The Binding Corporate Rules Processor and Controller Policies establish the approach taken by 91������ý Business Group (“91������ý”) to the protection and management of personal information, in accordance with the GDPR and the UK Data Protection Act 2018, when it is transferred from the EU or UK to a third country.

The lead supervisory authority for 91������ý's EU Binding Corporate Rules is the Irish Data Protection Commission.  The UK Information Commissioner's Office is the supervisory authority for 91������ý's UK Binding Corporate Rules.

Guidelines from the European Data Protection Board (EDPB) require companies to assess whether transfers of personal data out of the EU are adequately protected in accordance with the EU General Data Protection Regulation and to put in place such additional safeguards they consider necessary. Since then, the US administration has made certain changes to rules around US intelligence-gathering, primarily to support the EU/US Privacy Framework, and as a result international transfers to the US under 91������ý’s Binding Corporate Rules and other adequacy mechanisms now benefit from those safeguards, which are contained in Executive Order 14086.

Following the EDPB guidelines, 91������ý has reviewed its Binding Corporate Rules (BCRs) and the transfers of personal data that are made under the protection of the BCRs. 91������ý evaluates whether additional safeguards are required to protect the personal data when it is transferred out of the EU and UK under the BCRs by assessing the legal regimes in the countries to which it transfers personal data and by completing transfer impact assessments to quantify the risks of such transfers. Appropriate steps, such as additional safeguards set out by the EDPB or the UK Information Commissioner’s Office (ICO), will be taken to minimize any identified risks.

91������ý’s EU BCRs are reviewed annually by the Irish Data Protection Commission (DPC) as part of the established review cycle. 91������ý has acted on guidance from the DPC on changes to 91������ý's EU BCRs to take account of the EDPB guidelines and the DPC has approved 91������ý's updated EU BCRs, available below. In its role as the lead supervisory authority for 91������ý’s EU BCRs, the DPC acts on behalf of the EU data protection authorities.

91������ý has obtained approval from the ICO to use UK Binding Corporate Rules for Controllers and Binding Corporate Rules for Processors, which are formed using the UK Addendum to the EU Binding Corporate Rules.  The UK Binding Corporate Rules ensure the adequate protection of personal data when it is transferred out of the UK.

91������ý is satisfied that the BCRs meet the current requirements.

September 2024

The Binding Corporate Rules Processor Policies (“Policies”) establish the approach taken by 91������ý to the protection and management of personal information¹ globally when 91������ý group members ("Group Members") process² that information on behalf of a third party or another Group Member, and where such personal information originates from Europe (including the EEA and Switzerland) or the UK, except where your contract states otherwise.

The Policies are an appropriate safeguard, or adequacy mechanism, as set out in GDPR Article 46. They apply to all personal information originating from Europe and the UK when it is collected and processed as part of the regular business activities of 91������ý in the course of providing services to a third party or to another Group Member (equally referred to as the "customer" in the Policies). Group Members and their employees must comply with and respect the Policies when collecting and processing personal information in their capacity as service providers.

91������ý has adopted UK Binding Corporate Rules formed using the UK Addendum to EU Binding Corporate Rules, and therefore transfers of UK-originating personal data are protected to the same standards as set out in Policies.The Policies do not replace any specific data protection requirements that might apply to a business area or function.

Download the UK Binding Corporate Rules Processor Summary (PDF)

Download the Full EU Binding Corporate Rules Processor Policy (PDF)

¹ Personal information means any information relating to an identified or identifiable natural person in line with the definition of “personal data” in EU Regulation 2016/679 General Data Protection Regulation and the UK Data Protection Act 2018.

² For the purposes of this Policy reference to the 'processing' of personal information is as defined in EU Regulation 2016/679 GDPR and the UK Data Protection Act 2018, and references to 'collection' 'use' and 'transfer' are all elements of the definition of processing.

The Binding Corporate Rules Controller Policies (“Policies”) establish the approach taken by 91������ý to the protection and management of personal information¹ globally by 91������ý group members ("Group Members") when processing² that information for their own purposes and where such personal information originates from Europe (including the EEA and Switzerland) or the UK.

The Policies are an appropriate safeguard, or adequacy mechanism, as set out in GDPR Article 46. They apply to all personal information that is processed in Europe and the UK (which means that it will also include personal information collected by Group Members outside Europe and sent to Group Members in Europe and the UK ) which is then transferred from Group Members within Europe and the UK to Group Members outside Europe. Group Members and their employees must comply with and respect the Policies when collecting and processing  personal information for 91������ý’s own purposes. The Policies apply to all such personal information processed by 91������ý, for example (i) in the course of customer and supplier management, and (ii) which relates to employees and contractors.

91������ý has adopted UK Binding Corporate Rules formed using the UK Addendum to EU Binding Corporate Rules, and therefore transfers of UK-originating personal data are protected to the same standards as set out in Policies.  The Policies do not replace any specific data protection requirements that might apply to a business area or function.

Download the full EU Binding Corporate Rules Controller Policy (PDF)

Download the UK Binding Corporate Rules Controller Summary (PDF)

1 Personal information means any information relating to an identified or identifiable natural person in line with the definition of “personal data” in EU regulation 2016/679 and the UK Data Protection Act 2018.

2 For the purposes of this Policy reference to the 'processing' of personal information is as defined in EU Regulation 2016/279 and the UK Data Protection Act 2018, and references to 'collection' 'use' and 'transfer' are all elements of the definition of processing.

Below is a list of companies which are participants of 91������ý’s EU Binding Corporate Rules and 91������ý's UK Binding Corporate Rules, including contact details for those companies. Additional information is available in the International Privacy Centre.

The email address for all participants is emeadataprotection@intl.verizon.com