Chandler MHM


Thailand PDPA Update: Requirements on Cross-border Transfer

Late December most of the world was winding down for Christmas and New Year, but here in Thailand things kept going. On Christmas Day (25 December 2023), the Personal Data Protection Committee (PDPC) published two notifications in the Royal Gazette regarding cross-border transfer (i.e., transfer of personal data to outside of Thailand) in relation to Section 28 (on criteria for adequacy country) and Section 29 (on appropriate safeguards) of the Personal Data Protection Act, B.E. 2562 (2019) (PDPA). These notifications finally address certain missing parts of the requirements and procedures for data controllers and processors on the processing of personal data which involves the transfer of such data to outside of Thailand, including the requirements and minimum standard of the destination country. These two notifications will become effective on 24 March 2024.