Rubrik's Binding Corporate Rules

Binding Corporate Rules (“BCRs”) are a set of data protection policies that are legally binding for multinational organizations – that is, groups of companies operating across multiple jurisdictions, such as the Rubrik Group. Competent data protection authorities approve BCRs. They provide a framework for these organizations to transfer personal data internationally while ensuring an adequate level of protection for the rights and freedoms of data subjects. In essence, BCRs constitute a comprehensive, internally enforced data protection standard within the organization. In the EU, BCRs are adopted under Article 47 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”) to allow transfers of personal data within the corporate group to countries outside the European Economic Area (“EEA”).

BCRs are categorized into two types:

• Controller BCRs – these apply when the organization acts as a controller, determining the purposes and means of the processing of personal data.  

• Processor BCRs – these apply when the organization acts as a processor, processing personal data on behalf of a controller.  

For further general information on BCRs, see the European Commission’s website:

commission.europa.eu – Binding Corporate Rules (BCR).  

Yes, Rubrik has adopted both the BCR-C and BCR-P.

BCRs demonstrate a company's commitment to data protection. They show that the company takes data privacy seriously and has implemented strong measures to protect personal data. This builds trust with customers and employees and helps the company comply with data protection laws like the GDPR.

Yes. The EU GDPR recognizes BCRs as a way to legally transfer personal data to countries outside of the EEA. This is important because EU data protection law restricts transfers of personal data to countries that don't offer adequate levels of protection, and BCRs help companies meet these requirements and ensure data stays safe wherever it goes.

Yes. Rubrik's Customer Data Processing Addendum (DPA) incorporates the BCR-P as a transfer mechanism for EEA personal data.  

In addition to our BCRs, we use other safeguards to protect data when it travels outside of Europe: 

• Adequacy Decisions – The European Commission recognizes certain countries around the world that offer an adequate level of protection for personal data.  

• U.S. Data Privacy Framework – Rubrik, Inc. participates in the EU-U.S., Swiss-U.S., and UK Extension to the EU-U.S. Data Privacy Framework maintained by the U.S. Department of Commerce. Rubrik, Inc.'s certification can be viewed on the U.S. Department of Commerce's official Data Privacy Framework List. 

• Standard Contractual Clauses – Rubrik offers the European Commission's Standard Contractual Clauses (Commission Implementing Decision 2021/914 of 4 June 2021) (“SCCs”) as well.