Aramex and ICT Legal Consulting International BV (ICTLC International) have announced the approval of the Aramex Group Binding Corporate Rules for Controllers (BCR-C) by the Dutch Supervisory Authority, Autoriteit Persoonsgegevens, acting as BCR Lead, following the positive opinion issued by the European Data Protection Board (EDPB).
This achievement marks an important milestone in Aramex’s global data protection governance programme. As a leading global provider of logistics and transportation solutions, headquartered in Dubai, United Arab Emirates and operating through a worldwide network of subsidiaries, Aramex’s approved BCR-C provide a GDPR-recognised framework for intra-group international transfers of personal data and reflect the company’s continued commitment to accountability, transparency, and high standards of data protection across its global operations.
Aramex is a multinational leader and transportation provider, offering end-to-end solutions across express delivery, freight, and supply chain services. Headquartered in the UAE and listed on the Dubai Financial Market, it connects customers across 70+ countries worldwide.
ICTLC International provided comprehensive assistance throughout the BCR process, including:
- Drafting and structuring the BCR-C in alignment with the GDPR and the EDPB recommendations;
- Developing specific intra-group agreements and identifying relevant privacy contact points across Aramex Group entities;
- Supporting the Co-review and Cooperation Phases with the Dutch Data Protection Authority.
In its Opinion adopted on 8 July 2025, the EDPB concluded that the draft BCR-C of the Aramex Group contained appropriate safeguards to ensure that the level of protection guaranteed by the GDPR would not be undermined when personal data is transferred to and processed by group members outside the European Union.
Amadou Diallo, Aramex Group CEO,commented: “Trust is fundamental to the way Aramex operates across markets, borders, and communities. The approval of our Binding Corporate Rules for Controllers reflects the maturity of our privacy programme and our continued investment in responsible data practices. For Aramex, data protection is not only a compliance requirement, but an essential part of how we serve our customers, support our people, and work with partners around the world. This milestone gives us a strong and consistent foundation for managing personal data responsibly as our business continues to grow globally.”
Paolo Balboni, Founder and Managing Partner of ICTLC International, commented: “We are proud to have supported Aramex in achieving this important milestone. Binding Corporate Rules remain one of the most robust GDPR instruments for international data transfers, and this result reflects Aramex’s commitment to maintaining very high data protection governance standards across its global operations.”
This achievement strengthens Aramex’s position as a trusted global logistics provider with GDPR-approved safeguards for international intra-group data flows. It also highlights ICTLC International’s experience in supporting complex, multinational privacy compliance projects, including data transfer governance, BCR approval processes, and global privacy and data protection framework implementation.
The ICTLC team was led by Paolo Balboni, Founder and Managing Partner, with the instrumental support of Martim Taborda Barata, Partner and Yazan AlMasri, Of Counsel, who worked in close collaboration with the Aramex team led by Farzana Hirani, Deputy General Counsel and Caroline Evans, Global Director Digital & Technology Strategy, Performance and GRC, who provided invaluable support to reach this achievement.
