Educational Information Only
The content on this page is for general educational purposes and does not constitute legal advice. Every legal situation is unique. For matters involving investigation, arrest, litigation, or formal proceedings, consult a qualified legal professional.
Thai Data Localisation + Cross-Border Transfer Rules
Thailand has no general data-localisation requirement — but sectoral rules (BOT, OIC, NBTC) apply, and PDPA §28-29 governs cross-border transfer of personal data. This guide explains the patchwork.
TL;DR
Thailand has no general data-localisation requirement. Sectoral rules (BOT for banks, OIC for insurers, NBTC for telcos) impose specific localisation or notification for sensitive operational data. The PDPA §28-29 governs cross-border transfer of personal data — requiring an adequacy assessment by PDPC, binding contractual clauses, consent, or other lawful mechanisms.
PDPA Cross-Border Transfer Mechanisms
| Mechanism | PDPA Section | Notes |
|---|---|---|
| Adequacy by PDPC | §28 | Country recognised — limited list to date |
| Standard contractual clauses | §29(1) | PDPC-approved clauses |
| Binding corporate rules | §29(2) | For intra-group transfers |
| Consent | §29(3) | Informed + specific |
| Performance of contract | §29(4) | Necessary for the contract |
| Public interest / vital interest / legal claim | §29(5-7) | Narrow |
Sectoral Localisation Examples
- BOT — bank core systems with operational-resilience requirements.
- OIC — insurer policy data backup.
- NBTC — telco subscriber records (under SIM-registration rules).
- Healthcare — sensitive records subject to enhanced safeguards.
Operational Programme
- Data inventory + lawful-basis mapping.
- Identify all cross-border flows.
- Select PDPA §29 mechanism per flow.
- Sectoral overlay check.
- Annual review + record-keeping.
Common Mistakes
- Assuming consent is the universal mechanism.
- Missing sectoral overlay for banks / insurers / telcos.
- Not documenting BCRs / SCCs.
- Onward transfer ignored.
FAQs
1. Are SCCs available?
PDPC has published model contractual clauses; sector-specific guidance evolves.
Related Reading
Professional Legal Assistance
blog.ctaContext
Anglo Siam Legal provides experienced legal services across Thailand for both Thai nationals and foreigners.
Stay Informed
Get the latest updates on Thai law changes, new guides, and legal resources delivered to your inbox.
We respect your privacy. Unsubscribe anytime.
feedback.wasThisHelpful