Belaws Home ›› Thailand ›› Blog ›› Thailand announces public hearing for cross-border transfer of Personal Data measures
legal
Thailand announces public hearing for cross-border transfer of Personal Data measures
11/10/2022
Thailand’s Personal Data Protection Committee (PDPC) has opened a public hearing relating to its draft notification regarding cross-border transfer of personal data. The public hearing will be open until October 24, 2022.
In this article we will take a look at some of the details contained within this notification.
Key points
- Once finalised, the draft notification will supplement the principle of cross-border transfer of personal data outside of Thailand set out in the Personal Data Protection Act (PDPA).
- The notification establishes key definitions relating to the cross-border transfer of personal data.
- Binding Corporate rules for cross-border data transfers can be created by companies. These rules must be submitted to the PDPC for approval.
- Appropriate safeguards for the data subjects rights have also been created.
What does the notification cover?
The notification establishes the following key definitions relating to the cross-border transfer of personal data.
“Transfer of personal data” refers to the sending or transferring of personal data by a transferor of personal data, either by physically or through a computer system or an internet network to the recipient of the personal data. The transfer of personal data does not include sending personal data through an intermediary by transiting between computer systems or internet networks, or any storing/retaining of personal data, either permanently or temporarily, through a cloud computing service provider, whereby the personal data transferor and the personal data recipient (1) are not making the order, (2) are not involved with any data selection or the content of the personal data sent and received through the computer systems or internet networks, or (3) have the purpose of entering into an agreement or any juristic act.
“Binding corporate rules” are the agreed terms or policy on personal data protection entered into by the personal data transferor and the personal data recipient in order to establish appropriate measures for safeguarding personal data within a group of corporations or companies.
“Standard contractual clauses” are the contractual terms that govern the personal data transferor and the personal data recipient to create the appropriate measures for safeguarding personal data.
“Code of conduct” is the code that sets out the obligations of a personal data transferor and a personal data recipient outside of Thailand.
“Certification” refers to the creation of appropriate personal data safeguarding measures.
Binding Corporate Rules
For cross-border transfers that are made within a group of corporations or companies, binding corporate rules (BCRs) can be established by these groups and submitted to the PDPC for approval.
These Binding Corporate Rules must adhere to the following minimum standards:
- The effectiveness and legally binding nature of the BCRs must apply to each company or entity within the group. This includes the data recipient, data processor, and data transferor, and the members belonging to the group, as well as their employees, staff, or persons related to the transfer or receipt of personal data within the group.
- The BCRs must comply with Thai laws on personal data protection.
- The BCRs must contain certification of data subject rights under the PDPA and sub-regulations.
- The BCRs must contain measures on personal data protection in relation to the following: personnel, processes, and security measures. These measures must be in accordance with the required technology standards for personal data protection.
Appropriate Safeguards
Under section 29, paragraph 3, of the PDPA, a personal data transferor may transfer personal data to a recipient outside of Thailand when procuring appropriate safeguard measures by way of “standard contractual clauses”, “code of conduct”, or “certification”.
Such appropriate safeguards must at least ensure the data subject’s rights are legally enforceable and effective legal remedial actions are available.
The notification states that the appropriate safeguards must include the following:
- Effectiveness and legal enforceability.
- Compliance with Thai laws on personal data protection.
- Certification of data subject rights under the PDPA and sub-regulations.
- Measures on personal data protection in relation to personnel, process, and security measures in accordance with the required technology standards for personal data protection.
All standard contractual clauses must be filed with the PDPC. The appropriate safeguard measures must provide the data subject with legal rights that are also enforceable under Thai law. These rights must also provide remedial rights for data subjects as stipulated under Thai law.
How can Belaws help?
For more information on how our experts can help your company in relation to the PDPA or this draft notification, why not talk to one of our experts now.
Please note that this article is for information purposes only and does not constitute legal advice.
Our consultations last for a period of up to 1 hour and are conducted by expert Lawyers who are fluent in English, French and Thai.
Consultations can be hosted via WhatsApp or Video Conferencing software for your convenience. A consultation with one of our legal experts is undoubtedly the best way to get all the information you need and answer any questions you may have about your new business or project.
USD 150
Up to 1 hour
Online payment (Paypal or Credit card)
Legal consultation can be conducted in English, French or Thai
Legal consultations are handled by experienced lawyers from the relevant fields of practice
Frequently asked questions
Can a foreigner open a company in Thailand?
Yes it is possible for a foreigner to open a company in Thailand. There are also options available which allow 100% foreign owned companies as well.
How much does it cost to set up a company in Thailand?
The official fees for registering a company in Thailand are THB 7,500.
How do I start a limited company in Thailand?
- Step 1: Choose and register a company name.
- Step 2: Draft and file the Memorandum of Association.
- Step 3: Call and hold a Statutory Meeting of the shareholders
- Step 4: Register the Company with the Ministry of Commerce.
- Step 5: Register the company for Value-Added Tax (VAT) and Income Tax
Is it good to start a business in Thailand?
Thailand is an attractive option for those wishing to start a business. Thailand has a great infrastructure in place and scheme such as the BOI provide great incentives for companies to take advantage of.
How much money do you need to start a business in Thailand?
Typically, it costs between THB 40,000 to THB 60,000 (excluding VAT and Government fees) to start a business in Thailand.The official fees for registering a company in Thailand are THB 7,500.
How can a foreigner start a small business in Thailand?
Yes, foreigners can start a business in Thailand. However, certain business activities are restricted by the Foreign Business Act and in order for businesses to undertake them they must obtain a Foreign Business Licence/Certificate which can be time consuming and complicated.
What is the biggest problem in Thailand?
The biggest problem facing foreign owned companies is being able to undertake their desired business activity as a 100% foreign owned company. Many business activities are protected by the Foreign Business Act and in order for a company to operate in these protected industries, they will be required to be majority owned by Thai Shareholders (unless a BOI promotion has been obtained).
Why is it hard to do business in Thailand?
The Foreign Business Act limits to the business activities a 100% foreign owned company can undertake. This means Thai Shareholders will need to be sought or a BOI promotion obtained in order for a company to legally operate.
Can I own a company in Thailand?
Yes, foreigners can start a business in Thailand. However, certain business activities are restricted by the Foreign Business Act and in order for businesses to undertake them they must obtain a Foreign Business Licence/Certificate which can be time consuming and complicated.
Related articles
Buying real estate in Thailand with crypto-currencies
05/08/2021
Is it possible to use your crypto to buy a property in Thailand? In theory, yes, but in practice it depends.
Is it possible to use your crypto to buy a property in Thailand? In theory, yes, but in practice it depends.
What is the cost of registering a company in Thailand in 2025?
21/10/2021
All you need to know about the cost of creating and registering a company in Thailand.
All you need to know about the cost of creating and registering a company in Thailand.
Raising funds in Thailand with a SAFE
21/10/2021
As an entrepreneur seeking funding in Thailand, there are a variety of term sheet options available, including the SAFE (Simple Agreement for Future Equity).
As an entrepreneur seeking funding in Thailand, there are a variety of term sheet options available, including the SAFE (Simple Agreement for Future Equity).
Subscribe today
Subscribe today
To our newsletter for all the latest legal news
in South East Asia, Belaws updates and
special promotions on our services.
To our newsletter today for all the latest legal news in South East Asia,
Belaws updates and special promotions on our services.
Belaws 2017 - 2025.
Belaws provides information and software only. Belaws is not a "lawyer referral service" and does not provide legal service or participate in any legal representation.
Belaws is not a law firm or a substitute for an attorney or a law firm. The use of Belaws is subject to our Terms of Use.
