EDPB Opinion on Heineken Group BCR Draft Decision

The European Data Protection Board (EDPB) has published its Opinion 1/2026, which provides an assessment of a draft decision from the Dutch Supervisory Authority concerning the Binding Corporate Rules (BCRs) of the Heineken Group. This opinion is a key step in the approval process for BCRs, which govern the international transfer of personal data within a multinational organization.

This document is crucial for companies seeking to implement or amend BCRs, as it indicates the EDPB's stance on the adequacy of data protection measures for international data flows. Compliance officers should review the opinion to understand the EDPB's interpretation of GDPR requirements related to BCRs and international data transfers, particularly in light of the specific case involving Heineken. While the EDPB's opinion is non-binding, it carries significant weight and influences the final decision of the supervisory authority.