Art.47 Binding corporate rules

Binding corporate rules must be approved by the competent supervisory authority under the consistency mechanism, must be legally binding on and enforced by every member of the group including its employees, and must expressly confer enforceable rights on data subjects. They must specify at least the structure and contact details of the group and each member, the transfers and data covered, their legally binding nature internally and externally, the application of the general data protection principles, the rights of data subjects and the means to exercise them, the acceptance by the Union established member of liability for breaches by members outside the Union, how information about the rules is provided to data subjects, the tasks of the data protection officer or other monitoring role, the complaint procedures, the verification mechanisms including data protection audits and corrective action, the mechanisms for reporting and recording changes to the rules and reporting them to the authority, the cooperation mechanism with the supervisory authority, the mechanism for reporting third country legal requirements likely to have a substantial adverse effect on the guarantees given, and appropriate data protection training for personnel with permanent or regular access to personal data.

Source: GDPR, Art.47. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open GDPR in the compliance library.

Many articles apply only where their condition is met (a data protection officer under Article 37, an impact assessment under Article 35, a representative under Article 27); the condition is in each statement.