BCRs work by setting out the principles and rules that a company must follow when processing personal data. This includes guidelines on data collection, processing, storage, and transfer. By implementing BCRs, companies ensure that they have a consistent approach to data protection across all their entities, which is recognized and approved by data protection authorities.