How to choose a public cloud that meets Thailand's NCSA rules Under Clause 4 of the NCSA Office's 2024 notification on public cloud with a primary data centre in Thailand, a system graded “high” impact must run on a cloud with its primary data centre in Thailand, plus a backup in Thailand or in Southeast Asia as close as possible to the main users, including Singapore and Hong Kong. The exception: if the state security and public order dimension is only low or medium, a Thai primary site is not required. Low- or medium-impact systems may choose freely.
A Thai software company was about to close a SaaS deal with a government agency when the client's IT team asked: “Is your primary data centre in Thailand, and where is your backup?” The sales team had no answer and no paperwork, and the deal stalled for weeks.
What you need to know
The 5 points that matter most, drawn from the law and guidance cited at the end of this guide. Read just this part and you can decide your next move.
- The rules bind state agencies, regulatory or supervisory agencies and Critical Information Infrastructure (CII) organisations, not ordinary private companies.
- High-impact systems need a primary data centre in Thailand (data localisation) and a backup in Thailand or Southeast Asia, including Singapore and Hong Kong.
- A system that is high overall but only low or medium on state security and public order does not have to use a Thai primary data centre.
- Personal data must be graded at least medium for confidentiality.
- The Cloud Security Standard took effect on 11 September 2026; a summary report goes to the NCSA Office within 30 days of completing the work.
How to do it in 7 steps
Work through these 7 steps in order. Each one is written so a team in a Thai organisation can act on it without waiting for a consultant, and keep the evidence an auditor will ask for.
- Check whether you are in scopeConfirm whether your organisation is a state agency, a regulatory or supervisory agency, or a CII organisation under the Cybersecurity Act B.E. 2562 (2019). If you sell systems to these bodies, prepare your data centre facts for their questions.
- List every system going to the cloudInventory each data set or information system that will use public cloud, by service type such as IaaS, PaaS or SaaS, so each one can be assessed on its own.
- Grade impact dimension by dimensionAssess under the NCSC's 2023 standard on cybersecurity characteristics, read with the NCSA Office's 2024 guideline or your regulator's own guideline. Keep the result for every dimension, especially state security and public order.
- Decide where the data centre must beHigh impact means a Thai primary site plus a backup. High overall but low or medium on state security means a Thai primary site is optional. Low or medium impact leaves the choice to you.
- Set the floor for personal dataIf a system holds personal data, grade confidentiality at least medium and meet no less than the minimum requirements annexed to the 2024 Cloud Security Standard.
- Put locations in the contractA good practice is to have the cloud provider state its primary and backup data centre locations in writing and give advance notice before moving them.
- Report to or notify the NCSA Office on timeSend a summary report to the NCSA Office within 30 days of completing the work. If you cannot meet the Cloud Security Standard, notify the Office in writing so it can refer the matter to the National Cyber Security Committee.
Who has to follow the NCSA public cloud rules?
The rules apply to state agencies, regulatory or supervisory agencies and CII organisations under the Cybersecurity Act B.E. 2562 (2019), which Clause 3 of the 2024 Cloud Security Standard calls “agencies”. Private companies outside these groups are not directly bound.
A cloud service provider can be a state body or a private company. If you sell cloud or SaaS to in-scope agencies, have your data centre details ready, because those clients must apply these criteria when they pick a provider.
When must a cloud have its primary data centre in Thailand?
Only when the data or system is graded high impact, under Clause 4, paragraph one, of the NCSA Office's 2024 public cloud notification. That notification took effect on the day it was announced, 26 December 2024.
- High: a primary data centre in Thailand and a backup in Thailand or in Southeast Asia as close as possible to the main users, including Singapore and Hong Kong (Clause 4, paragraph one).
- High, but low or medium for state security and public order: a Thai primary data centre is not required (Clause 4, paragraph two).
- Low or medium: a Thai primary data centre is optional (Clause 5).
When did the Cloud Security Standard take effect, and what else does it require?
The NCSC's Cybersecurity Standards for Cloud Systems B.E. 2567 (2024) were published in the Royal Gazette on 10 September 2024 and took effect after two years, on 11 September 2026. Agencies using public cloud must meet at least the minimum requirements annexed to it, taking into account each system's impact level (Clause 4).
For personal data, confidentiality impact must be graded at least medium (Clause 5). A summary report must reach the NCSA Office within 30 days from the date the work is completed (Clause 6).
What should a private company outside the scope do?
A private company that is not an in-scope agency is not bound by these two notifications, but they make a sound benchmark. A good practice is to rank your data by importance before choosing a cloud and to know exactly where your primary and backup data centres are.
Common problems and how to fix them
Most organisations slip on the same 4 points. The table shows how to fix each one yourself, and how AIPDPA gets it done faster with the evidence in place.
| Problem | Fix |
|---|---|
| ✗ Recording only the single highest impact level, not each dimension. | ✓ The Clause 4 exception only works if you can show the state security and public order score separately. Record every dimension on its own, then use AIPDPA's security controls register to work through the NCSA cloud standard requirements one by one. |
| ✗ Assuming the backup must be in Thailand, or only in Singapore or Hong Kong. | ✓ The text allows a backup in Thailand or in Southeast Asia as close as possible to the main users, expressly including Singapore and Hong Kong. Get the real locations from your provider in writing, then log the provider in AIPDPA's vendor register with its risk assessment. |
| ✗ Grading personal data as low impact to cut the workload. | ✓ Clause 5 of the Cloud Security Standard sets a floor of medium confidentiality for personal data. Set it from day one, then use AIPDPA to see which minimum controls are still missing. |
| ✗ Finishing the work but forgetting the report to the NCSA Office. | ✓ Clause 6 of the Cloud Security Standard requires a summary report within 30 days of completion. Note the completion date and the deadline straight away, and use AIPDPA's controls register to keep the status of every control in one place for the report. |
See which cloud security controls you still need, on one screen
AIPDPA maps your security controls against PDPC guidance, the ETDA framework, the NCSA cloud standard and the NCSA website security standard. See the demo account, no sign-up needed; paid plans from 2,900 THB a year (no VAT added).
Included in the GROWTH, PRO and ENTERPRISE plans, from 4,900 THB/year · demo account, no sign-up
Frequently asked questions
The questions people search for most on this topic. Each answer is short, direct and stands on its own.
Does a private company in Thailand have to use a Thai data centre?
Not under these two notifications, unless it is a regulatory or supervisory agency or a CII organisation. If you sell cloud or SaaS to government or CII clients, expect to be asked where your data centres are.
Can the backup data centre be outside Thailand?
Yes. For high-impact systems, Clause 4 allows the backup in Thailand or in Southeast Asia as close as possible to the main users, and it expressly includes Singapore and Hong Kong.
What impact level applies to personal data in the cloud?
At least medium for confidentiality, under Clause 5 of the NCSC Cybersecurity Standards for Cloud Systems B.E. 2567 (2024).
When did Thailand's cloud security standard come into force?
On 11 September 2026. It was published in the Royal Gazette on 10 September 2024 and took effect once two years had passed.
What if an agency cannot meet the cloud standard?
It must notify the NCSA Office in writing, and the Office will put the matter to the National Cyber Security Committee for consideration, under Clause 6 of the 2024 public cloud notification.
How many days do we have to report to the NCSA?
Thirty days from the date the work is completed, under Clause 6 of the 2024 Cloud Security Standard.
Sources
This guide relies on 9 sources. Statutes are cited by section or clause; guidelines and standards are guidance, not law.
- Notification of the Office of the National Cyber Security Agency on Guidelines for Using Public Cloud Services with a Primary Data Centre in Thailand B.E. 2567 (2024), Clause 3
- Notification of the Office of the National Cyber Security Agency on Guidelines for Using Public Cloud Services with a Primary Data Centre in Thailand B.E. 2567 (2024), Clause 4
- Notification of the Office of the National Cyber Security Agency on Guidelines for Using Public Cloud Services with a Primary Data Centre in Thailand B.E. 2567 (2024), Clause 5
- Notification of the Office of the National Cyber Security Agency on Guidelines for Using Public Cloud Services with a Primary Data Centre in Thailand B.E. 2567 (2024), Clause 6
- Notification of the National Cyber Security Committee on Cybersecurity Standards for Cloud Systems B.E. 2567 (2024), Clause 2
- Notification of the National Cyber Security Committee on Cybersecurity Standards for Cloud Systems B.E. 2567 (2024), Clause 3
- Notification of the National Cyber Security Committee on Cybersecurity Standards for Cloud Systems B.E. 2567 (2024), Clause 4
- Notification of the National Cyber Security Committee on Cybersecurity Standards for Cloud Systems B.E. 2567 (2024), Clause 5
- Notification of the National Cyber Security Committee on Cybersecurity Standards for Cloud Systems B.E. 2567 (2024), Clause 6
The law cited here comes from AIPDPA's legal knowledge base, transcribed from the Royal Gazette · This is general information; if your situation has unusual facts, our lawyers can review it with you.
Tools and services that help right now
Want to do it yourself, faster? Use the tools in AIPDPA. Want a lawyer to handle it, or to learn the skill yourself? Pick the service in our network that fits.
PDPC, ETDA and NCSA requirements in one place — do the work once, evidence several standards.
Join the waitlist →Know who processes data for you, how risky they are and whether the contract is in place.
Join the waitlist →News and analysis on tech law as it happens worldwide.
Read the latest →Courses to build PDPA, DPO and AI-governance skills, plus ready-to-use digital toolkits.
See courses & products →
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)
Keep reading
Guides that usually come next after this one. Read them in the order your organisation needs.