Grupo Santander's Binding Corporate Rules (BCR)

Our commitment to data protection worldwide

At Grupo Santander, we are firmly committed to protecting the personal data and privacy of our customers, employees, and all other individuals with whom we interact. In a global environment where information regularly flows between the entities within our Group, it is essential to ensure that personal data is processed in accordance with the highest standards of security and protection, regardless of the country in which it is processed.

To this end, Grupo Santander has developed and obtained approval of its Binding Corporate Rules (known as BCR), an instrument recognised by the General Data Protection Regulation (GDPR) as an appropriate safeguard for the international transfer of personal data within corporate groups.

What are Binding Corporate Rules (BCR)?

Binding Corporate Rules are legally binding internal personal data protection policies that govern transfers of personal data between the entities of a corporate group established within and outside the European Economic Area (EEA).

In practice, BCR ensure that the adhering entities of Grupo Santander apply a level of personal data protection equivalent to that required under European data protection law, regardless of their geographic location.

Approval of Grupo Santander's BCR

Grupo Santander's controller BCR (BCR-C) have been approved by the Spanish Data Protection Authority (AEPD), acting as the competent supervisory authority, by means of Resolution TI/00001/2026 of 5 June 2026, following completion of the cooperation procedure established by the European Data Protection Board (EDPB).

The EDPB issued its Opinion 12/2026 of 15 April 2026, confirming that Grupo Santander's BCR contain all the elements required under Article 47 of the GDPR and the Board's Recommendations 1/2022, and that they provide appropriate safeguards for the transfer of personal data in accordance with Articles 46 and 47 of the GDPR.

Documentation

Grupo Santander's Binding Corporate Rules are published in the official languages of all EEA Member States from which international transfers covered by the BCR are made:

Español: Normas Corporativas Vinculantes (PDF 645 Kb)

English: Binding Corporate Rules (PDF 654.5 Kb)

Português: Regras Corporativas Vinculantes (PDF 663.3 Kb)

Français: Règles d'Entreprise Contraignantes publique (PDF 726.7 Kb)

Italiano: Norme Vincolanti (PDF 682.2 Kb)

Nederlands: Bindende Bedrijfsvoorschriften (PDF 667.7 Kb)

Polski: Wiążące Reguły Korporacyjne — Wersja publiczna (PDF 713.9 Kb)

Adhering entities

The BCR are binding on all Grupo Santander entities that have signed the corresponding Intra-Group Agreement. The complete and up-to-date list of adhering entities is set out in Appendix 5 of the BCR, which is published separately at the following link:

Appendix 5 — List of entities adhering to Grupo Santander's BCR (PDF 171.6 Kb)

Last updated: June 2026