This page was updated on 25 July 2022.
Applicants should ensure they read the updated Guidance before completing the referential table and the UK BCR documentation pack.
The UK BCRs and corresponding referential table, together with any additional guidance that may be published from time to time, are subject and without prejudice to, further amendments as may be required pursuant to Section 58.3(b) UK GDPR
Introduction
- References to Articles are to the provisions of the United Kingdom General Data Protection Regulations (UK GDPR).
- References to DPA 2018 are to the Data Protection Act 2018 (as amended).
- References to the Commissioner are to the Information Commissioner appointed under Part 2, Schedule 12, DPA 2018.
The UK GDPR allows personal data to be transferred to a third country outside the UK only when there are adequacy regulations in place for that third country (Article 45) or when the Controller or Processor making the transfer ensures appropriate safeguards are in place with respect to the protection of privacy (Article 46) or where specific derogations apply (Article 49). UK Binding Corporate Rules (UK BCRs) are one of the ways of ensuring such appropriate safeguards are in place.
UK BCRs must comply with Article 47 and any guidelines and requirements published by the Commissioner from time to time. The Commissioner approves UK BCRs (Articles 57 & 58).
UK BCRs are appropriate for use by a group of undertakings, or group of enterprises engaged in a joint economic activity.
The following form is for use by those seeking approval of their UK BCRs for Processors (UK BCR-P) and it is intended to help applicants demonstrate how to meet the requirements. When completing this form and drafting their UK BCRs, applicants should consider and also complete ICO UK BCR Referential Table v.2.0. When applying for UK BCR-P, Annex 1 to the ICO UK BCR Referential Table should also be completed.
Instructions
- Please read the UK BCR-P Guidance document before completing this application form.
- If you are unsure whether a UK BCR-P is suitable for your organisation, please first contact the ICO to discuss.
- Please submit one electronic copy of the completed application form.
- Please submit one electronic copy of your draft IGA/binding instrument.
- Please submit one electronic copy of your draft BCR-Policy, including any annexes to it. Copy policies and procedures in support of any commitments made within the application should also be provided.
- Please include a completed ICO UK BCR Referential Table v.2.0, including a completed Annex 1 to that Table, indicating where in the application form and/or BCR Policy or binding instrument/IGA the relevant requirement is met.
- You may indicate in any submission document where you believe confidential information is contained. However, applicants should be aware that the Commissioner and their staff will deal with any requests for disclosure of any information in accordance with relevant UK legislation.
Taken together, the application form, IGA, BCR Policy and supporting documents constitute your UK BCRs.
Please note that if you wish to apply for UK BCR for Controllers at the same time as or instead of a UK BCR-P, the Commissioner will require a separate application form.
All applicants are required to submit a completed ICO UK BCR Referential table. Where applicants seek UK BCR-P, they must also submit a completed Annex 1 to that table.
In that regard, applicants may if they so wish, submit:
- One combined UK BCR Policy for your UK BCR-C & UK BCR-P
- One combined IGA/binding instrument for UK BCR-C & UK BCR-P
- A combined set of supporting policies and procedures if they cover both the BCR C & P.
Where combined UK Controller and Processor documentation is submitted, they must clearly delineate the Controller / Processor obligations as necessary.
The BCR Policy accompanying this application should be contained in one document. A number of documents may be supplied (for example, as annexes) provided that the relationship between them is made clear. Applicants are encouraged to draft succinct BCR Policies with as few annexes as possible.
The IGA/binding mechanism should be a separate document.
Ancillary documentation not supplied should be listed as the Commissioner may request this.