When data leaves Thailand: section 28, step by step

Almost no Thai company keeps its data purely inside Thailand anymore. CRM, email and chatbots usually come from overseas vendors, some firms run support teams abroad, and subsidiaries of foreign groups send reports to head office every month.

The first question is not whether the destination has good enough law. It is whether this is a transfer abroad at all. Get that wrong and every later step is wrong too. This piece follows the order set by the Personal Data Protection Act B.E. 2562 (2019), the two 2023 PDPC notifications and the TDPG 4.0 guidelines.

Is using a foreign SaaS or cloud service already a transfer abroad?

Not necessarily. It depends on whether an outsider can access the data. Clause 3 of the PDPC notification on transfers under section 28 defines "sending or transferring personal data" and carves out two cases: mere transit, and storage that no outsider can access.

The same definition names cloud services directly and puts the key condition at the end: the lack of outside access must rest on something. Saying the vendor never looks at your data is not enough.

A clear technical measure is encryption with keys the company holds itself. A legal condition could be a contract term barring provider access. If the SaaS contract lets the vendor's support team view your data to fix problems, the carve-out does not apply.

The TDPG 4.0 guidelines show the difference with an example. TDPG is industry guidance, not law. Data stored on a server in India that no outsider can reach is not a transfer; configure the system so a Singapore analytics firm can use the same data, and the answer changes.

Another common question: an employee travels abroad and opens work email containing customer data. TDPG F7 says this is not access abroad, as long as the employee is working for the company and following its data protection standards.

If it is a transfer, what does section 28 require?

That the receiving country or international organisation has adequate data protection standards under criteria set by the Committee, unless one of the six exceptions in the same section applies.

Those criteria sit in the 2023 section 28 notification, in force since 25 March 2024. Clause 5 looks at two facts together.

1. The destination's law or mechanisms align with Thai law, especially on security duties, enforceable data subject rights and effective remedies (clause 5(1)).
2. An authority with power to enforce data protection law exists in the destination country or organisation (clause 5(2)).

Where adequacy is in doubt, the Committee decides. Section 28, paragraph three, sends the question to the Committee, and clause 6 of the notification lets it decide case by case or publish a list of countries.

"May" means it is a power the Committee can choose to use. Before you claim a country qualifies, check the PDPC Office website for an actual decision or list. Do not borrow another regime's list, such as the EU's adequacy decisions.

What has the PDPC Office said about this?

The PDPC Office's book of consultation answers includes Bank Z, which had to send its directors' data to ACRA, Singapore's corporate regulator, and asked whether the section 28(1) "compliance with law" exception covers foreign law. The book has no English version, so the Thai answer is quoted as published.

In plain English: the law relied on must be one that binds the data controller, so the section 28(1) exception only covers compliance with Thai law. On the second issue, the answer noted that at the time there were no criteria and no adequacy decisions, so the bank had to look at other exceptions such as section 28(3), performance of a contract to which the director is a party, and fall back on consent under section 28(2) only if nothing else fit. The criteria notification has since been issued, but the reasoning still holds.

How do you walk the decision from section 28 to section 29 and the exceptions?

TDPG 4.0, chapter F, sets the order: check adequacy first; if there is none, look to BCRs or appropriate safeguards; the exceptions come last. The table turns that order into questions. Stop at the first one you can answer yes.

For most private companies the real answer lands at step 3: contract clauses under the section 29 notification, which may use model sets such as the ASEAN MCC or EU SCC. The detail, and how they compare with BCRs, is in Sending data to group companies abroad.

When can you rely on the exceptions in section 28(1)–(6)?

Only when the specific transfer genuinely fits one of them. The exceptions were not designed to carry routine daily flows. TDPG describes the compliance-with-law exception this way.

The exception people reach for first is consent. Section 28(2) asks for more than ordinary consent: the data subject must first be told that the destination's protection is inadequate.

• (1) Compliance with law: Thai law that binds the controller; the destination's law does not count (Bank Z answer).
• (2) Consent: after telling people protection is inadequate. TDPG F33 suggests naming the recipient, the country, the reason, the data types, the right to withdraw and the risks.
• (3) Necessary for a contract with the data subject: for example, booking an overseas hotel for a customer who bought a tour package.
• (4) A contract with another party for the data subject's benefit: the data subject is not a party but benefits from the contract.
• (5) Preventing danger to life, body or health when the data subject cannot consent at the time; TDPG F36 says this generally means matters of life and death.
• (6) Substantial public interest: TDPG F37 says it must be a public interest recognised by Thai law.

Which step do common situations fall under?

Each case states its assumptions in the title. If your facts differ, the result may too, so run the decision table again.

That last case involves more than the PDPA; see ChatGPT at work: four laws. Cloud security rules for state agencies and CII are covered in the 2024 NCSA cloud standard.

Where should a company start?

Start with an inventory: every system or vendor located abroad or reachable by people abroad. Answer step 0 for each one first. That step alone usually shortens the list you actually need to fix.

AIPDPA's processing register records the destination country and the transfer basis for each activity and prints a Section 39 report. For the overview and related templates, see the cross-border transfer guide.

Who stands behind this guide?

Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel

Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)