A colleague calls the company’s ordinary processor Data Processing Agreement its “BCRs” for US transfers. What correction is needed?
Select an answer to reveal the explanation.
Short Explanation
A normal vendor DPA is a workhorse contract; BCRs are a specialised, approved rulebook for moving data inside a corporate group. Mixing up the labels is like calling a city bus pass an airline ticket. For third-country group transfers, you need the real BCR pathway—or another Chapter V tool—not just a renamed DPA.
Full Explanation
Binding Corporate Rules are a specific Article 46 transfer mechanism for corporate groups, approved through supervisory cooperation, with enforceable data-subject rights and internal binding force. An ordinary processor Data Processing Agreement under Article 28 is not “BCRs,” even if lengthy or intra-group in flavour. Mislabelling confuses procurement and exam candidates alike and can leave US transfers without a real Chapter V safeguard. Civic suppliers and private companies must use correct instrument names so accountability files stay coherent.
Page length does not transform a DPA into BCRs. BCRs are not identical to SCCs; SCCs are Commission clauses for relationships, while BCRs are approved group rules. Supervisory authorities do not treat all intra-group emails as approved BCRs.
Exam caveat: you may need both an Article 28 DPA (for processor processing) and a transfer tool (SCCs, BCRs, adequacy) when the processor is outside the EEA. One document rarely does every job.
Operational check: rename internal references that call DPAs “BCRs,” verify whether approved BCRs actually exist for the group, and if not, execute appropriate SCCs or wait for BCR approval before relying on that label in notices or audits.