Article 47. Binding Corporate Rules 1. The competent supervisory authority shall approve binding

corporate rules in accordance with the consistency mechanism set out in Article 63, provided that they

A, are legally binding and apply to and are enforced by every member concerned of the

group of undertakings or group of enterprises engaged in a joint economic activity, including

their employees. B, expressly confer enforceable rights on data subjects with regard to the

processing of their personal data, and C, fulfill the requirements laid down in paragraph 2.

2. The binding corporate rules referred to in paragraph 1 shall specify at least. A, the structure

and contact details of the group of undertakings, or group of enterprises engaged in a joint

economic activity and of each of its members. B, the data transfers or group of enterprises engaged in a joint economic activity and of each of its members.

B, the data transfers or set of transfers, including the categories of personal data,

the type of processing and its purposes, the type of data subjects affected and the identification

of the third country or countries in question. C, their legally binding nature, both internally and externally.

D, the application of the general data protection principles, in particular purpose limitation,

data minimization, limited storage periods, data quality, data protection by design and by default,

legal basis for processing, processing

of special categories of personal data, measures to ensure data security, and the requirements

in respect of onward transfers to bodies not bound by the binding corporate rules.

E, the rights of data subjects in regard to processing and the means to exercise those rights,

including the right not to be subject to decisions based solely on automated processing, including profiling in accordance

with Article 22, the right to lodge a complaint with the competent supervisory authority and

before the competent courts of the member states in accordance with Article 79, and to obtain

redress and, where appropriate, compensation for a breach of the member states in accordance with Article 79, and to obtain redress and, where appropriate,

...