Deutsche Telekom introduced the Binding Corporate Rules Privacy (BCRP) in 2014. Even before the General Data Protection Regulation (GDPR) was introduced, these rules committed Deutsche Telekom to a very high level of data protection worldwide. The BCRP were aligned with the GDPR in 2018. Based on the European Data Protection Board's requirements, a revised version was developed and coordinated with the Federal Commissioner for Data Protection and Freedom of Information (BfDI) in December 2023. The BCRP form the Group-wide internal data protection policy. Where legally permissible, the companies in the Deutsche Telekom Group have committed to this Group policy. The BCRP are intended to ensure a consistently high level of data protection for our products and services. You can find a list of the companies that have adopted this Group policy as binding to the side under „Learn more“.
The Group Data Privacy Officer at Deutsche Telekom is Susanne Eichhorn. She is located in Bonn, Germany. Together with her team Group Privacy she coordinates the processes of cooperation and agreement on all significant issues regarding data privacy within the Deutsche Telekom Group internationally as well as nationally. The BCRP are the foundation for that. She directly reports to the Board of Deutsche Telekom.
The BCRP require the appointment of data protection officers for every company in the Group, regardless of whether there is a legal obligation to do so. Deutsche Telekom therefore employs more than 60 data protection officers outside Germany who monitor and oversee data protection within their companies. They are managed by the Group Data Protection Officer and ensure compliance with the high data protection requirements in their respective companies.
In Germany, Deutsche Telekom goes a step further. In addition to the BCRP, the national Group Policy on the Organization of Data Protection applies here.
This policy stipulates that the Group Data Protection Officer is appointed as the Data Protection Officer by the German subsidiaries. In some cases, additional Data Protection Officers are also appointed. The Group Data Protection Officer is supported throughout Germany by more than 110 privacy coordinators. At least 10 percent of their working time is available to them for the Data Protection Officer's management tasks, such as conducting training sessions and audits. They are the first point of contact for their colleagues in the individual companies on data protection matters.
In addition to setting out the management responsibilities of the Data Protection Officers, the policy also requires Privacy bridgeheads to be established. They help the management teams of the companies put these Data Protection Officer requirements into practice.
Moreover, the group companies must appoint Data Controllers and System Owners to support the Data Privacy bridgeheads in integrating requirements into the business processes and systems. They ensure that the policies ultimately lead to procedures and processes that comply with data protection regulations.
These group guidelines and the organisation of data protection have been ensuring a very high level of data protection thoughout the Deutsche Telekom for many years. They even exceed the already strong requirements of the DSGVO and guarantee that Deutsche Telekom is well positioned for the upcoming challenges of digitisation in matters of data protection.