--- title: "Art. 47 GDPR: Binding corporate rules" canonical: "https://dposchool.com/gdpr/article/47" source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_47" source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en" publisher: "DPO School" --- Art. 47 GDPR · Chapter V: Transfers of personal data to third countries or international organisations # Article 47 GDPR: Binding corporate rules Text as of 28 October 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review) ## Summary (not the official text) The competent supervisory authority approves binding corporate rules through the consistency mechanism, provided they meet the requirements in paragraph 1. Paragraph 2 lists what the rules must specify at least. ## Official text ### Article 47(1) **1.** The competent supervisory authority shall approve binding corporate rules in accordance with the consistency mechanism set out in Article 63, provided that they: #### Article 47(1)(a) **(a)** are legally binding and apply to and are enforced by every member concerned of the group of undertakings, or group of enterprises engaged in a joint economic activity, including their employees; #### Article 47(1)(b) **(b)** expressly confer enforceable rights on data subjects with regard to the processing of their personal data; and #### Article 47(1)(c) **(c)** fulfil the requirements laid down in paragraph 2. ### Article 47(2) **2.** The binding corporate rules referred to in paragraph 1 shall specify at least: #### Article 47(2)(a) **(a)** the structure and contact details of the group of undertakings, or group of enterprises engaged in a joint economic activity and of each of its members; #### Article 47(2)(b) **(b)** the data transfers or set of transfers, including the categories of personal data, the type of processing and its purposes, the type of data subjects affected and the identification of the third country or countries in question; #### Article 47(2)(c) **(c)** their legally binding nature, both internally and externally; #### Article 47(2)(d) **(d)** the application of the general data protection principles, in particular purpose limitation, data minimisation, limited storage periods, data quality, data protection by design and by default, legal basis for processing, processing of special categories of personal data, measures to ensure data security, and the requirements in respect of onward transfers to bodies not bound by the binding corporate rules; #### Article 47(2)(e) **(e)** the rights of data subjects in regard to processing and the means to exercise those rights, including the right not to be subject to decisions based solely on automated processing, including profiling in accordance with Article 22, the right to lodge a complaint with the competent supervisory authority and before the competent courts of the Member States in accordance with Article 79, and to obtain redress and, where appropriate, compensation for a breach of the binding corporate rules; #### Article 47(2)(f) **(f)** the acceptance by the controller or processor established on the territory of a Member State of liability for any breaches of the binding corporate rules by any member concerned not established in the Union; the controller or the processor shall be exempt from that liability, in whole or in part, only if it proves that that member is not responsible for the event giving rise to the damage; #### Article 47(2)(g) **(g)** how the information on the binding corporate rules, in particular on the provisions referred to in points (d), (e) and (f) of this paragraph is provided to the data subjects in addition to Articles 13 and 14; #### Article 47(2)(h) **(h)** the tasks of any data protection officer designated in accordance with Article 37 or any other person or entity in charge of the monitoring compliance with the binding corporate rules within the group of undertakings, or group of enterprises engaged in a joint economic activity, as well as monitoring training and complaint-handling; #### Article 47(2)(i) **(i)** the complaint procedures; #### Article 47(2)(j) **(j)** the mechanisms within the group of undertakings, or group of enterprises engaged in a joint economic activity for ensuring the verification of compliance with the binding corporate rules. Such mechanisms shall include data protection audits and methods for ensuring corrective actions to protect the rights of the data subject. Results of such verification should be communicated to the person or entity referred to in point (h) and to the board of the controlling undertaking of a group of undertakings, or of the group of enterprises engaged in a joint economic activity, and should be available upon request to the competent supervisory authority; #### Article 47(2)(k) **(k)** the mechanisms for reporting and recording changes to the rules and reporting those changes to the supervisory authority; #### Article 47(2)(l) **(l)** the cooperation mechanism with the supervisory authority to ensure compliance by any member of the group of undertakings, or group of enterprises engaged in a joint economic activity, in particular by making available to the supervisory authority the results of verifications of the measures referred to in point (j); #### Article 47(2)(m) **(m)** the mechanisms for reporting to the competent supervisory authority any legal requirements to which a member of the group of undertakings, or group of enterprises engaged in a joint economic activity is subject in a third country which are likely to have a substantial adverse effect on the guarantees provided by the binding corporate rules; and #### Article 47(2)(n) **(n)** the appropriate data protection training to personnel having permanent or regular access to personal data. ### Article 47(3) **3.** The Commission may specify the format and procedures for the exchange of information between controllers, processors and supervisory authorities for binding corporate rules within the meaning of this Article. Those implementing acts shall be adopted in accordance with the examination procedure set out in Article 93(2). ## Source Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu [Article 47 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_47) Text as of 28 October 2026. This is reference material, not legal advice. ## Related recitals This list is under review. - [Recital 109](https://dposchool.com/gdpr/recital/109) - [Recital 110](https://dposchool.com/gdpr/recital/110) ## EDPB guidance ### [Recommendations 1/2026 on the application for approval and on the elements and principles to be found in Processor Binding Corporate Rules](https://dposchool.com/gdpr/guidance/edpb-rec-01-2026) EDPB Rec 01/2026 · Draft for consultation · First published 19 January 2026 Consultation closed; final not yet published. Whether it will replace WP29 WP257 rev.01 and WP265 is not stated on the EDPB listing. [Document on the EDPB website](https://www.edpb.europa.eu/documents/recommendation/recommendations-12026-on-the-application-for-approval-and-on-the-elements_en) ### [Recommendations 1/2022 on the application for approval and on the elements and principles to be found in Controller Binding Corporate Rules (Art. 47 GDPR)](https://dposchool.com/gdpr/guidance/edpb-rec-01-2022) EDPB Rec 01/2022 · Final · Final version 20 June 2023 Supersedes WP29 WP256 rev.01 and WP264. [Document on the EDPB website](https://www.edpb.europa.eu/documents/recommendation/recommendations-12022-on-the-application-for-approval-and-on-the-elements_en) ### [Working document setting up a table with the elements and principles to be found in Processor Binding Corporate Rules](https://dposchool.com/gdpr/guidance/wp257-rev-01) WP257 rev.01 · Final · Endorsed by the EDPB 25 May 2018 Still listed as endorsed. Draft EDPB Recommendations 1/2026 on processor BCRs are pending. [Document on the EDPB website](https://www.edpb.europa.eu/endorsed-wp29-guidelines_en) ### [Recommendation on the standard application form for approval of Processor Binding Corporate Rules](https://dposchool.com/gdpr/guidance/wp265) WP265 · Final · Endorsed by the EDPB 25 May 2018 [Document on the EDPB website](https://www.edpb.europa.eu/endorsed-wp29-guidelines_en) ## Navigation [GDPR Navigator](https://dposchool.com/gdpr) / [Chapter V](https://dposchool.com/gdpr/chapter/5) / Article 47 Previous: [Art. 46 GDPR: Transfers subject to appropriate safeguards](https://dposchool.com/gdpr/article/46) Next: [Art. 48 GDPR: Transfers or disclosures not authorised by Union law](https://dposchool.com/gdpr/article/48) Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/gdpr/llms.txt - JSON API: https://dposchool.com/gdpr/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents