A colleague calls the company’s ordinary processor Data Processing Agreement its “BCRs” for US transfers. What correction is needed?
Select an answer to reveal the explanation.
Short Explanation
A normal vendor DPA is a workhorse contract; BCRs are a specialised, approved rulebook for moving data inside a corporate group. Mixing up the labels is like calling a city bus pass an airline ticket. For third-country group transfers, you need the real BCR pathway—or another Chapter V tool—not just a renamed DPA.
Full Explanation
Binding Corporate Rules are defined transfer safeguards for corporate groups, subject to substantive content requirements and supervisory approval. A standard Article 28 processor agreement addresses processor obligations but is not by itself a BCR and does not automatically authorise Chapter V transfers. BCRs are also distinct from SCCs, even though both can serve as Article 46 tools in different contexts.