Why cross-border data transfers are an urgent issue for Thai organizations in 2026
In an era where business operations increasingly rely on multinational technology platforms and cloud services, many Thai organizations are transferring personal data outside the country—sometimes without realizing it. Examples include using a SaaS-based CRM with servers located in Singapore, sending HR data to a parent company in Europe, or using an email marketing service provider based in the United States.
Thailand’s Personal Data Protection Act B.E. 2562 (2019) (PDPA) clearly establishes the legal framework for these transfers under Sections 28 and 29, yet many organizations still do not fully understand the requirements. This article summarizes the key obligations and provides a practical checklist to help DPOs, Compliance officers, and legal teams assess and manage risk effectively.
Section 28: The fundamental principle for transferring data overseas
Section 28 of the PDPA provides that a Data Controller may not freely send or transfer personal data to a foreign country unless the destination country or international organization receiving the data has an adequate standard of personal data protection.
Countries with adequate protection standards (Adequacy Decision)
The Personal Data Protection Committee (PDPC) has the authority to announce a list of countries or territories recognized as having personal data protection standards adequate and comparable to those of Thailand. Where data is transferred to those jurisdictions, the Data Controller may proceed without relying on any additional transfer mechanism.
However, to date, the PDPC is still in the process of developing such a list. As a result, most organizations must still rely on other mechanisms permitted by law.
Section 29: Exceptions and alternative mechanisms
Where the destination country does not meet the Adequacy Decision threshold, Section 29 provides six alternative mechanisms that a Data Controller may rely on, as follows:
1. Binding Corporate Rules (BCR)
BCRs are internal personal data protection policies within a corporate group that have been certified by the PDPC or another recognized regulatory authority. They are suitable for multinational companies or business groups that regularly exchange data among affiliated entities.
Advantages: They cover all intra-group transfers and reduce the burden of obtaining consent on a case-by-case basis.
Disadvantages: Drafting and obtaining approval is complex and time-consuming.
2. Standard Contractual Clauses (SCC)
SCCs are standard contractual terms between the data exporter and the overseas data recipient. The PDPC may issue a standard form, or the parties may rely on standard clauses recognized by internationally accepted regulators, such as the EU SCCs.
What to watch for: SCCs are effective only if both parties are genuinely bound by the contract, and the data exporter must verify on an ongoing basis that the recipient complies with the contractual obligations.
3. Explicit consent from the data subject
A Data Controller may transfer data overseas if it has obtained the data subject’s explicit consent in advance, provided the data subject is informed of:
- The destination country to which the data will be transferred
- The protection standard of that country, which may be lower than Thailand’s
- The risks that may arise from such transfer
Important limitation: Consent embedded in general terms of service may not be sufficient, and there must be a mechanism allowing the data subject to withdraw consent.
4. Necessity for the performance of a contract
If the transfer is necessary for the performance of a contract between the Data Controller and the data subject, or to take steps at the data subject’s request prior to entering into a contract, the transfer may proceed without additional consent.
Example: International hotel or airline bookings, where passenger data must be sent to overseas service providers.
5. Public interest or vital interests
This basis may be used where the transfer is necessary for public interest purposes or to protect the vital interests of the data subject, such as transferring health data for emergency medical treatment abroad.
6. Legal claims
Where the transfer is necessary for the establishment, exercise, compliance with, or defense of legal claims.
Special considerations for cloud services
One of the most common practical challenges is the use of cloud services provided by foreign vendors, which raises additional considerations.
Data Residency vs. Data Sovereignty
Many organizations mistakenly assume that selecting “Asia Pacific Region” or “Singapore Region” in a cloud service means the data is not transferred outside Thailand. In practice, however:
- Metadata and log files may be processed in other regions
- Backup and disaster recovery may replicate data across multiple regions
- Support access may allow overseas support teams of the provider to access the data
What needs to be done: Review each cloud provider’s Data Processing Agreement (DPA) and Privacy Policy, and clearly identify where personal data is processed and stored.
Sub-processors and third-party vendors
A Data Processor acting as a cloud service provider often relies on multiple sub-processors, each of which may be located in different countries. The Data Controller is responsible for verifying that these sub-processors also maintain adequate data protection standards.
