Binding Corporate Rules (BCR - kötelező szervezeti szabályozás) are fast becoming the most practical tool for data transfers within company groups. Most importantly, companies using BCR do not need to obtain separate approval for each personal data transfer within their organisation. The use of BCR also reduces administrative costs and strengthens the harmonisation of the internal data processing practices. In addition, BCR is the most future proof tool for intra-group data transfers, as it can be more flexibly adopted to the day-to day operation than EU Model Clauses, and the potentially unsafe Safe Harbor scheme. The upcoming new EU general data protection regulation also expressly accepts BCR.

In practice, BCR is a cross-border internal data protection policy, adopted by company groups who carry out business in more countries but at least in one European Economic Area (EEA) country. It is binding and enforceable for all members of the group, irrespective of their seat, and for their employees.

At last, as of 1 October 2015, the Hungarian Data Protection Act officially accepts Binding Corporate Rules as adequate protection in case of data transfers outside the EEA. Now this is endorsed by the new guidelines by NAIH, Hungary’s Authority for Data Protection and Freedom of Information, which provide detailed procedural rules for the introduction of BCRs in Hungary. The fee for the NAIH approval of a BCR is HUF 266,000. (approx. EUR 900).

On the basis of the amended legislation, it is advisable for Hungarian companies operating outside the EEA to consider the preparation of their own BCR. Companies using BCR which is already approved by another European data protection authority or authorities prior to 1 October 2015 should also request for the approval of the NAIH, in order to have their BCR recognised in Hungary too.

Laws:

Act CXII of 2011 on the Right of Self-Determination in Respect of Information and the Freedom of Information (“Data Protection Act”)

Decree No. 20/2015. (VIII. 31.) IM of the Ministry of Justice on the Administrative Fee for BCR Approval

NAIH’s explanatory note on BCRs