THAILAND Law and Practice Contributed by: Jutharat Anuktanakul, Suphakorn Chueabunchai and Pitchaya Roongroajsataporn, Chandler Mori Hamada Limited
the general PDPA provisions are applicable to this area.
• such transferor of the personal data applies bind - ing corporate rules (BCRs) that have already been approved by the PDPC office to such transfer. Where no list is prescribed for those countries deemed to have adequate personal data protection measures, or where the BCRs have not yet been approved by the PDPC office, the PDPA stipulates that the trans - feror must provide appropriate security measures in accordance with the rights of the data subjects, together with effective legal remedial measures, such as appropriate standard contractual clauses (SCCs) for cross-border transfers and certification mecha - nisms. Under a PDPA notification, SCCs based on the ASEAN Model Contractual Clauses for Cross-Border Data Flows and GDPR SCCs are acceptable. 5.2 Government Notifications and Approvals Cross-border transfers do not require any government notification or approval. 5.3 Data Localisation Requirements In certain cases, operators have to retain some docu - ments on their premises, such as accounting docu - ments and VAT certificates. However, operators can duplicate and transfer such data outside Thailand (see 5.1 Restrictions on International Data Transfers for more details). 5.4 Blocking Statutes There are no blocking statutes under Thai privacy laws. 5.5 Recent Developments On 29 September 2025, the PDPC issued the Rules on the submission, consideration, examination, cer - tification and supervision of personal data protection policies within the same affiliated business or group of undertakings (B.E. 2568 (2025)), which establish a for - mal certification regime for BCRs under the PDPA. The Rules confirm that there are two types of BCRs: BCRs for Controllers (BCR-C) and BCRs for Processors (BCR-P), each of which may be used as an appropri - ate safeguard for cross-border personal data transfers from Thailand regardless of the adequacy status of the destination country. A Thai “anchor” entity must be established under Thai law and maintain a place of business in Thailand (eg, the Thai headquarters or
5. International Considerations 5.1 Restrictions on International Data Transfers
The PDPA does not provide for the concept of abso - lute restriction for any type of transfer of personal data outside the jurisdiction of Thailand. Instead, control - lers, as transferors, may be subject to several obliga - tions and/or must ensure that the transferee meets the qualifications prescribed under the PDPA. In general, in the case of transferring personal data outside Thailand, the countries in which the transferee is located should have adequate personal data protec - tion measures in place. The list of countries deemed to have adequate personal data protection measures is set to be prescribed by the PDPC; however, such list has not yet been issued. Two key criteria for assess - ing whether a country is deemed to have adequate personal data protection measures are: • whether the legal safeguards for personal data pro - tection in such country are of a standard equivalent to or higher than those under the PDPA; and • whether such country has a competent authority or organisation responsible for enforcing the above- mentioned safeguards. In any event, even after such list is prescribed, several exemptions exist under which a controller may trans - fer personal data to countries outside such list (trans - fers necessary for compliance with the law, trans - fers based on the data subject’s consent, transfers required for the performance of a contract to which the data subject is a party, etc). Another exemption to the limitation on personal data transfers to only those countries included in such list applies where the following conditions are fulfilled: • such transfer is made within a group of undertak - ings or enterprises; and
501 CHAMBERS.COM
Powered by FlippingBook