1 Controllers that are part of a group of undertakings or institutions affiliated to a central body may have a legitimate interest in transmitting personal data within the group of undertakings for internal administrative purposes, including the processing of clients’ or employees’ personal data. 2 The general principles for the transfer of personal data, within a group of undertakings, to an undertaking located in a third country remain unaffected.
This recital of the General Data Protection Regulation clarifies article 6 GDPR (Lawfulness of processing).*
