Groups of companies do not enjoy any corporate privileges and therefore every data transfer must be justifiable. According to the type of the cooperation between companies of a group this can either be in the form of Joint Controller Agreements (JCA) or Data Processing Agreements (DPA). However, if the data transfer is outside the EU or EEA then one will need Standard Contractual Clauses (SCC) or other guarantees. Instead of establishing BCRs one would mostly suggest framework agreements for group-wide data transfers, including Joint Controller Agreements, Data Processing Agreements and if necessary Standard Contractual Clauses. Other companies of the group may join such framework agreements, so that the greatest possible flexibility is maintained.