GDPR Article 47: Obligations, Deadlines & Penalties

The competent supervisory authority shall approve binding corporate rules in accordance with the consistency mechanism set out in Article 63, provided they meet specific criteria. Regulation (EU) 2016/679, Article 47, Article 47

Binding corporate rules must be legally binding and apply to and be enforced by every member concerned of the group of undertakings or enterprises engaged in a joint economic activity, including their employees. Regulation (EU) 2016/679, Article 47, Article 47

Binding corporate rules must expressly confer enforceable rights on data subjects with regard to the processing of their personal data. Regulation (EU) 2016/679, Article 47, Article 47

Binding corporate rules must specify the structure and contact details of the group of undertakings or enterprises and of each of its members. Regulation (EU) 2016/679, Article 47, Article 47

Binding corporate rules must specify the data transfers or set of transfers, including categories of personal data, type of processing, purposes, data subjects affected, and identification of third countries. Regulation (EU) 2016/679, Article 47, Article 47

Binding corporate rules must specify their legally binding nature, both internally and externally. Regulation (EU) 2016/679, Article 47, Article 47

Binding corporate rules must specify the application of general data protection principles, including purpose limitation, data minimisation, limited storage periods, data quality, data protection by design and by default, legal basis, special categories, security measures, and onward transfer requirements. Regulation (EU) 2016/679, Article 47, Article 47

Binding corporate rules must specify the rights of data subjects regarding processing and the means to exercise those rights, including rights against automated decision-making, lodging complaints, and obtaining redress or compensation. Regulation (EU) 2016/679, Article 47, Article 47

The controller or processor established in the Union must accept liability for any breaches of the binding corporate rules by any member concerned not established in the Union, unless it proves that member is not responsible for the event giving rise to the damage. Regulation (EU) 2016/679, Article 47, Article 47

Binding corporate rules must specify how information on the rules, particularly provisions on principles, rights, and liability, is provided to data subjects in addition to Articles 13 and 14. Regulation (EU) 2016/679, Article 47, Article 47

Binding corporate rules must specify the tasks of any data protection officer or other person/entity in charge of monitoring compliance, training, and complaint-handling within the group. Regulation (EU) 2016/679, Article 47, Article 47

Binding corporate rules must specify the complaint procedures. Regulation (EU) 2016/679, Article 47, Article 47

Binding corporate rules must specify mechanisms for ensuring verification of compliance, including data protection audits and methods for corrective actions, with results communicated to the monitoring entity and board and available to the supervisory authority. Regulation (EU) 2016/679, Article 47, Article 47

Binding corporate rules must specify mechanisms for reporting and recording changes to the rules and reporting those changes to the supervisory authority. Regulation (EU) 2016/679, Article 47, Article 47

Binding corporate rules must specify the cooperation mechanism with the supervisory authority to ensure compliance, including making available the results of verifications of measures. Regulation (EU) 2016/679, Article 47, Article 47

Binding corporate rules must specify mechanisms for reporting to the competent supervisory authority any legal requirements in a third country likely to have a substantial adverse effect on the guarantees provided by the rules. Regulation (EU) 2016/679, Article 47, Article 47

Binding corporate rules must specify the appropriate data protection training to personnel having permanent or regular access to personal data. Regulation (EU) 2016/679, Article 47, Article 47