Pre-GDPR BCRs overview list

The list of pre-GDPR BCRs provides information on BCRs which were submitted to supervisory authorities (SAs) for approval prior to 25 May 2018 and for which the informal cooperation procedure was closed successfully. The list states which SA took charge of coordinating the informal EU cooperation procedure.

Inclusion in the list does not imply endorsement by the EDPB of these BCRs. Inclusion in the list is without prejudice to any decision or measure the competent SA wishes to take, in particular regarding the BCRs or the processing involved.

Please note that this overview list is provided for information purposes only. Companies have a responsability to inform the competent supervisory authorities of changes to the BCRs. The overview list is updated based on information provided by the company to the competent supervisory authorities.

Companies relying on BCRs for data transfers are obliged to give concerned data subjects easy access to their BCRs. For more details about the BCRs, please contact the company.

Closure of Last update Terminated Title* Type of BCR* the EU SA* Updates of the BCR cooperation overview* ABN AMRO Group Controller 2012 NL SA N 20200703 N.V. Lead SA Controller 2009 UK SA change: IE SA as 20200528 of March 2019 ADIENT Controller BE SA N 20201021 DE SA AGCO Controller N 20201020 (Bavaria) Air liquid Controller 2018 FR SA 20201026 Airbus Controller 2014 FR SA 20201026 Akastor ASA Controller NO SA 20180524 Aker Solutions ASA Controller NO SA 20180524 Akzo Nobel N.V. Controller 2014 NL SA N 20200706 Controller Align Technologies, and 2014 NL SA N 20200706 Inc. Processor * Mandatory fields 20201218 1 Closure of Last update Terminated Title* Type of BCR* the EU SA* Updates of the BCR cooperation overview* DE SA Allianz Controller N 20201020 (Bavaria) BCR in effect as of 28 January 2013 American Express Controller 2012 UK SA Lead SA 20200528 Company change: ES SA as of September 2019 AMGEN Controller 2016 FR SA N 20201026 Arcadis N.V. Controller 2017 NL SA N 20200706 ArcelorMittal Group Controller 2013 LU SA N 20201030 Name change: group was Ardian Controller 2013 FR SA N 20201026 called Axa Private Equity Lead change: SE Astra Zeneca AB Controller 2014 UK SA N SA as of 20201030 October 2020 Controller and 2014 FR SA 20201026 Processor 2018 Automated Data Controller Controller Processing Inc. and NL SA N 20200703 (ADP) Processor 2018 Processor Controller DE SA AVAYA Group and 2018 Y 20201029 (Hessen) Processor AXA Controller 2013 FR SA N 20201026 BakerCorp International Controller 2015 NL SA 20200707 Holdings Inc. Controller BMC and 2015 FR SA 20201026 Processor DE SA BMW Controller N 20201020 (Bavaria) BNP Paribas SA Controller 2018 FR SA 20201026

* Mandatory fields 20201218 2 Closure of Last update Terminated Title* Type of BCR* the EU SA* Updates of the BCR cooperation overview* Controller Box, Inc and 2016 UK SA 20200528 Processor BP Controller 2010 UK SA 20200528 Lead Authority Bristol Myers change: IE SA as Controller 2011 FR SA N 20201026 Squibb of June 2019 on date 20190625 Lead Authority Controller change: NL SA BT Group Plc. and 2017 UK SA as of 20200901 Processor September 2020 Lead SA 2015 CA Plc. (trading as change: DE Controller UK SA 20200528 CA Technologies) (Hessen) as of

28/08/2018 Controller and 2016 FR SA 20201026 Processor Cardinal Health, Inc Controller MT SA 20180524 BCRs withdrawn CareFusion Inc. Controller 2011 UK SA Y 20200528 2019 at request of applicant Lead change: Cargill, Inc. Controller 2013 UK SA NL SA as of July 20200528 2020 Christian Louboutin Controller 2018 FR SA 20201026 SAS Cisco Systems, Inc. Controller 2018 NL SA N 20200706 BCR in effect as of 6 June 2013 Citigroup Controller 2012 UK SA N Lead change: IE 20201020 SA as of December 2020 CMA-CGM Controller 2011 FR SA N 20201026 DE SA (Lower Continental Group Controller N 20201021 Saxony) Corning Controller 2015 FR SA 20201026 Coöperatieve Controller 2014 NL SA N 20200706 Rabobank U.A. Danfoss A/S Controller DK SA 20201020

* Mandatory fields 20201218 3 Closure of Last update Terminated Title* Type of BCR* the EU SA* Updates of the BCR cooperation overview* Deutsche Post DHL Controller 2011 DE SA (BFDI) N 20201030 Deutsche Telekom Controller 2014 DE SA (BFDI) N 20201030 DNV GL Controller NO SA 20180524 Controller DocuSign and 2018 IE SA N 20201020 Processor DSM Controller NL SA 200117 e-Bay Controller 2009 LU SA N 20201030 Name change: group was ENGIE Controller 2015 FR SA 20201026 called GDF SUEZ Lead change: 2013 NL SA as of May Controller Controller 2019 EY and UK SA N Name change: 20200706 Processor 2018 group was Processor called Ernst & Young DE SA (Baden- Festo Group Controller 2017 N 20201118 Württemberg) Controller Lead change: IE First Data and 2011 UK SA SA as of 20200528 Corporation Processor December 2020 Name change: group was called Flex Controller 2015 UK SA 20200528 Flextronics International Ltd Lead change: Fluor Corporation Controller 2015 UK SA N NL SA as of 20200703 INc. April 2020 2012 Controller General Electric Controller and FR SA 20201026 (GE) 2018 Processor Processor Controller Giesecke & DE SA and N 20201020 Devrient (Bavaria) Processor Lead change: IE GlaxoSmithKline Plc Controller 2013 UK SA SA as of October 2020 20200528

* Mandatory fields 20201218 4 Closure of Last update Terminated Title* Type of BCR* the EU SA* Updates of the BCR cooperation overview* Company notified Lead Henner Controller 2017 FR SA Y SA of termination in March 2020 Hermès Controller 2012 FR SA N 20201026 Corporate reorganisation: Hewlett Packard Hewlett Packard Company was Controller 2011 FR SA Y 20201026 Company split into 2 companies in 2015: HP Inc. and HP Enterprise Corporate reorganisation: Hewlett 2011 Packard Controller Hewlett Packard Controller Company was and FR SA 20201026 Enterprise 2017 split into 2 Processor Processor companies in 2015: HP Inc. and HP Enterprise Corporate reorganisation: Hewlett 2011 Packard Controller Hewlett Packard Controller Company was and FR SA 20201026 Inc. 2018 split into 2 Processor Processor companies in 2015: HP Inc. and HP Enterprise Hyatt Controller 2009 UK SA 20200528 BCRs IMS Health withdrawn Controller 2010 UK SA Y 20200528 Incorporated 2019 at request of applicant ING Bank N.V. Controller 2013 NL SA N 20200706 Intel Corporation Controller 2012 IE SA N 20201020

* Mandatory fields 20201218 5 Closure of Last update Terminated Title* Type of BCR* the EU SA* Updates of the BCR cooperation overview* Lead change: International NL SA as of Business Machines Controller 2017 UK SA 20200528 September Corporation (IBM) 2020 International SOS Controller 2011 FR SA N 20201026 ISS Group Controller DK SA 20201020 Itera ASA Processor NO SA 20180524 Name change: group was called D.E. Master Blenders 1753 (“DEMB”) until 23 June 2015 Jacobs Douwe Controller 2011 NL SA N Name change: 20200706 Egberts N.V. group was called Sara Lee International B.V. (indirect subsidiairy of Sara Lee Corporation) until 4 July 2011 DE SA (Baden- John Deere Controller 2018 N 20201118 Württemberg) Johnson Controls Controller BE SA N 20201021 Lead change: DE (Hessen) as JPMC Controller 2010 UK SA 20200528 of December 2020 Kongsberg Controller NO SA 20180524 Koninklijke DSM Controller NL SA 20200706 N.V. Koninklijke Controller 2017 NL SA N 20200706 N.V. Kvaerner ASA Controller NO SA 20180524 Lead change: Latham & Watkins DE (Hessen) as Controller 2016 UK SA 20200528 LLP of December 2020

* Mandatory fields 20201218 6 Closure of Last update Terminated Title* Type of BCR* the EU SA* Updates of the BCR cooperation overview* LeasePlan Controller 2015 NL SA N 20200706 Corporation N.V. DE SA Ledvance Controller N 20201020 (Bavaria) Lego Group Controller DK SA 20201020 Controller 2014 FR SA 20201026 Controller Linkbynet and 2014 FR SA 20201026 Processor Lead SA change: BE SA Linklaters LLP Controller 2012 UK SA 20200528 as of 1 February 2020 Louis Vuitton Moët Controller 2010 FR SA N 20201026 Hennessy (LVMH) Maersk Group Controller DK SA 20201020 Lead change: IE Marsh and Controller SA as of McLennan and 2017 UK SA 20200528 September Companies Inc. Processor 2020 Controller Mastercard and BE SA N 20201021 Processor Merck Sharp & Controller BE SA 20180524 Dohme (MSD) Michelin Controller 2010 FR SA N 20201026 Name change: group was called the Atmel Microchip Controller 2009 UK SA Corporation 20200528 Technology Inc. Lead SA change: NO SA as of October 2018 Motorola Mobility Controller 2013 UK SA 20200528 LLC Lead Authority change: DK SA Motorola Solutions Controller UK SA N 20201020 as of December 2020 NetApp, Inc. Controller 2015 NL SA N 20200706 NextiraOne Europe Processor 2016 NL SA N 20200706 B.V. * Mandatory fields 20201218 7 Closure of Last update Terminated Title* Type of BCR* the EU SA* Updates of the BCR cooperation overview* Norsk Hydro Controller NO SA 20180524 NOVARTIS Controller 2012 FR SA N 20201026 Novo Nordisk A/S Controller DK SA 20201020 Nutreco N.V. Controller 2016 NL SA N 20200706 Oracle EMEA Ltd Processor 2017 IE SA N 20201020 DE SA Osram Controller N 20201020 (Bavaria) OVH Controller 2012 FR SA N 20201026 PayPal Controller 2018 LU SA N 20201030 Rakuten Controller 2017 LU SA N 20201030 Rockwool Controller DK SA 20201020 Controller 2012 NL SA N 20200706 Plc. 2012 Controller Royal Controller and NL SA N 20200706 Electronics 2014 Processor Processor Safran Controller 2010 FR SA N 20201026 Salesforce Processor 2015 FR SA N 20201026 Sanofi Aventis Controller 2009 FR SA N 20201026 Schlumberger Ltd. Controller 2012 NL SA N 20200706 Schneider Electric Controller 2012 FR SA N 20201026 DE SA Siemens Group Controller N 20201020 (Bavaria) DE SA (North Simon-Kucher & Controller Rhine- 20180524 Partners Westphalia) Sociéte Générale Controller 2013 FR SA N 20201026 2012 Name change: Controller Controller group was Sopra HR Software and FR SA N 20201026 2013 called HR Processor Processor Access Spencer Stuart Controller 2011 UK SA 20200528 As of 15 October 2018 Starwoord Hotels Controller BE SA Y the Starwood 20180524 and Resorts BCRs are terminated Statoil ASA Controller NO SA 20180524 Controller Telefonaktiebolaget 2016 and SE SA N 20201030 LM Ericsson Processor Processor

* Mandatory fields 20201218 8 Closure of Last update Terminated Title* Type of BCR* the EU SA* Updates of the BCR cooperation overview* 2017 Controller Controller Teleperformance² and 2018 FR SA N 20201026 Processor Controller TMF Group B.V. and 2014 NL SA N 20200706 Processor Due to an acquisition of TNT by FedEx, the geographical scope of the BCR has been extended. The name of TNT Express N.V. Controller 2017 NL SA N 20200706 the group entity in the NL is “TNT Nederland B.V.” and with the aquisition “Federal Express Corp. In the U.S. joined. Total Controller 2014 FR SA N 20201026 Controller Twilio Ireland Ltd and 2018 IE SA N 20201020 Processor UCB Controller BE SA N 20201021 United Technologies Controller BE SA N 20201021 Corporation (UTC) Univar, Inc. Controller 2017 NL SA N 20200706 Verizon Controller Lead change: IE communications and 2018 UK SA SA as of 20200528 inc. Processor December 2020 VMware International Processor 2018 IE SA N 20201020 Limited Workday Processor 2018 IE SA N 20201020 Yara Controller NO SA 20180524

* Mandatory fields 20201218 9 Closure of Last update Terminated Title* Type of BCR* the EU SA* Updates of the BCR cooperation overview* Zendesk Controller International and 2017 IE SA N 20201020 Limited Processor

* Mandatory fields 20201218 10