Exam CIPP-US topic 1 question 159 discussion

By submitting to the ICO a new application for the UK BCRs using the UK BCR application forms, as their existing authorized EU BCRs are not recognized is not correct because, under UK GDPR, Binding Corporate Rules (BCRs) that were approved under the EU GDPR can still be valid in the UK. However, organizations may need to ensure their existing EU BCRs are updated to reflect UK-specific legal requirements.

I am between B and C, but am voting B based on the wording of the question. Which is not always the best gut check with the CIPP, as we're aware. Both are valid, BCRs are the gold standard and would require submitting to the ICO for approval. In the interim, that transfer should be suspended. In contrast, SCCs are self regulating and offer an adequate level of protection that can be implemented quickly, allowing the transfer to continue.

C. By submitting to the ICO a new application for the UK BCRs using the UK BCR application forms, as their existing authorized EU BCRs are not recognized.

SCCs are for transfers between third parties. BCRs are for intragroup transfers. Post Brexit, company's need to separately obtain approval with the UK ICO for their UK BCRs. "Holders of EU Binding Corporate Rules (EU BCRs) are now required to take action to continue relying on them as an appropriate safeguard for international data."

SCCs are for transfers between third parties. BCRs are for intragroup transfers. Post Brexit, company's need to separately obtain approval with the UK ICO for their UK BCRs. "Holders of EU Binding Corporate Rules (EU BCRs) are now required to take action to continue relying on them as an appropriate safeguard for international data."