Binding Corporate Rules

Binding corporate rules (BCR) are one of the appropriate safeguards listed in Article 9 of the KVKK for cross-border data transfers. They allow companies within a group of undertakings engaged in a joint economic activity to govern their intra-group transfers to different countries through a single set of rules.

Who Are They For?

Binding corporate rules are designed for multinationals operating in many countries with a constant flow of data between group companies. Instead of signing separate standard contractual clauses for each pair of group companies, a single framework is created for the whole group. Transfers to suppliers or customers outside the group are not covered.

Board Approval

To be used under the KVKK, binding corporate rules must be approved by the Personal Data Protection Board. The application is made under the procedure set by the Board and should contain the elements described in the Authority’s supporting documents. The rules generally cover:

• The structure of the group and the list of companies bound by the rules,
• The categories of data transferred, the purposes of transfer and the recipient countries,
• How the general principles of the KVKK and data subject rights will be applied within the group,
• Assurance that the rules are binding on all group companies and employees,
• A complaints mechanism, training and an internal audit programme,
• The legal remedies available to data subjects in Turkey in case of breach of the rules.

Assessment

Preparing binding corporate rules and obtaining approval takes much longer and costs more than standard contractual clauses. On the other hand, once approved, new intra-group transfers do not require a separate contract and notification each time. The decision should therefore be based on the size of the group, the number of countries and the intensity of data flows.