Binding Corporate Rules

The Binding Corporate Rules Processor and Controller Policies establish the approach taken by Verizon Business Group (previously referred to as Verizon Enterprise Solutions) (“Verizon”) in accordance with the GDPR and the UK Data Protection Act 2018.

The lead supervisory authority for Verizon's EU Binding Corporate Rules policies is the Irish Data Protection Commission.  The UK Information Commissioner's Office is the supervisory authority for Verizon's UK Binding Corporate Rules policies.

View BCR FAQs

The CJEU judgment in the “Schrems II” case (July 2020)  required companies to assess whether transfers of personal data out of the EU are adequately protected in accordance with the EU General Data Protection Regulation and to put in place such additional safeguards they consider necessary. Since then, the US administration has made certain changes to rules around US intelligence-gathering, primarily in support of the EU/US Privacy Framework, and as a result international transfers to the US under Verizon’s Binding Corporate Rules and other adequacy mechanisms now benefit from those safeguards, which are contained in Executive Order 14086.

In response to these developments, Verizon has undertaken a review of its Binding Corporate Rules (BCRs) and the transfers of personal data that are made under the protection of the BCRs. Verizon evaluates whether additional safeguards are required to protect the personal data when it is transferred out of the EU and UK under the BCRs by assessing the legal regimes in the countries to which it transfers personal data and by completing transfer impact assessments to quantify the risks of such transfers. Appropriate steps, such as additional safeguards set out by the European Data Protection Board (EDPB) or ICO, will be taken to minimize any identified risks.

Verizon’s EU BCRs are reviewed annually by the Irish Data Protection Commission (DPC) as part of the established review cycle. Verizon has acted on guidance from the DPC on changes to Verizon's EU BCR's to take account of the Schrems II ruling and DPC has approved the 2023 update to Verizon's EU BCRs, available below. In its role as the lead supervisory authority for Verizon’s EU BCRs, the DPC acts on behalf of the EU data protection authorities.

Verizon has submitted the 2023 review of Verizon's UK BCRs to the ICO, taking into account the guidelines relating to Brexit and Schrems II which were issued by the ICO in July 2022. Existing provisions in the UK BCRs state that "Verizon will ensure that any transfers of customer personal information under this Policy that it makes to a public authority are not massive, disproportionate or indiscriminate in a manner that would go beyond what is necessary in a democratic society.'' which addresses the core of the issue raised in the CJEU ruling. Verizon is satisfied that the BCRs meet the current requirements.

September 2023

The Binding Corporate Rules Processor Policies (“Policies”) establish the approach taken by Verizon to the protection and management of personal information¹ globally by Verizon group members ("Group Members") when processing² that information on behalf of a third party or another Group Member, and where such personal information originates from Europe or the UK except where your contract states otherwise.

The Policies apply to all personal information originating from Europe and the UK when collected and processed as part of the regular business activities of Verizon in the course of providing services to a third party orto another Group Member (equally referred to as the "customer" in the Policies) Group Members and their employees must comply with and respect the Policies when collecting and processing personal information in their capacity as service providers. The EU Policies relate to personal data originating in the EU and the UK Policies relate to personal data originating in the UK.

The Policies do not replace any specific data protection requirements that might apply to a business area or function.

Download the Full UK Binding Corporate Rules Processor Policy

Download the Full EU Binding Corporate Rules Processor Policy

Download the updated UK Binding Corporate Rules Processor Policy as notified to the ICO, June 2023

¹ Personal information means any information relating to an identified or identifiable natural person in line with the definition of “personal data” in EU Directive 95/46/EC.

² For the purposes of this Policy reference to the 'processing' of personal information is as defined in EU Regulation 2016/679 GDPR and the UK Data Protection Act 2018, and references to 'collection' 'use' and 'transfer' are all elements of the definition of processing.

The Binding Corporate Rules Controller Policies (“Policy”) establish the approach taken by Verizon Business Group (previously referred to as Verizon Enterprise Solutions) ('Verizon') to the protection and management of personal information¹ globally by Verizon group members ("GroupMembers") when processing² that information for their own purposes.

The Policies apply to all personal information that is processed in Europe and the UK (which means that it will also include personal information collected by Group Members outside Europe and sent to Group Members in Europe and the UK ) which is then transferred from Group Members within Europe and the UK to Group Members outside Europe.³ The EU Policies relate to personal data originating in the EU and the UK Policies relate to personal data originating in the UK.

The Policies apply to all such personal information processed by Verizon; (i) in the course of customer and supplier management, and (ii) which relates to employees and contractors.

Group Members must comply with and respect the Policies when collecting and using personal information for their own purposes.

The Policies do not replace any specific data protection requirements that might apply to a business area or function.

Download the full UK Binding Corporate Rules Controller Policy

Download the full EU Binding Corporate Rules Controller Policy

Download the updated UK Binding Corporate Rules Controller Policy as notified to the ICO, June 2023

¹ Personal information means any information relating to an identified or identifiable natural person in line with the definition of “personal data” in EU regulation 2016/679 and the UK Data Protection Act 2018.

² For the purposes of this Policy reference to the 'processing' of personal information is as defined in EU Regulation 2016/279 and the UK Data Protection Act 2018, and references to 'collection' 'use' and 'transfer' are all elements of the definition of processing.

³ For the purpose of this Policy reference to Europe means the EEA and Switzerland.

Below is a list of companies which are participants of Verizon’s EU Binding Corporate Rules and Verizon's UK Binding Corporate Rules, including contacts details for those companies. Additional information is available in the International Privacy Centre.

The email address for all participants is emeadataprotection@intl.verizon.com