Cloud email and shared drives: when does your data leave Thailand?

HR emails the payroll file. Sales keeps the customer list in a shared drive. Customer service chats with clients in group threads. All of it runs on cloud services with servers mostly outside Thailand, so DPOs keep hearing the same question: are we transferring data abroad every single day?

Not necessarily. The Personal Data Protection Act B.E. 2562 (2019) and the PDPC's notifications do not decide by server location; they ask whether anyone outside the organisation can access the data. The general rules are covered in When data leaves Thailand. This article focuses on the everyday tools everyone uses.

Do cloud email and drive services count as cloud providers under the PDPC notification?

Yes. Clause 3 of the PDPC's 2023 notification under Section 28 defines cloud computing service providers broadly and lists Software as a Service (SaaS) among the examples. Online office suites fall within it.

Being a cloud provider does not make every use a transfer. The definition of "sending or transferring personal data" in the same clause excludes transit and storage that no outsider can access, and names the cloud case backed by technical measures or legal conditions explicitly.

Emailing a colleague in Thailand through a foreign server: is that a transfer?

TDPG 4.0 says no, if the recipient is in Thailand and nobody in the server's country accesses the data; that country is mere transit. TDPG is an industry guideline, not binding like the Act, but its reasoning in paragraph F5 tracks the notification's definition.

The same logic covers files stored in the company drive. In paragraph F11, TDPG notes that storing data in a cloud system on servers outside Thailand may not be a transfer if no one outside Thailand can access it. The word "may" matters: it depends on being able to show that outsiders really cannot get in.

So when does using these tools become a real transfer?

When someone outside your organisation, located abroad, can see or use the data. The clearest case is emailing or sharing files with a recipient abroad, even a group company. TDPG paragraph F3 uses the example of employee data emailed to a parent company in the United States and concludes:

The case people miss is access from the provider's side. If the service terms let the provider's support staff or affiliates abroad view your data, an outsider has access, and the storage exclusion no longer helps. Read that part of your provider's terms closely.

Use by use: what is a transfer and what is not

This table is our analysis based on clause 3 of the Section 28 notification and the TDPG examples, under the assumptions stated in each row. If your facts differ, the result may too.

If it is a transfer, which basis applies?

There are three routes. The destination has adequate protection under Section 28, paragraph one. One of the exceptions in Section 28 (1) to (6) applies. Or appropriate safeguards are in place under Section 29 and the PDPC notification issued under it.

Route one: an adequate destination

Clause 6 of the Section 28 notification lets the PDPC decide case by case or publish a list of countries deemed adequate. Our knowledge base contains no such list, so do not start from the assumption that any country has already passed.

Route two: a Section 28 exception

An exception such as performance of a contract with the data subject under Section 28 (3) works for specific tasks, like sending a traveller's name to an overseas hotel the customer booked. It is a poor basis for running company-wide email or storage, because most daily use is not necessary for a contract with any particular data subject.

Route three: appropriate safeguards under Section 29

For workplace tool providers this is the route most often used. Clause 8 of the PDPC's 2023 notification under Section 29 recognises three forms: contract clauses, certification, and instruments between state agencies. Clause 10 (2) accepts two foreign model clause sets.

In practice, open the provider's data processing terms and see which clause set they rely on. One of these two is a good start, but clause 10 sits under clause 9: the clauses must be enforceable, recognise data subject rights, and carry security measures no weaker than Thailand's legal minimum.

When you leave a service, what happens to the data left behind?

If you rely on clauses drafted by the parties under clause 10 (1) and the provider is a processor, the clauses must require return, deletion or destruction of the data with written confirmation, under 10 (1) (c) 3). The next item, 4), has the recipient report breaches back within 72 hours of becoming aware, as soon as feasible.

Even under model clauses, exiting a service deserves its own procedure: export what you must keep, ask for proof of deletion, and log the date in your retention records.

What is the risk of ignoring Sections 28 and 29?

Section 83 of the PDPA sets an administrative fine of up to 3 million baht for a data controller who fails to comply with Section 28, or who transfers data other than in accordance with Section 29, paragraph one or three.

How can you get your tools in order this week?

1. List every online tool actually in use, including ones departments signed up for on their own.
2. Open each provider's data processing terms: who can access data, and which clause set do they rely on?
3. Use the table above to separate transfers from non-transfers, and write down the basis for each transfer.
4. Record each transfer in your record of processing activities (RoPA).
5. Set internal rules on sharing outside the organisation, such as public links off by default.

Steps 3 and 4 are where most organisations stall. AIPDPA's RoPA register prints a Section 39 report and keeps each tool's transfers and bases in one place. See it in the demo account.

Who stands behind this guide?

Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel

Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)