discuss.
- Please submit one electronic copy of the completed application form.
- Please submit one electronic copy of your draft IGA/binding instrument.
- Please submit one electronic copy of your draft BCR Policy, including any annexes to it. Copy policies and procedures in support of any commitments made within the application should also be provided.
- Please include a completed ICO UK BCR Referential Table v.2.0 indicating where in the application form and/or BCRs or IGA the relevant requirement is met.
- You may indicate in any submission document where you believe confidential information is contained. However, applicants should be aware that the Commissioner and their staff will deal with any requests for disclosure of any information in accordance with relevant UK legislation.
Taken together, the application form, IGA, BCR Policy and supporting documents constitute the Controller UK BCRs.
Please note that if you wish to apply for a UK BCR for Processors at the same time as or instead of a UK BCR-C, the Commissioner will require a separate application form.
All applicants are required to submit a completed ICO BCR Referential Table. Where applicants seek UK BCR-P, they must also complete Annex 1 to that table.
In that regard, applicants may if they so wish, submit:
- One combined UK BCR Policy for your UK BCR-C & UK BCR-P
- One combined IGA for UK BCR-C & UK BCR-P
- A combined set of supporting policies and procedures if they cover both the UK BCR-C & UK BCR-P.
Where combined UK Controller and Processor documentation is submitted, they must clearly delineate the Controller / Processor obligations as necessary.
The BCR Policy accompanying this application should be contained in one document. A number of documents may be supplied (for example, as annexes) provided that the relationship between them is made clear. Applicants are encouraged to draft succinct BCR Policies with as few annexes as possible.
The IGA/binding mechanism should be a separate document.
Ancillary documentation not supplied should be listed as the Commissioner may request this at any time during and post approval.
- Application form
- UK BCR referential table – for completion by ALL Applicants
- Previous version of the application form
If you have any questions, please contact the BCR team at the ICO.