Binding corporate rules must be approved by the competent supervisory authority under the consistency mechanism, must be legally binding on and enforced by every member of the group including its employees, and must expressly confer enforceable rights on data subjects. They must specify at least the structure and contact details of the group and each member, the transfers and data covered, their legally binding nature internally and externally, the application of the general data protection principles, the rights of data subjects and the means to exercise them, the acceptance by the Union established member of liability for breaches by members outside the Union, how information about the rules is provided to data subjects, the tasks of the data protection officer or other monitoring role, the complaint procedures, the verification mechanisms including data protection audits and corrective action, the mechanisms for reporting and recording changes to the rules and reporting them to the authority, the cooperation mechanism with the supervisory authority, the mechanism for reporting third country legal requirements likely to have a substantial adverse effect on the guarantees given, and appropriate data protection training for personnel with permanent or regular access to personal data.
GDPR GDPR-Art.47 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of GDPR your existing evidence covers. Hold ISO 27701:2019 and 21 of 40 GDPR controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the ISO 27701:2019 pair alone.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.