BCRs Under Article 64: The EDPB Opinion Process

Understanding the EDPB's Role in BCR Approval

This guide explains the European Data Protection Board's (EDPB) Article 64 opinion procedure for Binding Corporate Rules (BCRs). BCRs transform a national supervisory authority's draft decision into an EU-wide data transfer tool. If your team is preparing BCRs for approval or assessing existing ones, it's crucial to understand how the EDPB influences what gets approved.

We'll cover controller and processor BCRs, the timeline from draft to final approval, and key areas where the EDPB typically intervenes.

Key Concepts

Binding Corporate Rules (BCRs): Internal data protection policies that allow a multinational group to transfer personal data from the EU to non-EU entities within the same corporate family. They require approval by a lead supervisory authority and an EDPB consistency review under Article 64 GDPR.

Article 64 Opinion: A binding opinion from the EDPB on draft supervisory authority decisions about BCRs. The national authority must consider this opinion and decide whether to follow or amend its draft decision.

Controller BCRs vs. Processor BCRs: Controller BCRs apply when the receiving entity determines the purposes and means of processing. Processor BCRs apply when the receiving entity processes data on behalf of a controller. The requirements differ, especially regarding data subject rights and liability.

Lead Supervisory Authority: The authority responsible for approving BCRs, usually based on the location of the group's main establishment in the EU (Article 56 GDPR).

Requirements Breakdown

Article 64(1)(d) Trigger

When a supervisory authority drafts a decision approving BCRs, it must submit that draft to the EDPB if the BCRs are for transfers outside the European Economic Area. This submission is mandatory.

Article 47 Substantive Requirements

BCRs must include legally binding commitments covering:

• Data subject rights: Mechanisms for individuals to enforce rights against any group member (Article 47(2)(e))
• Liability allocation: Rules on which entity is responsible for breaches, including joint and several liability (Article 47(2)(f))
• Third-party beneficiary rights: Allowing data subjects to invoke BCRs as third-party beneficiaries where applicable (Article 47(2)(g))
• Supervisory authority cooperation: Commitments to cooperate with the lead authority (Article 47(2)(j))
• Complaint mechanisms: Procedures for handling data subject complaints, with escalation paths (Article 47(2)(h))

EDPB Working Document 256 Rev.01

The EDPB's working document on BCRs outlines detailed requirements for both controller and processor BCRs, including:

• Data categories, processing purposes, and recipient categories
• Onward transfer restrictions
• Data protection principles mirroring Chapter II GDPR
• Audit and training obligations
• Binding nature and enforceability in each member state

Implementation Guidance

Preparing for Article 64 Review

Before submitting a draft decision to the EDPB, conduct an internal gap analysis against Article 47(2) and WP 256 Rev.01. Recent EDPB opinions, like Opinion 26/2026 (Snowflake Group processor BCRs), Opinion 27/2026 (HCL Tech Group controller BCRs), and Opinion 28/2026 (HCL Tech Group processor BCRs), illustrate the consistency mechanism in action.

Controller vs. Processor BCR Distinctions

For processor BCRs, commitments must reflect processing on behalf of a controller:

• Purpose limitation: Data can't be repurposed without controller instruction
• Sub-processor rules: Govern engagement and oversight of sub-processors
• Controller instructions: Commit to processing only on documented instructions
• Breach notification: Timelines for notifying the controller of breaches

Controller BCRs require broader coverage of lawful basis, data subject rights, and retention schedules.

Timeline Expectations

The EDPB aims to adopt Article 64 opinions within eight weeks of receiving a draft decision. Complex BCRs may extend this timeline. Allow extra time for your lead authority to respond and finalize its decision.

If the EDPB finds deficiencies, your authority will likely ask for amendments before final approval, potentially adding months to your timeline.

Common Pitfalls

Treating BCRs as a one-time approval: BCRs need ongoing maintenance. Changes in group entities, processing purposes, or data flows may require amendments. Establish a governance process to track changes.

Underspecifying data subject rights mechanisms: Vague commitments won't pass EDPB scrutiny. Specify request submission, response entities, and conflict handling between local law and GDPR rights.

Ignoring onward transfer restrictions: Transfers to third parties outside the group need their own Article 46 mechanism. BCRs don't extend protection to non-group recipients.

Failing to demonstrate enforceability: Provide evidence that BCRs create binding obligations under each EU member state's law. Generic statements aren't enough; legal opinions or equivalent proof are needed.

Overlooking processor-specific obligations: Ensure processor BCRs align with your role. Mismatches will be flagged by the EDPB.

Quick Reference Table

Article 64 Opinion Status

Before relying on a group's BCRs, confirm the EDPB has issued a favorable Article 64 opinion and the lead authority has adopted a final decision. Track EDPB opinions on their website. If an opinion notes deficiencies, ensure the final decision addressed them before relying on the BCRs.