AIPDPAAi PDPA
ไทยEnglish

Theme — used on every page, including the app

LightDarkSystem

Skin — the same set as the app, remembered on every page

SignatureOrange FoxDeep SeaAppleIndigoNitroZestyMonoLatteIn Love
WaitlistJoin the waitlist
Articles · 5

Cloud and cross-border data articles

Cloud and cross-border data articles are 5 AIPDPA pieces that quote Thai law word for word and say what organisations must do. They suit DPOs, legal teams and business owners, who get answers with the legal text and links to read further.

Last updated · by

Cloud and cross-border data

Photo of tangled network cables forming a maze, with one clearly routed cable lit by a warm light.Cloud and cross-border data

CCTV in the cloud and on apps: questions to ask first

The 2026 NCSA guideline does not ban the cloud or P2P. It asks where the data is, who can reach it, who holds the keys and how you leave. Those questions, arranged as tables you can use.

16 October 2026 · 16 min readTwo Thai public-sector IT officers compare a printed cloud service contract against a laptop, with server racks visible behind a glass wall.Cloud and cross-border data

Moving to the cloud: who Thailand's 2024 cloud security standard binds

The NCSA cloud cybersecurity standard took effect on 11 September 2026. Government agencies, critical information infrastructure operators and the cloud providers that serve them now have to classify data, pick certified providers and write tighter contracts.

14 October 2026 · 10 min readA Thai HR director and legal manager on a video call with colleagues at the overseas parent company, with policy documents on the table.Cloud and cross-border data

Sending data to group companies abroad: BCR or standard clauses?

A Thai subsidiary sends staff and customer data to its parent every day. Even inside one group, that is a transfer abroad. Section 29 offers two routes: Binding Corporate Rules certified by the PDPC Office, or contract clauses on the Committee's terms.

14 October 2026 · 11 min readA customer support team lead in a Bangkok office points to a printed process chart for a colleague in the evening.Cloud and cross-border data

When data leaves Thailand: section 28, step by step

Foreign SaaS, offshore support, monthly reports to head office: not every one counts as a transfer abroad. Walk it through in order, from the definition in the section 28 notification to section 29 and then the exceptions.

14 October 2026 · 9 min readAerial night view of Bangkok with traffic light trails converging on the Chao Phraya, and a thin dotted line leaving the frame.Cloud and cross-border data

Cloud email and shared drives: when does your data leave Thailand?

Almost every Thai company runs on email, drives, chat and video calls hosted outside the country. Server location is not the test. What the PDPA looks at is who can access the data. This guide goes action by action: what counts as a transfer, what does not, and which basis applies when it does.

14 October 2026 · 8 min read

Topic index

Articles per topic and the latest piece in each
TopicArticlesLatest
Data breaches7CCTV Footage Leaked? What to Do in the First 72 Hours · 16 October 2026
Overlapping laws390-Day Logs vs the Right to Erasure: When Thailand's Computer Crime Act and the PDPA Pull Apart · 14 October 2026
AI at work9Face-scan cameras at work: how strong a reason do you need? · 16 October 2026
HR and employee data4AI in hiring and staff evaluation: what HR must watch · 14 October 2026
PDPC opinions2The PDPC Has Answered: 8 Real PDPA Questions from Thai Organisations · 14 October 2026
Cloud and cross-border data5CCTV in the cloud and on apps: questions to ask first · 16 October 2026
PDPA in practice17CCTV already installed? Secure it in seven steps this week · 16 October 2026
Cybersecurity11Viewing CCTV on your phone: fix factory passwords and P2P first · 16 October 2026
Intellectual property6An NDA That Actually Protects Your Trade Secrets · 14 October 2026
Global AI rules4The 10 AI practices the EU AI Act bans outright, and which Thai businesses could be caught · 14 October 2026
Phuwara Krobtaku

Who stands behind this guide?

Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel

Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)