Sending data to group companies abroad is a cross-border transfer, because each company is a separate legal entity. Under section 29 of the PDPA you can rely on BCR certified by the PDPC Office or on standard contract clauses. This is for DPOs and legal teams of corporate groups, and compares the two routes and their conditions.
- A group company that is a separate legal entity counts as an overseas recipient (TDPG 4.0, F3, which is guidance).
- BCRs need PDPC Office certification: 15 days to check documents, 180 days to review substance, no fee.
- A liable member established in Thailand is mandatory, and the applicant must be that same entity (2025 Regulation, clause 7).
- Standard clauses work at once with no approval, e.g. ASEAN MCC or EU SCC, but must cover the 7 matters in clause 11.
- If you draft your own clauses, the recipient must report a breach back within 72 hours (s.29 notification, clause 10(1)).
Picture a Bangkok company limited that belongs to a foreign group. Every month HR pushes payroll and performance ratings into the parent's global HR system, and sales sends key-account lists to the regional office for reporting. Everyone thinks of it as data moving around inside the house.
Under the Personal Data Protection Act B.E. 2562 (2019), the parent and the subsidiary are two legal persons. A cross-border flow between them needs a basis under section 28 or section 29. This piece compares the two main section 29 tools, Binding Corporate Rules and standard contract clauses, and who each one suits.
Is sending data to a parent company abroad a cross-border transfer?
Yes, if the recipient is a separate legal entity that can access the data. The TDPG 4.0 industry guidelines use the example of a Thai company emailing staff data to its US parent and conclude as follows. TDPG is guidance, not law, and does not bind like the Act. Its source text has an English version, quoted here.
this constitutes the sending or transfer of personal data to a foreign country, because the data recipient located abroad is able to access the personal data sent through email and the internet network. This is so even though it is the sending and receiving of data between companies within the same business group, but which are separate legal entities from one another.
TDPG treats a different set-up differently in F9: one legal entity with branches in Thailand and abroad. When a Bangkok-branch employee sends data to a colleague at a foreign branch of the same entity, the guidelines say this is not a restricted transfer under section 28, because both sides sit under the PDPA.
So the line follows the corporate structure, not the brand or the org chart. Before you pick a tool, check whether each recipient is a branch or a separate company.
How many routes does section 29 give a corporate group?
Two. The first is in paragraph one: a group data protection policy reviewed and certified by the Office, known as Binding Corporate Rules (BCR). Once certified, transfers made under that policy are exempt from section 28.
If such Personal Data protection policy has been reviewed and certified by the Office, the sending or transferring of Personal Data to a foreign country, which is in accordance with such reviewed and certified Personal Data protection policy, can be carried out and shall be exempt from compliance with section 28.
The second is in paragraph three. Where there is no section 28 adequacy decision, or no certified policy yet, the sender must put in place appropriate safeguards that let data subjects enforce their rights and give them effective remedies.
the Data Controller or the Data Processor may send or transfer the Personal Data to a foreign country in exemption to compliance with section 28, if the Data Controller or the Data Processor provides suitable protection measures which enable the enforcement of the data subject’s rights, including effective legal remedial measures according to the rules and methods as prescribed and announced by the Committee.
Clause 8 of the section 29 notification names three forms of appropriate safeguard: contract clauses on the Committee's terms, certification against recognised standards, and binding instruments between Thai and foreign state agencies. For a private group, contract clauses are the common route. Certification under clause 14 follows whatever the Committee prescribes in a separate notification, so check that such a notification exists before relying on it.
What is a BCR, and which group companies can use one?
A BCR is a binding policy or agreement on data protection agreed between senders and recipients in the same group. It only works within a "Group of Undertakings or a Group of Enterprises", which the section 29 notification defines by control.
undertakings which the operator has control and management power over other undertakings or undertakings that are controlled by the operator which has power over other undertakings in the forms of parent company, subsidiaries, affiliates
The 2025 Office Regulation adds terms you need before drafting. Each one is a component the Office will look for in the file.
- BCR-C and BCR-P: the first applies when members transfer and process as data controllers; the second when members act as processors for a third-party controller.
- BCR Member: a group entity that has agreed to be bound by the policy.
- Intra-Group Agreement (IGA): the written contract that makes the policy binding on every member.
- Third-Party Beneficiary Rights: data subjects can exercise rights or sue to enforce the policy directly against members, as if they were parties.
- Liable BCR Member: a member established in Thailand that accepts liability for breaches by overseas members.
a member of the policy which is established in the Kingdom and has an office in the Kingdom, and which is expressly identified in the policy for personal data protection among a Group of Undertakings or a Group of Enterprises as agreeing to accept liability and responsibility for the payment of compensation for any damage arising from a breach of the policy by other members of the policy located outside the Kingdom
This is where the Thai entity should think hard before accepting the role: it pays for damage caused by members abroad. Clause 7, paragraph two, also requires the applicant to be the very same legal person as the liable member.
How do you apply to the PDPC Office for BCR certification?
The PDPC Office Regulation on BCR review and certification, B.E. 2568 (2025), sets out the sequence below. No fee is charged at any stage (clause 19).
- Before filingPrepare the application and documents in Thai: the full policy with its member list, the binding instrument such as a draft IGA, and the company certificate. Foreign-language documents should carry a translation certified by a Notary Public.Regulation cl. 8
- Filing dayFile in person, by post, by email or through another channel the Office sets. Use one channel only.Regulation cl. 9
- Within 15 daysThe Office checks completeness. If complete, it issues a receipt with a reference code; if not, it asks for more.Regulation cl. 13
- During reviewA Case Officer reads the substance and may send written requests for information or corrections.Regulation cl. 14
- Within 180 days of a complete fileThe Secretary-General decides: certify, certify with conditions, or refuse. A certificate in the annexed form follows certification.Regulation cl. 15 · 16
- After the decisionAn applicant who disagrees with a conditional or negative result may appeal under the administrative procedure law.Regulation cl. 18
The Office will complete its consideration of the content of the policy for personal data protection among a Group of Undertakings or a Group of Enterprises within a period of 180 days from the date on which the documents accompanying the application for review and certification are accurate and complete under Clause 8.
The 180 days run from the date the file is complete, not from the filing date, and clause 16 allows overruns for unavoidable reasons tied to group complexity and document quality. Plan a fallback for the waiting period.
Our group already has EU- or UK-approved BCRs. Do we start over?
No. Clause 11 creates a special procedure for BCRs approved under the GDPR, the UK GDPR, or by a country the Committee designates under section 28. The applicant files proof of approval, a copy of the approved policy and a Thai BCR Addendum instead of the full document set.
confirmation that data subjects in Thailand have Third-Party Beneficiary Rights enabling them to lodge complaints and to bring legal proceedings to enforce the policy for personal data protection among a Group of Undertakings or a Group of Enterprises within the Kingdom
The Addendum should also name the Thai liable member, accept the Office's supervision and Thai court jurisdiction, and adjust anything needed to fit the PDPA. The point is simple: a data subject in Thailand must be able to sue in a Thai court, not in the parent's home country.
How far can standard contract clauses replace a BCR?
They work inside and outside the group with no approval step. Clause 10 of the section 29 notification offers two options: clauses the parties draft themselves that cover items (a) to (e) of clause 10(1), or an existing model set.
The contractual clauses established by the parties under the laws of a foreign country or formulated by an international organization, containing content and provisions related to personal data protection, using one of the following model contractual clauses: (a) ASEAN Model Contractual Clauses for Cross Border Data Flows;
Clause 10(2)(b) also accepts the EU Standard Contractual Clauses issued under the GDPR, so groups already on EU SCCs can build on them. Check them against the seven matters in clause 11, such as notice to data subjects, limiting transfers to what is necessary, and remedies. Clause 12 permits non-substantive edits that do not conflict with clause 11.
If you draft your own, the usual gap is breach reporting. The notification requires the overseas recipient to report back within 72 hours, whether it acts as processor or as controller.
the Recipient of personal data must notify the Sender or Transferor of personal data on data breach in the manners as prescribed by the law on personal data protection, without undue delay and within seventy-two hours from the moment of becoming aware of the breach, as soon as it becomes feasible
BCR versus standard clauses: where do they differ?
The table is built from the section 29 notification and the 2025 Regulation. The last row is our own view based on how the two tools work, not a legal requirement.
| Point | BCR (s.29 para. 1) | Contract clauses (s.29 para. 3) |
|---|---|---|
| Who can use it | Only companies in the same group of undertakings or enterprises (notification cl. 3) | Any parties, in or outside the group |
| Prior approval by the PDPC Office | Yes; the Office must review and certify (notification cl. 5–7) | No approval step in the notification; usable once signed |
| Time | 15-day completeness check + 180-day review from a complete file (Regulation cl. 13, 16) | As long as negotiation and signature take |
| Government fee | None (Regulation cl. 19) | None |
| Validity | No expiry, until the Office amends, alters or revokes it (Regulation cl. 17) | The contract term |
| Liable party in Thailand | A liable member established in Thailand is mandatory (Regulation cl. 3, 7) | No such rule, but effective legal remedies are required (notification cl. 10(1)(e), 11(7)) |
| Minimum content | Six principles in Regulation cl. 12, including cooperation with the Office and a RoPA | Clause 10(1)(a)–(e) if self-drafted, or a model set covering the 7 matters in clause 11 |
| Language | Application and documents in Thai; foreign documents should carry a certified translation (Regulation cl. 8) | Not specified |
| Best suited to (our view) | Groups with many entities and countries exchanging data over many years | A few data flows, recipients outside the group, or a bridge while a BCR is pending |
A certification of a policy for personal data protection among a Group of Undertakings or a Group of Enterprises issued by the Office has no expiry period and shall remain in force for so long as it has not been amended, altered or revoked by the Office.
What mistakes do groups make with intra-group transfers abroad?
If the recipient is a separate legal entity, TDPG F3 treats it as a transfer abroad that needs a section 28 or 29 basis.
Clause 11 of the s.29 notification lists seven matters a model set must cover; clause 12 allows non-substantive additions and edits.
Clause 10(1)(c) 4) and (d) require the recipient to report a breach within 72 hours of becoming aware.
Clause 7, paragraph two, requires the applicant to be the same legal person as the liable member.
Clause 9, paragraph two, allows one filing channel only.
Section 29, paragraph three, applies where no certified policy exists yet, so clauses can bridge the gap.
Before choosing a tool, map which data goes to which company, in which country, and why. AIPDPA's processing register records recipients and overseas destinations for each activity, and comes with ready-to-use Thai and English documents. See the RoPA guide.
If you are not sure a flow falls under section 28 in the first place, read When data leaves Thailand, which walks the decision from section 28 to section 29 and the exceptions. If the data sits on the cloud of a state agency or CII, see the 2024 NCSA cloud standard. The overview is in the cross-border transfer guide.
Frequently asked questions
Do we need every employee's consent to send staff data to our foreign parent?
Not necessarily. Section 29 lets you rely on a PDPC-certified BCR or on contract clauses as appropriate safeguards. Consent under section 28(2) is a separate exception, and it requires telling people that the destination's protection may be inadequate.
How long does BCR certification take in Thailand?
Under the 2025 PDPC Office Regulation, the completeness check takes up to 15 days and the substantive review should finish within 180 days of a complete file, with overruns possible for unavoidable reasons.
Is there a fee for BCR certification?
No. Clause 19 of the Regulation states that no fee or service charge is collected.
How long is a certified BCR valid?
There is no expiry. Clause 17 keeps it in force until the Office amends, alters or revokes it.
Can we use EU SCCs for transfers out of Thailand?
Yes. Clause 10(2)(b) of the s.29 notification accepts SCCs issued under the GDPR, provided they cover the seven matters in clause 11; clause 12 allows non-substantive adjustments.
Does a foreign branch of the same legal entity need a BCR?
TDPG 4.0, F9, says data moving within one legal entity between a Thai branch and a foreign branch is not a restricted transfer under section 28. TDPG is guidance, not law, so record your reasoning in the RoPA.
Law and sources
- Personal Data Protection Act B.E. 2562 (2019) — Section 29
- PDPC Notification on Criteria for the Protection of Personal Data Sent or Transferred to a Foreign Country pursuant to Section 29 of the PDPA, B.E. 2566 (2023) — Clause 3 · Clause 5–13
- Regulation of the Office of the PDPC on the Review and Certification of Binding Corporate Rules, B.E. 2568 (2025) — Clause 3 · Clause 7–19
- TDPG 4.0 Thailand Data Protection Guidelines (guidance, not law) — TDPG4.0-F (F3 · F9)
Text in the "The text" boxes is copied word for word from AIPDPA's legal knowledge base, transcribed from the Royal Gazette and official documents; every edit is checked by the system against that base, character by character. English wording is an unofficial translation; the Thai text prevails. This article is general information, not legal advice for a particular case.
Do it in the system
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)