(20)

‘binding corporate rules’ means personal data protection policies which are adhered to by a controller or processor established on the territory of a Member State for transfers or a set of transfers of personal data to a controller or processor in one or more third countries within a group of undertakings, or group of enterprises engaged in a joint economic activity;

← art_4__point_19__text_1 · All articles · art_4__point_20__text_1 →

Source: EUR-Lex (Cellar) · retrieved 2026-09-25 · Text as adopted (Official Journal); later amendments are not incorporated in this text.