Data Privacy Rules

Data Privacy Rules

BP, in the course of conducting business, collects or uses personal information about current and prospective employees, contractors, customers and business contacts. BP, including BP America, recognizes the importance of protecting this personal information and has adopted group-wide privacy rules known as Binding Corporate Rules (BCRs) which are stated as follows:

Rule 1 – We must first and foremost comply with local law where it exists.

Rule 2 – We must ensure that BP representatives take ownership of data protection.

Rule 3 – We must honor our commitment to each other as a global organization.

Rule 4 – We must be open with individuals as to how their personal information will be used by us.

Rule 5 – We must only obtain and use personal information for those purposes which are known to the individual or which are within their expectations and are relevant to us.

Rule 6 – We can only change the purpose for which personal information is used if we make people aware of such change or it is within their expectations and they can express their concerns.

Rule 7 – We must keep personal information accurate and up to date.

Rule 8 – We must only keep personal information for as long as is really necessary.

Rule 9 – We must always be receptive to any queries, requests or complaints made by individuals in connection with their personal information and adhere to our Access Request Response Procedure.

Rule 10 – We must always adhere to appropriate technical and organizational security measures to protect personal information.

Rule 11 – We must ensure that providers of services to us also adopt appropriate and equivalent security measures.

Rule 12 – We must never transfer personal information to non-BP Entities without ensuring that the third parties provide the right level of protection.

Rule 13 – We must only use sensitive personal information if it is absolutely necessary for us to use it.

Rule 14 – We must only use sensitive personal information where we have obtained the individual’s explicit consent unless we have another lawful basis for doing so under European data protection law.

Rule 15 – We must always allow customers to opt out of receiving marketing information.

Rule 16 – We must always suppress from marketing initiatives the personal data of individuals who have opted out of receiving marketing information.


Personal data, information or electronic communications created or stored on company computers or other electronic media such as hand-held devices are not private. Records of your electronic communications may be made and used for a variety of reasons, and may be subject to monitoring or auditing at any time and without notice.

BP Rights

BP reserves the right to unilaterally amend, change, modify, delete, replace or add to the statements in this policy, at any time, with or without prior notice. BP also reserves the right to interpret the provisions of this policy, and such interpretations will be final and binding. In addition, not every situation can be anticipated in written policies, guidelines and/or procedures, and the facts surrounding any situation can require discretionary judgments by appropriate levels of management.

This policy is not intended to create, nor does it create, any express or implied contractual rights in any person. Unless he/she has entered into an express written agreement signed by an authorized company representative, each employee of BP is an "at-will" employee. Just as any at-will employee may terminate his/her employment at any time and for any reason, BP may terminate any at-will employee at any time, with or without cause, and with or without prior notice. This policy does not represent a contract, or an offer to form a contract and does not create any binding contractual commitments between an employee and BP regarding any subject, and does not alter or limit the at-will employment status of BP employees.