This is an internal rulebook that large multinational companies create to protect personal data when it moves between their own offices in different countries. For example, if Google transfers customer data from its London office to its Dublin office, Binding Corporate Rules set the standards for how that data is handled. These rules must be approved by data protection authorities and are legally binding on the company. This is less risky than Standard Contractual Clauses because the company controls both ends of the data transfer.
If you're contracting with a large multinational, ask whether they have Binding Corporate Rules in place—this is actually a good sign that they take data protection seriously. You don't need to negotiate this clause yourself; just verify it exists and ask for a copy so you know what protections apply to your data. If they don't have one, ask them to use Standard Contractual Clauses instead. ---
Frequently Asked Questions
What does this clause mean in simple terms?
This is an internal rulebook that large multinational companies create to protect personal data when it moves between their own offices in different countries.
Why should I care about this clause?
For example, if Google transfers customer data from its London office to its Dublin office, Binding Corporate Rules set the standards for how that data is handled.
What are my options?
These rules must be approved by data protection authorities and are legally binding on the company.
How does this affect small businesses?
This is less risky than Standard Contractual Clauses because the company controls both ends of the data transfer.