How to transfer personal data abroad or use overseas cloud under the PDPA Under Section 28 of the Personal Data Protection Act B.E. 2562 (2019), you may send or transfer personal data abroad if the destination country or international organisation has adequate data protection standards, or if an exception applies, such as consent after telling people the standards are inadequate, or necessity for a contract with them. Section 29 also allows certified binding corporate rules or appropriate safeguards under the 2023 notification.
A Bangkok online retailer runs its customer management on an overseas SaaS platform and sends weekly sales reports with customer names to its regional head office. One day a foreign executive asks whether all this complies with the PDPA. Nobody on the team can answer.
What you need to know
The 6 points that matter most, drawn from the law and guidance cited at the end of this guide. Read just this part and you can decide your next move.
- The default rule is that the destination must have adequate protection standards under criteria set by the Committee (Section 28).
- The Section 28 and Section 29 notifications of 2023 have been in force since 25 March 2024.
- Storing data with a cloud provider where no outside party can access it, thanks to technical measures or legal conditions, falls outside the notifications' definition of a transfer.
- Consent works as an exception only after you tell people the destination's standards are inadequate.
- Transfers within a corporate group can rely on binding corporate rules (BCR) reviewed and certified by the PDPC Office (Section 29).
- Without an adequacy decision or BCR, you can rely on appropriate safeguards that make data subject rights enforceable and provide effective legal remedies.
How to do it in 7 steps
Work through these 7 steps in order. Each one is written so a team in a Thai organisation can act on it without waiting for a consultant, and keep the evidence an auditor will ask for.
- Map data leaving ThailandList every overseas cloud service, SaaS tool, group company and vendor, and record the destination country, recipient and mechanism in your Record of Processing Activities (RoPA).
- Separate transfers from mere storageCheck whether anyone besides you and your staff can access the data. If no one can because of technical measures or legal conditions, it may fall outside the definition of a transfer; a good practice is to keep evidence of those measures.
- Assess the destination's adequacyCheck whether the Committee has ruled on or listed the destination, and weigh the Clause 5 factors: data protection law consistent with Thailand's, and an authority that enforces it.
- If inadequate, use a Section 28 exceptionPick the exception that matches the facts, such as legal compliance, consent after disclosing the inadequate standards, or necessity for a contract with the data subject.
- For group companies, use BCRIf you transfer within the same group of undertakings for a joint business, adopt binding corporate rules and submit them to the PDPC Office for review and certification.
- Otherwise, put appropriate safeguards in placeRely on appropriate safeguards under Section 29 paragraph 3 and the 2023 notification. A good practice is a written agreement with the overseas recipient, checked against the notification.
- Record and reviewKeep the results of each check with the activity, and review them whenever you change provider or destination country.
Does using an overseas cloud count as transferring data abroad?
Not always. The Committee's 2023 notifications under Sections 28 and 29 define a transfer so that it excludes acting merely as a conduit for data in transit, or storing data where no outside party can access it other than the sender and the sender's own staff.
The notifications give the example of passing data through a cloud provider's system that no one else can access because technical measures or legal conditions prevent it. If the provider or anyone else can access the data, that carve-out does not apply and the transfer must meet Section 28 or 29.
Which destinations count as having adequate standards?
Clause 5 of the Section 28 notification looks at two factors: whether the destination has legal measures consistent with Thai data protection law, and whether it has an authority empowered to enforce them.
Under Clause 6, the Committee may decide case by case or set a list of countries or international organisations treated as adequate. Controllers may submit a question for decision, and the PDPC Office may ask for a review when new evidence emerges.
- The destination's law requires appropriate security measures.
- Data subjects can enforce their rights.
- Effective legal remedies are available.
- An authority has the duty and power to enforce data protection law.
Can you still transfer data if the destination is not adequate?
Yes, if one of the Section 28 exceptions applies, or you use a Section 29 route: binding corporate rules certified by the PDPC Office, or appropriate safeguards under the Committee's criteria.
- Compliance with the law.
- Consent, after telling the person that the destination's standards are inadequate.
- Necessary to perform a contract with the person, or to act on their request before entering one.
- Acting under a contract between the controller and another party for the person's benefit.
- Preventing or suppressing danger to life, body or health when the person cannot consent at that time.
- Necessary for an important public-interest task.
How do you send data to a parent or group company abroad?
Use binding corporate rules (BCR) that the PDPC Office has reviewed and certified. Under Section 29, transfers made in line with certified rules are exempt from Section 28.
The Section 29 notification defines a group to include parent, subsidiary and associated companies and others linked legally or through joint business, and defines BCR as a binding policy or agreement between the sender and the recipient.
Common problems and how to fix them
Most organisations slip on the same 4 points. The table shows how to fix each one yourself, and how AIPDPA gets it done faster with the evidence in place.
| Problem | Fix |
|---|---|
| ✗ Assuming any overseas cloud is unlawful, or assuming the PDPA does not apply to it at all. | ✓ Check each system for outside access against the 2023 definition. The AIPDPA vendor register keeps your providers and their risk in one place, so you can see which to check first. |
| ✗ Asking for consent to transfer data abroad without saying the destination's standards are inadequate. | ✓ Section 28(2) only works once that has been disclosed, so state it clearly in the consent form. AIPDPA Ready-to-use documents includes Thai and English consent forms and data processing agreements (DPA), ready to use straight away. |
| ✗ Sending customer data to head office every week with no BCR or safeguards. | ✓ Pick a clear route: adequacy, a Section 28 exception, certified BCR, or Section 29 safeguards. If you want the whole setup done for you, Kooru Data Shield provides a lawyer-led PDPA readiness check and full setup. |
| ✗ Nobody knows which countries the company's data ends up in. | ✓ Record each transfer against its activity. The AIPDPA RoPA register has fields for destination country, recipient, mechanism and safeguards, and prints a report for auditors. |
Know where your data goes abroad, and on what legal footing
The AIPDPA RoPA register records every cross-border transfer by activity, including destination country, recipient, mechanism and safeguards, and pairs with the vendor register to track provider risk. See the demo account, no sign-up needed.
Included in every plan, from 2,900 THB/year · demo account, no sign-up
Frequently asked questions
The questions people search for most on this topic. Each answer is short, direct and stands on its own.
Is using overseas email or cloud file storage a PDPA breach?
Not automatically. If the provider only stores the data and no outside party can access it because of technical measures or legal conditions, it is not a transfer under the 2023 notifications. If others can access it, Section 28 or 29 must be met.
Which countries have adequate data protection standards?
Under Clause 6 of the Section 28 notification, the Committee may decide case by case or publish a list of destinations. Check whether a decision exists for your destination; if not, use a Section 28 exception or a Section 29 route.
Can customer consent replace an adequacy check?
Consent is one exception under Section 28(2), but only after you tell the person the destination's standards are inadequate. A good practice is to use it when no other route fits, because you must keep evidence of every person's consent.
Do data processors have to follow the cross-border rules too?
Section 29 applies to both controllers and processors located in Thailand, and the Section 29 notification defines the sender to include processors.
When did the cross-border transfer notifications take effect?
The Section 28 and Section 29 notifications of 2023 apply 90 days after publication in the Royal Gazette and have been in force since 25 March 2024.
What if we are unsure whether a destination is adequate?
Section 28 lets the question be referred to the Committee for a decision, and Clause 6 of the notification lets the PDPC Office accept submissions from controllers. Meanwhile, rely on a Section 28 exception or a Section 29 route.
Sources
This guide relies on 4 sources. Statutes are cited by section or clause; guidelines and standards are guidance, not law.
- Personal Data Protection Act B.E. 2562 (2019), Section 28
- Personal Data Protection Act B.E. 2562 (2019), Section 29
- Personal Data Protection Committee Notification on Criteria for Protecting Personal Data Sent or Transferred Abroad under Section 28 of the PDPA B.E. 2566 (2023), Clauses 3–6
- Personal Data Protection Committee Notification on Criteria for Protecting Personal Data Sent or Transferred Abroad under Section 29 of the PDPA B.E. 2566 (2023), Clause 3
The law cited here comes from AIPDPA's legal knowledge base, transcribed from the Royal Gazette · This is general information; if your situation has unusual facts, our lawyers can review it with you.
Tools and services that help right now
Want to do it yourself, faster? Use the tools in AIPDPA. Want a lawyer to handle it, or to learn the skill yourself? Pick the service in our network that fits.
The register fills itself from your org chart, picks the lawful basis with its section, and prints a Section 39 report in one click.
Join the waitlist →Know who processes data for you, how risky they are and whether the contract is in place.
Join the waitlist →40 ready-to-use documents in Thai and English, with all 88 AI-added clauses confirmed, filled from your registers, with a QR to verify the approved copy.
Join the waitlist →A lawyer-led team checks your readiness and sets up PDPA end to end — ideal for SMEs without the time.
See the service →Courses to build PDPA, DPO and AI-governance skills, plus ready-to-use digital toolkits.
See courses & products →
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)
Keep reading
Guides that usually come next after this one. Read them in the order your organisation needs.