THANATHIP & PARTNERS
We use cookies, including third party cookies, to personalise and optimise your experience when exploring our website. For more detailed information about our cookies, please refer to cookies section in our privacy notice .
If you agree to the use of cookies, please click “Accept”. To manage your cookies settings, please click “Cookies Settings”.
Cross-Border Transfer of Personal Data
January 2024
By Nat Boonjunwetvat, Punnapa Vorapanyasakul, Kunrisa Mektrakarn
Introduction
On 25 December 2023, the Personal Data Protection Commission (the “PDPC”) issued two notifications relating to cross-border transfer of personal data, namely:
Introduction
On 25 December 2023, the Personal Data Protection Commission (the “PDPC”) issued two notifications relating to cross-border transfer of personal data, namely:
- Notification of the PDPC Re: Criteria for the Protection of Personal Data Sent or Transferred to a Foreign Country Pursuant to Section 28 of the PDPA (the "Section 28 Notification”); and
- Notification of the PDPC Re: Criteria for the Protection of Personal Data Sent or Transferred to a Foreign Country Pursuant to Section 29 of the PDPA (the "Section 29 Notification”).
Coming into effect on 24 March 2024, the notifications aim at providing clarity on standards and criteria for cross-border transfer restrictions under Sections 28 and 29 of the Personal Data Protection Act B.E. 2562 (A.D. 2019) (the “PDPA”).
Cross-border transfer
In the event of a cross-border transfer of personal data, Section 28 of the PDPA principally requires that the destination country or international organisation receiving the transferred personal data must have adequate data protection standards, unless other exemptions apply.
The Section 28 Notification further elaborates that such “adequate data protection standards” shall be determined by the destination country or international organisationhaving (i) legal measures or mechanisms which are aligned with Thai personal data protection laws and (ii) agencies or organisations empowered to enforce personal data laws and regulations. In this connection, “whitelist” countries and international organisations remain to be announced by the PDPC for this purpose.
Group transfer
Pursuant to Section 29 of the PDPA and the Section 29 Notification, transfers of personal data outside Thailand within a group of undertakings or enterprises shall be permitted to the extent that:
Cross-border transfer
In the event of a cross-border transfer of personal data, Section 28 of the PDPA principally requires that the destination country or international organisation receiving the transferred personal data must have adequate data protection standards, unless other exemptions apply.
The Section 28 Notification further elaborates that such “adequate data protection standards” shall be determined by the destination country or international organisationhaving (i) legal measures or mechanisms which are aligned with Thai personal data protection laws and (ii) agencies or organisations empowered to enforce personal data laws and regulations. In this connection, “whitelist” countries and international organisations remain to be announced by the PDPC for this purpose.
Group transfer
Pursuant to Section 29 of the PDPA and the Section 29 Notification, transfers of personal data outside Thailand within a group of undertakings or enterprises shall be permitted to the extent that:
- Binding Corporate Rules (the “BCR”) governing internal rules and policies for data transfers having been established, reviewed and certified by the PDPC; or
- Appropriate safeguards having been put in place to enable the enforcement of data subjects’ rights, including effective legal remedial measures. Such safeguards may take various forms, including:
- Standard Contractual Clauses (SCC) containing the terms and requirements prescribed by PDPC under the Section 29 Notification. Alternatively, the SCC may follow certain overseas models as recognised by the PDPC, namely:
-
ASEAN Model Contractual Clauses for Cross Border Data Flows;
-
Standard Contractual Clauses for the Transfer of Personal Data to Third Countries issued under Articles 46(1), 46(2)(c) and 28(7) of the Regulation (EU) 2016/679 of the European Union (the GDPR) ; or
-
SCCs of other agencies or international organisations as prescribed by the PDPC.
-
- Certifications affirming an implementation of appropriate safeguards for cross-border transfer of personal data; and
- Legally binding and enforceable data transfer documents or agreements governing the transfer of personal data between state agencies in Thailand and other countries.
- Standard Contractual Clauses (SCC) containing the terms and requirements prescribed by PDPC under the Section 29 Notification. Alternatively, the SCC may follow certain overseas models as recognised by the PDPC, namely:
This document is solely intended to provide an update on recent development in Thailand legislation and is not purported to provide a legal opinion, nor a legal advice to any person.
New Tax Guideline on Foreign-Sourced Income of Thai Tax Residents
September 2023
The Revenue Department of Thailand has made a radical change to its longstanding principal as regards its treatment of foreign-souced income of an individual “Thai tax resident”.
Amendment to Takeover Regulations to Reduce Burdens and Increase Flexibility
May 2022
With effect from 1 May 2022, the Office of the Securities and Exchange Commission (the “SEC”) has amended takeover regulations with an aim to reducing burdens of private sectors,
Tax Exemption for Startup Fundraising through Venture Capital
March 2022
The Cabinet has approved tax measures to promote fundraising in Startups by providing certain tax benefits for investment, both directly and indirectly through Venture Capital, in Thai Startups that engage in certain industries. As a result of this measure, it is expected that there will be an increase in investment in (i) Thai Startups for approximately Baht 320 billion and (ii) an employment rate by 2066 as well as strengthen our economic growth.