On 25 December 2023, Thailand’s Personal Data Protection Committee (PDPC) published two subordinate regulations regarding cross-border transfer of personal data under the Personal Data Protection Act B.E. 2562 (2019) (PDPA) in the Government Gazette. These two rules are (1) Whitelist Notification; and (2) the Binding Corporate Rules (BCRs) and Appropriate Safeguards Notification, both of which will come into force on 24 March 2024.
Businesses may need to revisit which cross-border transfer option is appropriate for their specific circumstances, particularly considering whether their existing BCRs (for the Office of the PDPC’s approval) or appropriate safeguards (e.g., existing contractual clauses) are in compliance with the requirements set out by these new subordinate rules.

On 27 October 2023, Thailand’s Personal Data Protection Committee published for public consultation two new draft rules regarding cross-border transfer of personal data. These two draft rules, namely: (1) Draft Whitelist Notification and (2) Draft Binding Corporate Rules and Appropriate Safeguards Notification, upon becoming effective as binding laws, will serve to expand the available options for making a lawful transfer of personal data outside Thailand in compliance with the Personal Data Protection Act B.E. 2562.

Request a copy For over 40 years, the team at Baker McKenzie, Bangkok has assisted foreign individuals and international companies who are seeking investment opportunities in Thailand. Doing Business in Thailand is your personal guide to the key aspects of Thai law that significantly affect the way business is conducted…

The Ministry of Digital Economy and Society (“MDES”) has been quite active throughout 2018, having already passed several laws under the digital economy initiatives. While much attention was focused on the Personal Data Protection Bill (click here to read our latest alert), MDES has been similarly committed to advancing other…