Final EDPB Recommendations 1/2026 on processor binding corporate rules (BCR-P)

What it is about

After a public consultation (19 January to 2 March 2026, 11 responses) the EDPB adopted on 10 November 2026 the final version of its recommendations on processor binding corporate rules (BCR-P, Article 47). With BCR-P a group acting as a processor transfers personal data to its own group entities outside the EEA. The recommendations provide the standard application form and the required content, and replace the former Article 29 Working Party documents WP257 rev.01 and WP265. Alongside the BCR-P, a processing agreement with the customer remains necessary that meets Article 28(3) and refers to the BCR-P. New compared with the consultation version: the group only has to provide internal audit results at the customer's request, and the customer can always obtain the group's transfer impact assessment (TIA) and use it as the basis for its own assessment.

What this means in practice

If your group has BCR-P or is applying for them, you must update them. Existing holders do so in their 2028 annual update; this generally does not require a new approval. New and ongoing applications must meet the recommendations now; only applications that already have a consolidated draft and receive an EDPB opinion by 30 June 2027 may wait until the 2028 update. If you are a customer of such a group, ask for the TIA and, where needed, for the audit results. BCR-P are not suitable for a direct transfer from an external controller to a group entity outside Europe; that requires another Article 46 tool.

The GDPR articles concerned

• Article 28: Processor
• Article 46: Transfers subject to appropriate safeguards
• Article 47: Binding corporate rules