Albania Law No. 124/2024 on Personal Data Protection 42: Article 42: binding company rules approved by the Commissioner

A group of companies, or of enterprises in a joint economic activity, may transfer under binding company rules approved by the Commissioner if the rules are binding on every member and its employees, expressly confer rights on data subjects, and specify at least the group structure and contacts; the transfers, data categories, processing, purposes, data subjects and destinations; internal and external binding force; application of the Article 6 principles; data subject rights and how to exercise them, including against automated decisions, complaint to the Commissioner and the courts, rectification and compensation; acceptance by the Albanian member of liability for breaches by non-Albanian members unless it proves they are not responsible; compliance mechanisms (DPOs, training, audits, breach reporting); change reporting to the Commissioner; and cooperation with the Commissioner, including reporting foreign legal requirements that could seriously undermine the safeguards.