Recital 110
General Data Protection Regulation · UE 2016/679
| (110) | A group of undertakings, or a group of enterprises engaged in a joint economic activity, should be able to make use of approved binding corporate rules for its international transfers from the Union to organisations within the same group of undertakings, or group of enterprises engaged in a joint economic activity, provided that such corporate rules include all essential principles and enforceable rights to ensure appropriate safeguards for transfers or categories of transfers of personal data. |
In Luxembourg, the CNPD frequently acts as lead supervisory authority for BCR of financial and industrial groups headquartered or holding-based in the Grand Duchy (private banks, funds, e-commerce groups, telcos). The law of 1 August 2018 organising the CNPD confirms its competence to handle Article 47 BCR files and cooperate with other concerned authorities through the EDPB consistency mechanism. The CNPD has issued practical guidance on the approval procedure and favours a structured preliminary dialogue before any formal filing.
Luxgap practice: for Luxembourg groups, we recommend a pre-filing meeting with the CNPD before any official submission, to align expectations on the TIA and non-EU subsidiaries. Our team prepares the file and supports the instruction phase up to the EDPB opinion.
