EDPB Delivers Landmark Opinion on FrieslandCampina's Binding Corporate Rules, Setting Precedent for Global Data Transfers

The European Data Protection Board (EDPB) has issued Opinion 3/2026, providing critical guidance on the Dutch Data Protection Authority's (DPA) draft decision concerning the Controller Binding Corporate Rules (BCRs) of the FrieslandCampina Group. This landmark opinion represents a significant development in the ongoing evolution of GDPR compliance frameworks for multinational corporations engaged in cross-border data transfers.

The case centers on FrieslandCampina, a Dutch dairy cooperative with operations spanning over 100 countries, which sought approval for its Controller Binding Corporate Rules to facilitate the transfer of personal data within its global corporate group. The Dutch DPA's draft decision, now subject to the EDPB's scrutiny, raises fundamental questions about the adequacy of safeguards for international data transfers under the General Data Protection Regulation.

Binding Corporate Rules represent one of the few mechanisms explicitly recognized under Article 47 of the GDPR for transferring personal data outside the European Economic Area. Unlike Standard Contractual Clauses, which are pre-approved contractual templates, BCRs are internal codes of conduct that bind all members of a corporate group to uniform data protection standards. The approval process for BCRs is notably rigorous, requiring both initial authorization by the lead supervisory authority and subsequent recognition by other relevant authorities.

The EDPB's opinion addresses several critical aspects of the Dutch DPA's draft decision. First, it examines the adequacy of the safeguards provided by FrieslandCampina's BCRs in ensuring compliance with GDPR principles, particularly regarding data minimization, purpose limitation, and the rights of data subjects. The Board emphasizes that BCRs must not only mirror GDPR requirements but also demonstrate practical effectiveness in protecting personal data across diverse legal and operational environments.

A particularly significant element of the opinion concerns the assessment of third-country legislation that may impact the effectiveness of the BCRs. This issue has gained heightened importance following the Schrems II decision, which invalidated the EU-US Privacy Shield and established stringent requirements for evaluating the risks posed by foreign surveillance laws. The EDPB underscores the necessity for controllers to conduct thorough assessments of applicable third-country laws and implement supplementary measures where necessary to ensure an essentially equivalent level of protection.

The opinion also addresses the territorial scope of the BCRs, clarifying that they should apply to all entities within the corporate group that process personal data, regardless of their location. This comprehensive approach ensures consistent data protection standards across the entire organization and eliminates potential gaps in compliance.

From a practical standpoint, the EDPB's guidance provides valuable clarity for multinational corporations seeking to implement BCRs. The opinion emphasizes the importance of:

• Clear governance structures and accountability mechanisms
• Comprehensive data protection impact assessments
• Regular monitoring and auditing procedures
• Effective mechanisms for data subjects to exercise their rights
• Robust data breach notification protocols

For the broader data protection community, this opinion carries significant implications. It reinforces the EDPB's commitment to maintaining high standards for international data transfers while acknowledging the legitimate business needs of global organizations. The guidance may influence how other supervisory authorities approach BCR applications and could shape future interpretations of GDPR requirements in cross-border contexts.

The timing of this opinion is particularly noteworthy given the ongoing challenges in establishing reliable mechanisms for transatlantic data flows. With the EU-US Data Privacy Framework still facing legal uncertainties, BCRs remain an important tool for organizations seeking to ensure GDPR compliance in their international operations.

However, the opinion also highlights the substantial burden associated with implementing and maintaining BCRs. The approval process can be lengthy and resource-intensive, requiring significant investment in data protection infrastructure and expertise. Organizations must carefully weigh these costs against the benefits of having a comprehensive, organization-wide data transfer mechanism.

Looking ahead, the EDPB's opinion on FrieslandCampina's BCRs is likely to influence future applications and interpretations of GDPR requirements for international data transfers. It may prompt organizations to re-evaluate their existing data transfer mechanisms and consider whether BCRs offer a more robust and sustainable solution for their global operations.

The case also underscores the continuing evolution of data protection enforcement in the post-Schrems landscape. As supervisory authorities grapple with the practical challenges of ensuring GDPR compliance in an interconnected world, opinions like this provide essential guidance while maintaining the regulation's fundamental principles.

For data protection professionals and legal practitioners, the EDPB's Opinion 3/2026 represents an important resource in navigating the complex terrain of international data transfers. It offers both practical guidance and theoretical framework for understanding how BCRs should function within the broader ecosystem of GDPR compliance mechanisms.

As organizations continue to adapt to the requirements of the GDPR and its evolving interpretation, the principles and guidance outlined in this opinion will likely play a crucial role in shaping compliance strategies for years to come. The FrieslandCampina case serves as a reminder that effective data protection in a global context requires not only technical and organizational measures but also a deep understanding of legal frameworks and their practical implementation across diverse jurisdictions.