Opinion 10/2026 on Dutch Supervisory Authority Draft Decision Regarding Controller Binding Corporate Rules of the SLB Group

The EDPB issued Opinion 10/2026 responding to a draft decision by the Dutch Supervisory Authority regarding the Controller Binding Corporate Rules of the SLB Group. The opinion was adopted under Article 64 GDPR, which requires the EDPB to issue opinions on draft decisions submitted by national supervisory authorities on matters of general application or relating to multilateral operations. SLB Group's BCRs must meet the requirements set out in GDPR Article 47 to serve as a valid legal mechanism for international personal data transfers.

For multinational corporations relying on BCRs for cross-border data transfers, this opinion illustrates the EDPB's role in reviewing national supervisory authority decisions on BCR applications. Companies preparing BCR submissions should ensure their applications fully address the criteria outlined in the EDPB BCR Working Document and GDPR Article 47 requirements, as the EDPB may issue observations that national authorities are expected to follow.