[ad_1]
On 19 December 2023, the Info Commissioner’s Workplace (ICO) revealed its up to date information on UK Binding Company Guidelines (BCRs), introducing the UK BCR Addendum for controllers and processors (the Addendum). It would allow organisations with current EU BCRs to incorporate knowledge transfers from the UK.
Background
Underneath the UK Normal Information Safety Regulation (UK GDPR), the switch of non-public knowledge to a third-country recipient is restricted, given the dangers offered by private knowledge being processed exterior the UK. Restricted transfers might solely happen beneath sure circumstances, e.g., the place there may be an adequacy choice, or there are applicable contractual safeguards, corresponding to customary contractual clauses (SCCs) or binding company guidelines (BCRs), have been put in place.
Following Brexit, EU BCR holders who wished to depend on this mechanism to impact transfers of non-public knowledge from the UK had been required to draft bespoke UK BCR documentation, which resulted in intensive drafting work, and prolonged ICO approval intervals. It’s nonetheless potential for holders of EU and UK BCRs to create and preserve two separate variations of their BCRs, in keeping with the Steerage.
Who can use the Addendum?
The BCRs are designed to be used for knowledge transfers by multinational companies or enterprises engaged in a joint financial exercise (corresponding to a three way partnership). Organisations with an accepted EU BCR at the moment are in a position to create and undergo the ICO a UK BCR Addendum to its current EU BCR, which extends the scope of the accepted EU BCR to incorporate UK-restricted transfers and satisfies the BCR necessities beneath the UK GDPR.
The Addendum software
The Steerage signifies that the UK BCR software consists of the next paperwork to be submitted to the ICO:
Your full UK BCR Addendum;
Your full EU BCR;
Your EU BCR approval; and
A UK BCR Abstract doc, which supplies info to the info topics beneath the UK BCR.
Organisations might use the addendum (i) as a typical kind with out modifications; or (ii) as a template which can be amended and to which various clauses could also be instated to fulfill specific enterprise wants. As well as, the Steerage clarifies {that a} controller and processor require separate purposes.
Key issues
Whereas the up to date UK BCR Addendum is anticipated to expedite the ICO’s assessment course of, the approval timeline might differ relying on how intently the applying aligns with the usual or bespoke template type of the Addendum. It’s suggested that organisations utilizing the Addendum as a template spotlight and supply a rationale for his or her amendments.
Individually, the Steerage makes clear that adjustments to an organisation’s EU BCR will instantly affect its UK BCR beneath the phrases of the Addendum. Accordingly, in instances of suspension, withdrawal or revocation of the EU BCR, the UK BCR will likely be equally affected, and one other worldwide switch mechanism have to be adopted.
[ad_2]
Source link
