text: This Working Party was set up under

text: Article 29 of Directive 95/46/EC

text: . It is an independent European advisory body on data protection and privacy. Its tasks are described in

text: Article 30 of Directive 95/46/EC

text: and

text: Article 15 of Directive 2002/58/EC

text: . The secretariat is provided by Directorate C (Fundamental Rights and Union Citizenship) of the European Commission, Directorate General Justice, B-1049 Brussels, Belgium, Office No MO-59 02/013. Website: http://ec.europa.eu/newsroom/article29/news.cfm?item_type=1358&tpa_id=6936

text: Article 57.1

text: .s GDPR states that “without prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory […] approve binding corporate rules pursuant to

text: Article 47

text: ” and

text: Article 58.3

text: .j GDPR according to which each supervisory authority shall have the “authorisation and advisory powers […] to approve binding corporate rules pursuant to

text: Article 47

text: ”. Pursuant to

text: Article 4(22)

text: (a) and (b), a ‘supervisory authority concerned’ means a supervisory authority which is concerned by the processing of personal data because the controller or processor is established on the territory of the Member State of that supervisory authority or because “data subjects residing in the Member State of that supervisory authority are substantially affected or likely to be substantially affected by the processing”. As for the BCRs approval procedure, the concerned SAs are the SAs in the countries from where the transfers are to take place as specified by the applicants or, in case of BCR-P, all SAs (since a processor established in a Member State may provide services to controllers in several – potentially all – Member States). 3 The “BCR Lead” is generally distinct from the “OSS Lead” considering that BCR transfers will not as a rule meet the definition/criteria of a cross-border processing operation. However, there could be cases in which the same SA could be the BCR Lead and the OSS Lead. This might e.g. be the case if a transfer performed by one establishment substantially affects data subjects in more than one MS (i.e. if personal data are first sent from member states A, B and C to the controller’s establishment in member state A, and subsequently transferred by this establishment in A to a third country or, in case of BCR-P, where the processor carries out the same transfers for all their clients in the different member states). In any case, the BCR approval procedure would be the specific one settled by

text: Article 64

text: GDPR.

text: This Working Party was set up under

text: Article 29 of Directive 95/46/EC

text: Article 30 of Directive 95/46/EC

text: and

text: Article 15 of Directive 2002/58/EC

text: According to

text: Article 47.2

text: .f GDPR, there should always be an EU based member of the group established on the territory of a Member State accepting liability for any breaches of the binding corporate rules by any member concerned not established in the Union. If the headquarters of the group were somewhere else, the headquarters should delegate these responsibilities to a member based in the EU.

text: This Working Party was set up under

text: Article 29 of Directive 95/46/EC

text: Article 30 of Directive 95/46/EC

text: and

text: Article 15 of Directive 2002/58/EC

text: See above footnote n. 2. 6 As a rule, the BCR Lead will consult 2 co-reviewers whenever 14 Member States or more are concerned by transfers. Under this threshold it is possible to have one or two co-reviewers depending on the specific case and the availability of SAs. 7 See above footnote n. 2.

text: This Working Party was set up under

text: Article 29 of Directive 95/46/EC

text: Article 30 of Directive 95/46/EC

text: and

text: Article 15 of Directive 2002/58/EC

text: According to

text: Article 64.5

text: , the Chair of the Board will, without undue delay, inform by electronic means the members of the Board and the Commission of this information. 9 In particular, in accordance with

text: Article 65.1

text: .c., “in order to ensure the correct and consistent application of this Regulation in individual cases, the Board shall adopt a binding decision in the following cases: […] (c) where a competent supervisory authority […] does not follow the opinion of the Board issued under

text: Article 64

text: . In that case, any supervisory authority concerned or the Commission may communicate the matter to the Board”.

text: This Working Party was set up under

text: Article 29 of Directive 95/46/EC

text: Article 30 of Directive 95/46/EC

text: and

text: Article 15 of Directive 2002/58/EC

text: See also on this

text: WP 256

text: and 257, Sections 1.7 according to which “The BCRs must contain the right for every data subject to have an easy access to them”.

text: This Working Party was set up under

text: Article 29 of Directive 95/46/EC

text: Article 30 of Directive 95/46/EC

text: and

text: Article 15 of Directive 2002/58/EC

sprak: en

title: Working Document Setting Forth a Co-Operation Procedure for the approval of “Binding Corporate Rules” for controllers and processors under the GDPR

text: Introduction

text: The procedure for approving binding corporate rules (BCRs) for controllers and processors is laid out by provisions contained in Articles 47.1, 63, 64 and (only if necessary) 65 of the

text: Regulation (EU) 2016/679

text: (GDPR). As a result, binding corporate rules are to be approved by the competent supervisory authority in the relevant jurisdiction in accordance with the consistency mechanism set out in

text: Article 63

text: , under which the European Data Protection Board (EDPB) will issue a non-binding opinion on the draft decision submitted by the competent Supervisory Authority (

text: Article 64

text: GDPR). As the group applying for approval of its BCRs may have entities in more than one Member State, this procedure may involve a number of concerned Supervisory Authorities (SAs) , e.g. in those countries from where the transfers are to take place. However, the GDPR does not lay down specific rules for the cooperation phase which should take place among the concerned SAs in advance of referral to the EDPB. It also does not set out specific rules for identifying the competent SA – which will act as Lead Authority for the BCRs (‘BCR Lead’) . The role of such BCR Lead includes acting as a single point of contact with the applicant organization or group during the approval process and managing the application procedure in its cooperation phase. The aim of this document is to update the

text: WP 107

text: and identify smooth and effective cooperation procedures in line with the GDPR whilst taking full advantage of the previous fruitful experience of the Data Protection Authorities in dealing with the approval of BCRs. This document will be reviewed and if necessary updated, based on the practical experience gained through the application of the GDPR.

text: 1. Identification of the BCR Lead Supervisory Authority

text: 1.1 A group of undertakings, or group of enterprises engaged in a joint economic activity (‘Group’), interested in submitting draft binding corporate rules (BCRs) for the approval of the competent Authority according to Articles

text: and

text: GDPR should propose a SA as the BCR Lead. The decision as to which SA should act as BCR Lead is based upon the criteria contained in this document (see next paragraph). It is for the organisation to justify the reasons why a given SA should be considered as the BCR Lead.

text: 1.2 An applicant Group should justify the proposal of the BCR Lead on the basis of relevant criteria such as:

text: a. the location(s) of the Group’s European headquarters;

text: b. the location of the company within the Group with delegated data protection responsibilities ;

text: c. the location of the company which is best placed (in terms of management function, administrative burden, etc.) to deal with the application and to enforce the binding corporate rules in the Group;

text: d. the place where most decisions in terms of the purposes and the means of the processing (i.e. transfer) are taken; and

text: e. the member state within the EU from which most or all transfers outside the EEA will take place.

text: 1.3 Particular attention will be given to factor described under 1.2 (a) above.

text: 1.4 These are not formal criteria. The SA to which the application is sent (as prospective BCR Lead SA) will exercise its discretion in deciding whether it is in fact the most appropriate lead SA and, in any event, the SAs among themselves may decide to allocate the application to a SA other than the one to which the Group applied (see next paragraph), in particular if it would be possible and worth for speeding up the procedure (e.g. taking into account the workload of the originally requested SA).

text: 1.5 The applicant should also provide the proposed BCR Lead (the entry point) with all appropriate information ( both on paper and electronically to facilitate further distribution) which justifies its proposal, inter alia, the nature and general structure of the processing activities in the EU with particular attention to the place/s where decisions are made, the location and nature of affiliates in the EU, the number of employees or persons concerned, the means and purposes of the processing, the places from where the transfers to third countries do take place and the third countries to which those data are transferred.

text: 2. Cooperation procedure for the approval of BCRs

text: 2.1 The proposed BCR Lead will forward the information received as to why that SA has been selected by the company to be the lead authority for the BCRs to all SAs concerned with an indication of whether or not it agrees to be the BCR Lead. If the entry point agrees to be the lead authority, the other concerned SAs will be asked, under

text: Article 57.1

text: .g GDPR, to raise any objections within two weeks (period extendable to two additional weeks if requested by any SA concerned). Silence is deemed as consent. In the event that the entry point is of the view that it should not act as the BCR Lead, it should explain the reasons for its decision as well as its recommendations (if any) as to which other SA would be the appropriate lead authority. The SAs concerned will endeavor to reach a decision within one monthfrom the date that the papers were first circulated.

text: 2.2 Once a decision on the BCR Lead has been made, the latter will start the discussions with the applicant and review the draft BCR documents. In order to foster a more consistent approach, it will send, under

text: Article 57.1

text: .g GDPR, a first revised draft of the BCRs and the related documents to one or two SAs (depending on the number of Member States from whose territories the transfers will take place) which will act as co-reviewers and will help the BCR Lead in the assessment. In case there is no response from a SA acting as co-reviewer within one month from the date the draft and the related documents were sent to it (deadline extendable under justified circumstances), that SA will be deemed to have agreed with them. There may need to be several different drafts or exchanges between the applicant and the relevant SAs before a satisfactory draft is produced.

text: 2.3 The result of these discussions should be a “consolidated draft” sent by the applicant to the BCR Lead which will circulate it among all concerned SAs under

text: Article 57.1

text: .g GDPR for comments. According to this procedure, the period for comments on the consolidated draft will not exceed one month. A concerned SA which has not presented a

text: reasoned objection within this period shall be deemed to be in agreement with the consolidated draft.

text: 2.4 The BCR Lead will send any further comments on the “consolidated draft” to the applicant and may resume discussions, if necessary. If the lead authority is of the view that the applicant is in a position to address satisfactorily all comments received, it will invite the applicant to send a “final draft” to it. 2.5 Pursuant to Article

text: and

text: GDPR, the BCR Lead will submit the draft decision to the EDPB on the ‘final draft’ of the BCRs along with all relevant information, documentation and the views of the concerned SAs. The EDPB will adopt an opinion on the matter in accordance with

text: Article 64.3

text: GDPR and its Rules of Procedure.

text: 2.6 Where the opinion handed down by the EDPB under

text: Article 64.3

text: endorses the draft decision on the draft BCRs in the form submitted, the BCR Lead will adopt its decision approving the draft BCRs.

text: 2.7 Where the opinion handed down by the EDPB according to

text: Article 64.3

text: requires any amendment to the draft BCRs, the BCR Lead will communicate to the Chair of the Board within the two-week period set out in

text: Article 64.7

text: whether it intends to maintain its draft decision (i.e. not to follow the opinion of the EDPB) or whether it intends to amend it in accordance with the EDPB opinion . In the first case, pursuant to

text: Article 64.8

text: GDPR,

text: Article 65.1

text: GDPR shall apply . If the BCR Lead communicates to the Chair of the Board that it intends to amend its draft decision in accordance with the EDPB opinion, the BCR Lead will contact the applicant immediately in order to request the amendments to the draft BCRs to be made in accordance with the EDPB opinion so that the draft BCRs can be finalized. When the draft BCRs have been finalized in accordance with the EDPB opinion, the BCR Lead will amend its initial draft decision accordingly, notify the EDPB pursuant Article 64.7 of its amended decision and approve the BCR.

text: 2.8 Once the BCR Lead approves the BCRs, it will inform and send a copy of them to all the concerned SAs. In accordance with

text: Article 46.2

text: .b GDPR, the approved ‘binding corporate rules’ will provide for the appropriate safeguards referred to in paragraph 46.1 without requiring any specific authorisation from the other concerned supervisory authorities.

text: 2.9 Translations: as a general rule and without prejudice to other translations where necessary or

text: required by law, all documents including the consolidated draft of the BCRs should be provided by the applicant in the language of the BCR Lead and also in English when possible in accordance with national law. The final draft and the approved BCRs must be translated by the applicant into the languages of those SAs concerned .

text: 2.10 Once the BCRs have been approved, the BCR Lead, according to

text: WP 256

text: and 257, points 5.1, will inform the concerned SAs of any updates to the BCRs or to the list of BCR members as provided by the applicant. In case the group extended the scope of the BCRs to an additional EU member state (because of the establishment of a new BCR member in this EU member state), the SA of this member state will then be deemed to be a new concerned SA as for point 2.8.


text: This Working Party was set up under

text: Article 29 of Directive 95/46/EC

text: . It is an independent European advisory body on data protection and privacy. Its tasks are described in

text: Article 30 of Directive 95/46/EC

text: and

text: Article 15 of Directive 2002/58/EC

text: . The secretariat is provided by Directorate C (Fundamental Rights and Union Citizenship) of the European Commission, Directorate General Justice, B-1049 Brussels, Belgium, Office No MO-59 02/013. Website: http://ec.europa.eu/newsroom/article29/news.cfm?item_type=1358&tpa_id=6936

text: INTERNAL BINDING NATURE

text: EXTERNALLY BINDING NATURE

publisher: Artikel 29-gruppen

title: Recommendation on the Standard Application for Approval of Controller Binding Corporate Rules for the Transfer of Personal Data

serie: wp

text: Standard Application for Approval of Controller Binding

type: rubrik

text: Corporate Rules for the Transfer of Personal Data

text: Introduction and Instructions The General Data Protection

text: Regulation (EU) 2016/679

text: (‘GDPR’) allows personal data to be transferred outside the EEA only when the third country provides an "adequate level of protection" for the data (Art. 45) or when the controller adduces adequate safeguards with respect to the protection of privacy (Art. 46). Binding Corporate Rules (BCRs) are one of the ways in which such adequate safeguards (Art. 47) may be demonstrated by a group of undertakings, or group of enterprises engaged in a joint economic activity. According to

text: Article 64

text: GDPR, the use of BCRs as appropriate safeguards for international data transfers from the EEA requires the approval of the competent supervisory authority in accordance with the consistency mechanism set out in

text: Article 63

text: without requiring any specific authorisation from a supervisory authority (

text: Article 46.2

text: .b GDPR). The following form is for use by companies seeking approval of BCRs. The form is based on papers previously issued by the

text: Article 29

text: Working Party of European data protection authorities (the "Working Party"), and in particular

text: , and it is intended to help applicants demonstrate how to meet the requirements set out in

text: Article 47

text: GDPR and

text: WP 256

text: . General Instructions  Only a single copy of the form need be filled out and submitted to the Supervisory Authority (‘SA’) you consider to be the lead authority for the BCRs (‘BCR lead’) in accordance with Article

text: and

text: GDPR and

text: WP 263

text: ; this form may be used in all EEA Member States.  Please fill out all entries and submit the form to the SA you consider to be the BCR lead.  You may attach additional pages or annexes if there is insufficient space to complete your responses.  You may indicate any responses or materials that is in your opinion commercially sensitive and should be kept confidential but, in any case, be aware that the relevant document will be shared among the concerned SAs and the European Data Protection Board (EDPB) which, under

text: Article 64

text: , has to issue its opinion on the approval draft decision of your BCRs. Requests by third parties for disclosure of such information, will, however, be handled by each supervisory authority involved in accordance with national legislation.  The footnotes in the application form indicate the relevant provisions of the

text: Article 47

text: GDPR and Working Party papers

text: WP 256

text: and specific Sections of

text: WP 74

text: and

text: WP 108

text: , which contain further clarification of the questions still valid under the framework of the GDPR.  Once you have submitted the form, the SA you approached will circulate Part 1 of the form to all the ‘concerned supervisory authorities’ in order to determine who should be the BCR Lead;

text: 1 This questionnaire takes also into account the draft standard application form for approval of Binding Corporate Rules drawn up by the ICC. 2 Pursuant to

text: Article 4(22)

text: (a) and (b), a ‘supervisory authority concerned’ means a supervisory authority which is concerned by the processing of personal data because the controller or processor is established on the territory of the Member State of that supervisory authority or because “data subjects residing in the Member State of that

type: stycke

text:  You will be informed by the SA you approached which SA has finally been appointed by all SAs concerned to act as BCR Lead;  As a rule, the BCR Lead will seek the cooperation of two other SAs concerned (SAs coreviewers) in order to assess the BCRs in the light of

text: Article 47

text: and

text: WP 256

text: ;  Once revised, in accordance with

text: Article 64

text: GDPR, the BCR Lead will circulate the remainder of the form including your BCRs to all the other supervisory authorities concerned in order to collect their views to be sent to European Data Protection Board (EDPB) along with the draft opinion on the BCRs.

text: supervisory authority are substantially affected or likely to be substantially affected by the processing”. As for the BCRs approval procedure, the concerned SAs are the SAs in the countries from where the transfers are to take place as specified by the applicants or, in case of BCR-P, all SAs (since a processor established in a Member State may provide services to controllers in several – potentially all – Member States). 3 As a rule, the BCR Lead will consult 2 co-reviewers whenever 14 Member States are concerned by transfers. Under this threshold it is possible to have one or two co-reviewers depending on the specific case and the availability of SAs.

text: PART 1 APPLICANT INFORMATION

text: Section 1: Structure and Contact Details of the Applicant and of the Group of group of undertakings, or group of enterprises engaged in a joint economic activity (‘Group’)  If the Group has its headquarters in the EEA the form should be filled out and submitted by that EEA entity.  If the Group has its headquarters outside the EEA, then the Group should appoint a Group entity located inside the EEA – preferably established in the country of the presumptive BCR Lead - as the Group member with “delegated data protection responsibilities”. This is the entity which should then submit the application on behalf of the Group.  Contact Details of the Responsible Party for Queries: o Please indicate a responsible party to whom queries may be addressed concerning the application. o This party need not be located in the EEA, although this might be advisable for practical reasons. o You may indicate a function rather than a specific person. Section 2: Short description of data flows  The applicant should also give a brief description of the scope and nature of the data flows from the EEA for which approval is sought. Section 3: Determination of the BCRs Lead  In accordance with

text: Article 64

text: GDPR, the BCR Lead is the authority in charge of coordinating the approval of your BCRs which then could be considered to be appropriate safeguards in the countries within the EEA which you have named in your application as the origin of transfers of personal data by Group members to third countries, without requiring any specific authorisation for the use of the BCR from the other supervisory authorities concerned. o Before you approach one SA as the presumptive BCR Lead you should examine the factors listed in Section 1of

text: WP 263

text: (still the same already enlisted in Sections 3.3 and 3.4. of

text: WP 108

text: ). Based on these factors you should explain in Part 1.3 of your application which SA should be the BCR Lead. The SAs are not obligated to accept the choice that you make if they believe that another SA is more suitable to be BCR Lead, in particular if it would be worth for speeding up the procedure (e.g. taking into account the workload of the originally requested SA).

text: PART 2 BACKGROUND PAPER

text: Section 4: Binding Nature of the Binding Corporate Rules  In order for the BCRs to be approved for the transfer of personal data, they must be shown to have legally binding effect both internally (between the Group entities, and on employees and subcontractors) and externally (for the benefit of individuals whose personal data is processed by the Group) in accordance with national legislation. These questions elicit the information necessary to determine if your BCRs have such binding effect.  Your application will need to make clear that the burden of proof with regard to an alleged breach of the rules will rest with one member of the Group established on the territory of a Member State (e.g. the member at the origin of the transfer or the European headquarters or that part of the organisation with delegated data protection responsibilities), regardless of where the claim originates.  Regulators in some sectors (such as the financial services industry) may prohibit an entity of the Group in one country from assuming liability for another Group entity in another country. If this is the case for your application, please provide details about this situation in the subsection “Legal claims or actions” and explain any other mechanisms your Group has implemented to ensure that an aggrieved individual can obtain recourse against the Group in the EEA. Section 5: Effectiveness  Effectiveness (verification of compliance) may be demonstrated by a variety of mechanisms typically implemented by companies, such as a regular audit programme, corporate governance activities, compliance departments, etc. Please respond to the questions on effectiveness based on the verification mechanisms used in your group.  You will need to confirm that you will permit the concerned SAs in the EEA to audit your compliance. Section 6: Cooperation with SAs  Section 6 focuses on cooperation with SAs. You have to specify how your BCRs deal with the cooperation with SAs. Section 7: Description of Processing and Data Flows  In order for the SAs to assess whether your BCRs provide adequate safeguards for the transfers of data in accordance with

text: Article 47

text: GDPR, it is essential that you describe data flows within your Group in a complete yet understandable fashion. Section 8: Mechanisms for Reporting and Recording Changes  Both the SAs and the Group entities must be informed without undue delay about any changes to the BCRs. In particular, changes that significantly affect data protection compliance (e.g. will be detrimental to data subject rights), and not to mere administrative changes (unless they impact the BCRs - e.g. changes to the bindingness) must be promptly communicated to the concerned Supervisory Authorities, via the competent SA under

text: Article 64

text: (i.e. BCR Lead) . In this section, please describe the mechanisms your Group has implemented for reporting and recording such changes.  The obligation to report changes applies only to the text of the BCRs themselves, and not to any supporting documentation, unless a change to such documentation would significantly affect compliance with the BCRs. Section 9: Data Protection Safeguards  In this Section please provide details of how your BCRs address the core data protection safeguards that are necessary to provide an adequate level of protection for the data that are transferred. Annex 1: Copy of the Formal Binding Corporate Rules  Please attach a copy of your BCRs. These need not necessarily be contained within one document and your BCRs may comprise a number of documents. In the latter case please clearly specify the legal relationship between these documents (e.g. general rules – more detailed rules for a specific area like HRM or CRM).

text: 4 See

text: WP 155

text: , Q 14.

text:  You do not need to attach all ancillary documentation at this stage, this may be submitted separately after discussions with the BCR Lead.

text: Standard Application for Approval of Binding Corporate Rules

text: PART 1: APPLICANT INFORMATION

text: 1. STRUCTURE AND CONTACT DETAILS OF THE GROUP OF UNDERTAKINGS OR GROUP OF ENTERPRISES ENGAGED IN A JOINT ECONOMIC ACTIVITY (THE GROUP)

text: Name of the Group and location of its headquarters: Does the Group have its headquarters in the EEA? Yes No

text: Name and location of the applicant: Identification number (if any): Legal nature of the applicant (corporation, partnership, etc.): Description of position of the applicant within the Group: (e.g. headquarters of the Group in the EEA, or, if the Group does not have its headquarters in the EEA, the member of the Group inside the EEA with delegated data protection responsibilities) Name and/or function of contact person (note: the contact person may change, you may indicate a function rather than the name of a specific person): Address: Country: Phone number: Fax: E-Mail: EEA Member States from which BCRs will be used:

text: 2. SHORT DESCRIPTION OF PROCESSING AND DATA FLOWS

text: Please, indicate the following: - Nature of the data covered by BCRs, and in particular, if they apply to one category of data or to more than one category, the type of processing and its purposes, the types of data subjects affected ( (for instance data related to employees, customers, suppliers and other third parties as part of its respective regular business activities,…)

text: - Do the BCRs only apply to transfers from the EEA, or do they apply to all transfers between members of the group?

text: - Please specify from which country most of the data are transferred outside the EEA:

text: - Extent of the transfers within the Group that are covered by the BCRs; including a description and the contact details of any Group members in the EEA or outside EEA to which personal data may be transferred

text: 3. DETERMINATION OF THE LEAD SUPERVISORY AUTHORITY (‘BCR LEAD’)

text: Please explain which should be the BCR Lead, based on the following criteria: - Location of the Group’s EEA Headquarters

text: - If the Group is not headquartered in the EEA, the location in the EEA of the Group entity with delegated data protection responsibilities

text: - The location of the company which is best placed (in terms of management function, administrative burden, etc.) to deal with the application and to enforce the binding corporate rules in the Group

text: - Country where most of the decisions in terms of the purposes and the means of the data processing are taken

text: - EEA Member States from which most of the transfers outside the EEA will take place

text: 5 See

text: Article 47.2

text: . a and b and Section 4.1.

text: WP 256

text: . 6 See Part. 1

text: WP 263

text: PART 2: BACKGROUND PAPER

text: 4. BINDING NATURE OF THE BINDING CORPORATE RULES (BCRs)

text: Binding within the entities of the Group

text: How are the BCRs made binding upon the members of the Group?

text: Measures or rules that are legally binding on all members of the Group Contracts or intra-group agreement between the members of the Group Unilateral declarations or undertakings made or given by the parent company which are binding on the other members of the Group (this is only possible if the BCR member taking responsibility and liability is located in a Member State that recognizes Unilateral undertakings as binding and if this BCR member is legally able to bind the other members subject to BCRs) Other means (only if the group demonstrates how the binding character of the BCRs is achieved), please specify

text: Please explain how the mechanisms you indicated above are legally binding on the members of the Group in the sense that they can be enforced by other members of the Group (esp. headquarters):

text: Does the internally binding effect of your BCRs extend to the whole Group? (If some Group members should be exempted, specify how and why)

text: 7 Working Document setting up a table with the elements and principles to be found in Binding Corporate Rules,

text: WP 256

text: , adopted on 6 February 2018. 8 See GDPR Art. 47.1.a and 47.2.c and Section 1.2

text: WP 256

text: . See, also, general considerations in Section 3.3.1.

text: and in Section 5

text: . 9 See Section 5.3

text: Binding upon the employees

text: Your Group may take some or all of the following steps to ensure that the BCRs are binding on employees, but there may be other steps. Please, give details below. - Work employment contract - Collective agreements (approved by workers committee/another body) - Employees must sign or attest to have read the BCRs or related ethics guidelines in which the BCRs are incorporated - BCRs have been incorporated in relevant company policies - Other means (but the group must properly explain how the BCRs are made binding on employees) - Disciplinary sanctions for failing to comply with relevant company policies, including dismissal for violation Please provide a summary supported by extracts from policies and procedures or confidentiality agreements as appropriate to explain how the BCRs are binding upon employees.

text: Binding upon subcontractors processing the data

text: What steps have you taken to require subcontractors to apply protections to the processing of personal data (e.g., through the use of obligations in your contracts with them)? Please specify: How do such contracts or other legal acts under Union or Member State law address the consequences of noncompliance? Please specify the sanctions imposed on subcontractors for failure to comply

text: 10 See

text: Article 47.1

text: .a and Section 1.2

text: WP 256

text: and Section 5.8

text: . 11 See Art. 28.3 GDPR and Section 5.10

text: How are the rules binding externally for the benefit of individuals (third party beneficiary rights) or how do you intend to create such rights? For example you might have created some third party beneficiary rights in contracts or unilateral declarations .

text: Legal claim or actions

text: Explain how you meet the obligations according to the requirement of

text: Articles 47.2

text: .e, 77 and 79, 82 GDPR

text: Please confirm that the controller established on the territory of a Member State (e.g. the European headquarters of the Group, or that part of the Group with delegated data protection responsibilities in the EEA), has made appropriate arrangements to enable itself or the member of the Group at the origin of the transfer payment of compensation for any damages resulting from the breach, by any part of the Group, of the BCRs and explain how this is ensured.

text: Please confirm that the burden of proof with regard to an alleged breach of the rules will rest with the member of the Group at the origin of the transfer or the European headquarters or that part of the organisation in the EEA with delegated data protection responsibilities, regardless of where the claim originates.

text: 12 See 47.1.b and 47.2.c and e GDPR and Section 1.3

text: WP 256

text: . See also general considerations in Section 3.3.2

text: . 13 Data subjects must at least be able to enforce the following elements of the BCRs: - Data protection principles (Art. 47.2.d and Section 6.1

text: WP 256

text: ), - Transparency and easy access to BCRs (Art. 47.2.g and Section 6.1, Section 1.7

text: WP 256

text: ), - Rights of access, rectification, erasure, restriction, objection to processing, right not to be subject to decisions based solely on automated processing, including profiling (GDPR Art. 47.2.e and Art. 15, 16, 17,18, 21, 22), - National legislation preventing respect of BCRs (Art. 47.2.m and Section 6.3 of this referential), - Right to complain through the internal complaint mechanism of the companies (Art. 47.1.i and Section 2.2

text: WP 256

text: ), - Cooperation duties with Data Protection Authority (Art. 47.2.k and l, Section 3.1

text: WP 256

text: ), - Liability and jurisdiction provisions (Art. 47.2.e and f, Section 1.3, 1.4

text: WP 256

text: ). Furthermore, you must be fully aware of the fact that according to civil law of some jurisdictions unilateral declarations or unilateral undertakings do not have a binding effect. In the lack of a specific legislative provision on bindingness of such declarations, only a contract with third party beneficiary clauses between the members of the Group may give proof of bindingness. 14 See also Section 1.3.

text: WP 256

text: : the BCRs must confer the right to lodge a complaint with the competent supervisory authority (choice before the SA in the Member State of his habitual residence, place of work or place of the alleged infringement, pursuant to art. 77 GDPR) and before the competent court of the EU Member States (choice for the data subject to act before the courts where the controller or processor has an establishment or where the data subject has his or her habitual residence pursuant to

text: Article 79

text: GDPR).

text: 5. EFFECTIVENESS

text: It is important to show how the BCRs in place within your organization are brought to life in practise, in particular in non EEA countries where data will be transferred on the basis of the BCRs, as this will be significant in assessing the adequacy of the safeguards.

text: Training and awareness raising (employees)

text: - Special training programs - Employees are tested on BCRs and data protection - BCRs are communicated to all employees on paper or online - Review and approval by senior officers of the company - How are employees trained to identify the data protection implications of their work, i.e. to identify that the relevant privacy policies are applicable to their activities and to react accordingly? (This applies whether these employees are or not based in the EEA)

text: Internal complaint handling

text: Do the BCRs contain an internal complaint handling system to enforce compliance? Please describe the system for handling complaints:

text: 15 See

text: Articles 47.2

text: .j and 47.2.l and Art. 38.3 GDPR and Section 2.3

text: WP 256

text: . See also general considerations in Section 5.2

text: and Section 6

text: . 16 See

text: Articles 47.2

text: .i and 12.3 GDPR and Section 2.2

text: WP 256

text: . See also Section 5.3

text: Verification of compliance

text: What verification mechanisms does your Group have in place to audit each member's compliance with your BCRs? (e.g., an audit programme, compliance programme, etc)? Please specify:

text: Please explain how your verification or compliance programme functions within the Group (e.g., information as to the recipients of any audit reports and their position within the structure of the Group).

text: Do the BCRs provide for the use of: - Data Protection Officer? Choose by clicking here

text: - internal auditors? Choose by clicking here - external auditors? Choose by clicking here

text: - a combination of both internal and external auditors? Choose by clicking here - verification by an internal compliance department? Choose by clicking here Do your BCRs mention if the verification mechanisms are clearly set out in… - a document containing your data protection standards Choose by clicking here - other internal procedure documents and audits? Choose by clicking here

text: Network of data protection officers (DPO) or appropriate staff

text: Please confirm that a network of DPOs or appropriate staff (such as a network of privacy officers) is appointed with top management support to oversee and ensure compliance with the BCR for Processors:

text: Please explain how your network of DPOs or privacy officers functions: - Internal structure:

text: - Role and responsibilities:

text: 6. COOPERATION WITH SAs

text: 17 See Section 2.4

text: WP 256

text: . 18 See

text: Article 47.2

text: .l GDPR and Section 3.1

text: WP 256

text: and Section 5.4

text: WP 74

text: Please, specify how your BCRs deal with the issues of cooperation with SAs:

text: Do you confirm that you will permit the concerned SAs to audit your compliance? Do you confirm that the Group as a whole and each of the companies of the Group will abide by the advice of the concerned Supervisory authority relating to the interpretation and the application of your BCRs?

text: 7. DESCRIPTION OF PROCESSING AND DATA FLOWS

text: Please indicate the following: - Nature of the data covered by the BCRs, e.g. HR data, and in particular, if they apply to one category of data or to more than one category - What is the nature of the personal data being transferred? - In broad terms where do the data flow to and from? - What are the type of processing and the purposes for which the data covered by the BCRs are transferred to third countries and of the processing that is carried out after the transfers? - Extent of the transfers within the Group that are covered by the BCRs, including a description and contact details of any Group members in the EEA or outside the EEA to which personal data may be transferred Do the BCRs only apply to transfers from the EEA, or do they apply to all transfers between members of the Group? Please specify:

text: 19 See

text: Article 47.2

text: .b GDPR and Section 4.1

text: WP 256

text: and Section 7

text: 8. MECHANISMS FOR REPORTING AND RECORDING CHANGES

text: Please, confirm and explain how your BCRs allow for informing other parts of the Group and the concerned SAs, via the competent SA under

text: Article 64

text: (i.e. the BCR Lead), of any changes to the BCRs and/or the list of BCR members (summary): Please confirm that you have put in place a system to record any changes to your BCRs.

text: 9. DATA PROTECTION SAFEGUARDS

text: Please, specify with reference to your BCRs how and where the following issues are addressed with supporting documentation where appropriate: - Transparency and fairness and lawfulness - Purpose limitation

text: - Data minimisation and accuracy - Limited storage periods - Processing of special categories of personal data - Security (including the obligation to enter into contracts with all internal and external subcontractors/processors which comprise all requirements as set out in Art. 28.3 GDPR and as well the duty to notify without undue delay any personal data breaches to the EU headquarters or the EU BCR member with delegated data protection responsibilities and the other relevant Privacy Officer/Function and data subjects where the personal data breach is likely to result in a high risk to their rights and freedoms) - Restrictions on onward transfers - Other (e.g. protection of children, etc.)

text: 20 See

text: Article 47.2

text: .k GDPR and Section 5.1.

text: WP 256

text: . 21 See

text: Article 47.2

text: .d GDPR and Section 6.1.

text: WP 256

text: 10. ACCOUNTABILITY AND OTHER TOOLS

text: -Please confirm and specify how BCR members will be responsible for and able to demonstrate compliance with the BCRs

text: -Please confirm that the BCR members will maintain a record of all categories of processing activities carried out on behalf of each controller in line with the requirements as set out in Art. 30.1 GDPR.

text: -Please confirm that data protection impact assessments will be carried out for processing operations that are likely to result in a high risk to the rights and freedoms of natural persons (GDPR Art. 35) and that where a data protection impact assessment under

text: Article 35

text: indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk, the competent supervisory authority, prior to processing, should be consulted (GDPR Art. 36)

text: - Please confirm and specify which appropriate technical and organisational measures will be implemented to comply with data protection principles and facilitate compliance with the requirements set up by the BCRs in practice (e.g. data protection by design and by default, GDPR Art. 25)

text: Please provide supporting documents where appropriate with respect to the information requested above

text: 22 See Section 6.1.2

text: ANNEX 1: COPY OF THE FORMAL BINDING CORPORATE RULES

text: Please attach a copy of your BCRs. Note that this does not include any ancillary documentation that you would like to submit (e.g. specific privacy policies and rules).

type: vagledning


text: This Working Party was set up under

text: Article 29 of Directive 95/46/EC

text: . It is an independent European advisory body on data protection and privacy. Its tasks are described in

text: Article 30 of Directive 95/46/EC

text: and

text: Article 15 of Directive 2002/58/EC

text: . The secretariat is provided by Directorate C (Fundamental Rights and Union Citizenship) of the European Commission, Directorate General Justice, B-1049 Brussels, Belgium, Office No MO-59 02/013. Website: http://ec.europa.eu/newsroom/article29/news.cfm?item_type=1358&tpa_id=6936

text: INTERNAL BINDING NATURE

title: Recommendation on the Standard Application form for Approval of Processor Binding Corporate Rules for the Transfer of Personal Data

text: Standard Application for Approval of Binding Corporate Rules for Processors

text: PART 1: APPLICANT INFORMATION

text: 1. STRUCTURE AND CONTACT DETAILS OF THE GROUP OF UNDERTAKINGS OR GROUP OF ENTERPRISES ENGAGED IN A JOINT ECONOMIC ACTIVITY (THE GROUP)

text: Name of the Group and location of its headquarters (ultimate parent company): Does the Group have its headquarters in the EEA? Yes No

text: Name and location of the applicant: Identification number (if any): Legal nature of the applicant (corporation, partnership, etc.): Description of position of the applicant within the Group: (e.g. headquarters of the Group in the EEA, or, if the Group does not have its headquarters in the EEA, the member of the Group inside the EEA with delegated data protection responsibilities) Name and/or function of contact person (note: the contact person may change, you may indicate a function rather than the name of a specific person): Address: Country: Phone number: Fax: E-Mail: EEA Member States from which BCRs for Processors will be used:

text: 2. SHORT DESCRIPTION OF PROCESSING AND DATA FLOWS

text: Please, indicate the following: - Expected nature of the data covered by BCR, and in particular, if they apply to one category of data or to more than one category, types of data subjects concerned, (for instance human resources, customers,…), anticipated types of processing and its purposes

text: - Anticipated purposes of data transfers for processing activities

text: - Do the BCR only apply to transfers from the EEA, or do they apply to all transfers for processing activities between members of the Group?

text: - Please specify from which country most of the data are transferred outside the EEA for processing activities:

text: - Extent of the transfers within the Group that are covered by the BCR; including a description and contact details of any Group members in the EEA or outside EEA to which personal data may be transferred for processing activities

text: 3. DETERMINATION OF THE LEAD SUPERVISORY AUTHORITY (BCR LEAD)

text: Please explain which should be the BCR Lead, based on the following criteria: - Location of the Group’s EEA headquarters

text: - If the Group is not headquartered in the EEA, the location in the EEA of the Group entity with delegated data protection responsibilities

text: - The location of the company which is best placed (in terms of management function, administrative burden, etc.) to deal with the application and to enforce the binding corporate rules in the Group

text: - EEA Member States from which most of the transfers outside the EEA will take place

text: PART 2: BACKGROUND PAPER

text: 4. BINDING NATURE OF THE BINDING CORPORATE RULES (BCR) FOR PROCESSORS

text: Binding within the entities of the Group acting as internal subprocessors

text: How are the BCR for processors made binding upon the members of the Group?

text: Measures or rules that are legally binding on all members of the Group Contracts or intra-group agreements between the members of the Group Unilateral declarations or undertakings made or given by the parent company which are binding on the other members of the Group (that is only possible if the BCR member taking responsibility and liability is located in a Member State that recognizes Unilateral declarations or undertakings as binding and if this BCR member is legally able to bind the other members subject to BCRs); Other means (only if the Group demonstrates how the binding character of the BCRs is achieved), please specify

text: Please explain how the mechanisms you indicated above are legally binding on the members of the Group in the sense that they can be enforced by other members of the Group (esp. headquarters):

text: Does the internally binding effect of your BCR for Processors extend to the whole Group? (If some Group members should be exempted, specify how and why)

text: Please confirm that any use of subprocessors (internal) is only done after prior information to data controllers and with their prior written consent

text: Working Document setting up a table with the elements and principles to be found in Processor Binding Corporate Rules,

text: , adopted on 6 February 2018. See Section 1.1 and 1.2

text: WP 257

text: See Section 1.2 (i)

text: WP 257

text: Binding upon the employees

text: Your Group may take some or all of the following steps to ensure that the BCR for Processors are binding on employees, but there may be other steps. Please, give details below. -Individual and separate agreement/undertaking with sanctions - Work employment contract with sanctions

text: - Collective agreements (approved by workers committee/another body) with sanctions

text: - Employees must sign or attest to have read the BCR for Processors or related ethics guidelines in which the BCR for Processors are incorporated

text: - BCR for Processors have been incorporated in relevant company policies with sanctions

text: - Disciplinary sanctions for failing to comply with relevant company policies, including dismissal for violation

text: - Other means (but the group must properly explain how the BCRs are made binding on employees) Please provide a summary supported by extracts from policies and procedures or confidentiality agreements as appropriate to explain how the BCR for Processors are binding upon employees.

text: See Section 1.2 (ii)

text: EXTERNALLY BINDING NATURE

text: Binding upon external subprocessors processing the data

text: Please confirm that a written contract or other legal act under Union or Member State law is put in place with external subprocessors which states that adequate protection is provided according to Articles 28, 29, 32, 45, 46, 47 of the GDPR and which ensures that the external subprocessors will have to respect the same data protection obligations as are imposed on the Group members according to the Service Agreements concluded with data controllers and Sections 1.3, 1.4, 3 and 6 of

text: How do such contracts or other legal acts under Union or Member State law address the consequences of non compliance? Please specify the sanctions imposed on subprocessors for failure to comply

text: Please confirm that any use of subprocessors (external) is only done after prior informed specific or general written authorization of the data controller

text: Please confirm that subprocessors accept to submit their data processing facilities for audit, at the request of a data controller, of the processing activities relating to that controller . Please describe the system.

text: How are the rules binding externally for the benefit of individuals (third party beneficiary rights) or how do you intend to create such rights? For example you might have created some third party beneficiary rights in contracts or unilateral declarations .

text: Please provide a summary supported by extracts from the agreement signed with data controllers as appropriate to explain how the BCR for Processors are made binding towards data controllers

text: Please confirm that data controllers’ rights shall cover the judicial remedies and the right to receive compensation

text: See Section 6.1 (vii)

text: See Section 6.1 (vii)

text: See Section 2.3

text: WP 257

text: You must be fully aware of the fact that according to civil law of some jurisdictions (e.g. Italy or Spain) unilateral declarations or unilateral undertakings do not have a binding effect. In the absence of a specific legislative provision on bindingness of such declarations, only a contract with third party beneficiary clauses between the members of the Group may give proof of bindingness. See Section 1.4

text: WP 257

text: Legal claim or actions

text: Explain how you meet the obligations according to the requirements of Article 47.2.e, 77, 79, 82, as further specified in paragraph 1.3 of

text: Please confirm that the controller established on the territory of a Member State (e.g. EEA headquarters of the Group, the Group member of the Processor with delegated data protection responsibilities in the EEA or the EEA exporter processor (e.g., the EEA contracting party with the controller), has made appropriate arrangements to enable itself to remedy the acts and to pay compensation, for any damages suffered either by a data subject or a data controller, resulting from the breach, by any member of the Group or by any external subprocessor, of the BCR for Processors and explain how this is ensured.

text: Please confirm that the burden of proof with regard to an alleged breach of the rules caused either by a Group member or by an external subprocessor will rest with the member of the Group in the EU that have accepted to endorse liability for breaches caused by non EEA members of the group or by subprocessors, regardless of where the claim originates.

text: Easy access to BCR for Processors

text: Please confirm that your BCR for Processors are annexed to the Service Agreements signed with data controllers, or that reference to it is made with a possibility of electronic access:

text: Please confirm that your BCR for Processors are published on the website of the Group of processor in a way easily accessible to data subjects, or at least that a document is published and contains all the information as required in Section 1.8 of

text: WP 257

text: provides that the BCRs must grant rights to data subjects to enforce BCRs as third party beneficiaries against the processor either when the requirements at stake are specifically directed to processors in accordance with the GDPR or in case the data subject is not able to bring a claim against the data controller because the data controller has factually disappeared or ceased to exist in law or has become insolvent, unless any successor entity has assumed the entire legal obligations of the data controller by contract of by operation of law, in which case the data subject can enforce its rights against such entity. See Section 1.8

text: 5. EFFECTIVENESS

text: It is important to show how the BCR for Processors in place within your Group are brought to life in practice, in particular in non EEA countries where data will be transferred for processing activities on the basis of the BCR for Processors, as this will be significant in assessing the adequacy of the safeguards.

text: Training and awareness raising (employees)

text: - Special training programs

text: - Employees are tested on BCR for Processors and data protection

text: - BCR for Processors are communicated to all employees on paper or online

text: - Review and approval by senior officers of the company

text: - How are employees trained to identify the data protection implications of their work, i.e. to identify that the relevant privacy policies are applicable to their activities and to react accordingly? (This applies whether these employees are or not based in the EEA)

text: Internal complaint handling

text: Do the BCR for Processors contain an internal complaint handling system to (i) communicate claims or requests without delay to data controllers, and to (ii) handle complaints instead of a data controller when the latter has disappeared factually, has ceased to exist in law or became insolvent, or when it has been agreed with a data controller that the Group will handle claims and requests from data subjects?

text: Please describe the system for handling complaints:

text: See Section 2

text: See Section 2.1

text: See Section 2.2

text: Verification of compliance

text: What verification mechanisms do your Group have in place to audit each Group members' compliance with your BCR for Processors? (e.g., an audit programme, compliance programme, etc)? Please specify:

text: Please explain how your verification or compliance programme functions within the Group (e.g., information as to the recipients of any audit reports and their position within the structure of the Group).

text: Do the BCR for Processors provide for the use of: - Data Protection Officer? Choose by clicking here

text: - internal auditors? Choose by clicking here - external auditors? Choose by clicking here

text: - a combination of both internal and external auditors? Choose by clicking here - verification by an internal compliance department? Choose by clicking here

text: Do your BCR for Processors mention if the verification mechanisms are clearly set out in… - a document containing your data protection standards Choose by clicking here - other internal procedure documents and audits? Choose by clicking here

text: Network of data protection officers (DPO) or appropriate staff

text: Please confirm that a network of DPOs or appropriate staff (such as a network of privacy officers) is appointed with top management support to oversee and ensure compliance with the BCR for Processors:

text: Please explain how your network of DPOs or privacy officers functions: - Internal structure:

text: - Role and responsibilities:

text: See Section 2.3

text: WP 257

text: See Section 2.4

text: WP 257

text: 6. COOPERATION WITH SAs

text: Please, specify how your BCR for Processors deal with the issues of cooperation with SAs:

text: Do you confirm that you will permit the relevant SAs to audit your compliance? Do you confirm that the Group as a whole and each members of the Group will abide by the advice of the relevant Supervisory authorities relating to the interpretation and the application of your BCR for Processors?

text: 7. COOPERATION WITH DATA CONTROLLERS

text: Please specify how your BCR for Processors deal with the duty of cooperation with data controllers?

text: Do you confirm that you will submit your data processing facilities to data controller (or to an inspection body composed of independent members, selected by the data controller) which requested it for audits of the processing activities relating to them?

text: See Section 3.1

text: See Section 3.2

text: WP 257

text: 8. DESCRIPTION OF PROCESSING AND DATA FLOWS

text: Please indicate the following: - Expected nature of the data covered by the BCR for Processors, e.g. HR data, and in particular, if they apply to one category of data or to more than one category - What is the nature of the personal data being transferred for processing activities? - In broad terms what is the extent of the flow of data?

text: - Purposes for which the data covered by the BCR for Processors are transferred to third countries and type of processing - Extent of the transfers within the Group that are covered by the BCR for Processors, including a description and contact details of any Group members in the EEA or outside the EEA to which personal data may be transferred for processing activities

text: Do the BCR only apply to transfers for processing activities from the EEA, or do they apply to all transfers for processing activities between members of the Group? Please specify:

text: See Section 4.1

text: See Section 5.1

text: Please confirm and explain how your BCR for Processors allow for informing other parts of the Group, the concerned Supervisory Authorities via the competent SA under Article 64 (i.e. the BCR Lead) and data controllers of any changes to the BCR for Processors and/or the list of BCR members (summary): Please confirm that you have put in place a system to record any changes to your BCR for Processors. Please confirm that where a change affects the processing conditions, data controllers are informed in a timely fashion that data controllers have the possibility to object to the changes or terminate the contract before the modification is made

text: 9. DATA PROTECTION SAFEGUARDS

text: Please, specify with reference to your BCR for Processors how and where the following issues are addressed with supporting documentation where appropriate: - Transparency, fairness and lawfulness (e.g., general duty to help and assist the controller) - Purpose limitation (e.g., duty to process personal data only on behalf of data controllers and in compliance with their instructions and to return the data to the data controller at the end of the contract) - Data quality (e.g., general duty to help and assist the controller) - Security - Data subjects’ rights (e.g., general duty to help and assist the controller) - Subprocessing within the Group - Restrictions on onward transfers to external subprocessors - Other (e.g. protection of children, etc.) See Section 6 of

text: 10. ACCOUNTABILITY AND OTHER TOOLS

text: -Please confirm and specify how BCR members will make available to the controller all information necessary to demonstrate compliance with their obligations as provided by Article 28-3-h (including through audits, and information of the controller if an instruction infringes the GDPR or other Union or Member State data protection provisions)

text: -Please confirm that the BCR members will maintain a record of all categories of processing activities carried out on behalf of each controller as provided by Article 30-2 GDPR

text: -Please specify how BCR members will assist the controller in implementing appropriate technical and organisational measures to comply with data protection principles and facilitate compliance with requirements set out by BCRs in practice (e.g. data protection by design, data protection by default)

text: See Section 6.1.2

text: ANNEX 1: COPY OF THE FORMAL BINDING CORPORATE RULES FOR PROCESSORS

text: Please attach a copy of your BCR for Processors. Note that this does not include any ancillary documentation that you would like to submit (e.g. specific privacy policies and rules).


text: This Working Party was set up under

text: Article 29 of Directive 95/46/EC

text: . It is an independent European advisory body on data protection and privacy. Its tasks are described in

text: Article 30 of Directive 95/46/EC

text: and

text: Article 15 of Directive 2002/58/EC

text: . The secretariat is provided by Directorate C (Fundamental Rights and Union Citizenship) of the European Commission, Directorate General Justice, B-1049 Brussels, Belgium, Office No MO-59 02/013. Website: http://ec.europa.eu/newsroom/article29/news.cfm?item_type=1358&tpa_id=6936

text: The WP29 considers that a processing activity can only be considered as “occasional” if it is not carried out regularly, and occurs outside the regular course of business or activity of the controller or processor. See WP29 Guidelines on Article 49 of Regulation 2016/679 (

identifier: Artikel 29-gruppens ställningstagande om artikel 30.5

title: Position Paper on the derogations from the obligation to maintain records of processing activities pursuant to Article 30(5) GDPR

text: The Working Party 29 has examined the obligation, under Article 30 of the GDPR, for controllers and processors to maintain a record of processing activities. This paper sets out the WP29’s position on the derogation from this obligation. Recital 13 of the GDPR says:

text: ‘To take account of the specific situation of micro, small and medium-sized enterprises, this Regulation includes a derogation for organisations with fewer than 250 employees with regard to record-keeping’.

text: Article 30(5) gives effect to Recital 13. It says that the obligation to keep a record of processing activities does not apply ‘to an enterprise or an organisation employing fewer than 250 persons unless the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data as referred to in Article 9(1) or personal data relating to criminal convictions and offences referred

text: to in Article 10.’

text: Some clarifications on the interpretation of this provision appear necessary, as shown by the high number of requests coming from companies and received in the last few months by national Supervisory Authorities.

text: · Processing that is likely to result in a risk to the rights and freedoms of data subjects.

text: · Processing that is not occasional.

text: · Processing that includes special categories of data or personal data relating to criminal convictions and offences.

text: The WP29 underlines that the wording of Article 30(5) is clear in providing that the three types of processing to which the derogation does not apply are alternative (“or”) and the occurrence of any one of them alone triggers the obligation to maintain the record of processing activities.

text: Therefore, although endowed with less than 250 employees, data controllers or processors who find themselves in the position of either carrying out processing likely to result in a risk (not just a high risk) to the rights of the data subjects, or processing personal data on a non-occasional basis, or processing special categories of data under Article 9(1) or data relating to criminal convictions under Article 10 are obliged to maintain the record of processing activities. However, such organisations need only maintain records of processing activities for the types of processing mentioned by Article 30(5). For example, a small organisation is likely to regularly process data regarding its employees. As a result, such processing cannot be considered “occasional” and must therefore be included in the record of processing activities. Other processing activities which are in fact “occasional”, however, do not need to be included in the record of processing activities, provided they are unlikely to result in a risk to the right and freedoms of data subjects and do not involve special categories of data or personal data relating to criminal convictions and offences. The WP29 highlights that the record of processing activities is a very useful means to support an analysis of the implications of any processing whether existing or planned. The record facilitates the factual assessment of the risk of the processing activities performed by a controller or processor on individuals’ rights, and the identification and implementation of appropriate security measures to safeguard personal data – both key components of the principle of accountability contained in the GDPR. For many micro, small and medium-sized organisations, maintaining a record of processing activities is unlikely to constitute a particularly heavy burden. However, the WP29 recognises that Article 30 represents a new administrative requirement for controllers and processors, and therefore encourages national Supervisory Authorities to support SMEs by providing tools to facilitate the set up and management of records of processing activities. For example, a Supervisory Authority might make available on its website a simplified model that can be used by SMEs to keep records of processing activities not covered by the derogation in Article 30(5).