Opinion 9/2026 on Dutch Draft Decision for Jacobs Douwe Egberts Controller Binding Corporate Rules

The EDPB issued Opinion 9/2026 responding to a referral from the Dutch Supervisory Authority under Article 64(2) GDPR, which mandates the Board to issue opinions on draft decisions of national supervisory authorities regarding Binding Corporate Rules. The opinion evaluates whether the Jacobs Douwe Egberts Group's controller BCRs satisfy the GDPR's requirements for lawful international data transfers, including the six elements prescribed by Article 47(2) GDPR. The EDPB's opinion is addressed to the Dutch Supervisory Authority, which remains the decision-maker; the opinion itself is non-binding under the GDPR framework.

For multinational groups relying on BCRs as their legal mechanism for intra-group international data transfers, this opinion confirms that EDPB Article 64 opinions serve as a consistency mechanism ensuring uniform application of GDPR requirements across Member States. The Jacobs Douwe Egberts Group and other multinationals preparing or renewing controller BCRs should ensure their applications address all elements enumerated in Article 47(2) GDPR, including binding and enforceable rights of data subjects, enforcement mechanisms, cooperation obligations with supervisory authorities, and procedures for handling data subject complaints. The Dutch Supervisory Authority will issue its final decision in light of the EDPB's opinion.