Binding Corporate Rules (BCR)

In order for the BCR to be approved, the respective companies must develop appropriate measures to ensure that the requirements of the European Commission are met. These measures are then reviewed by all European supervisory authorities in an elaborate process and approved if there are no concerns.

In addition to the Controller BCRs, which contain the requirements for the transfer of personal data processed under the company's own responsibility, the European Commission has also developed the Processor BCRs, which apply to the transfer of personal data processed on behalf of third parties.

Giesecke+Devrient is the first company in Germany to have undergone the recognition procedure with the European supervisory authorities for both Controller BCR and Processor BCR.

To obtain approval from the European supervisory authorities, the companies in question must have a very high level of data privacy.

BCRs are therefore also referred to as Gold Standard, as approval is associated with the confirmation that the level of data privacy in the company meets the highest requirements.

• create a consistent level of data privacy on the basis of the General Data Protection Regulation (GDPR)
• are among the appropriate guarantees under the GDPR and enable data transfers to countries outside Europe that do not have an equivalent level of data protection
• avoid the necessity of regulatory approvals or additional contracts (e.g. standard data protection clauses/EU model clauses)
• reduce time and costs
• offer high flexibility and the basis for an effective "follow the sun" service
• include enforceable rights and effective remedies for data subjects
• include internal audit and control mechanisms
• have been audited and officially approved by the relevant European supervisory authorities

The recognition of BCR of a company is published by the European Commission on the following website of the European Data Protection Board (EDPB): https://edpb.europa.eu/our-work-tools/accountability-tools/bcr_en?page=1

Companies that have already received approval of their BCR before the introduction of the GDPR (such as G+D) are included in the following list: https://edpb.europa.eu/system/files/2023-03/EDPB_Information_Pre-GDPR_BCRs_Overview_en.pdf

To confirm compliance with the BCR, G+D conducts annual reviews through internal audits, which are reviewed on a regular cycle by an external body.

For inquiries and feedback, as well as for reporting potential noncompliances, our whistleblowing tool can be used.

You can find additional information and documents on this website in the Data Privacy Documents section.