In brief
On 27 October 2023, Thailand’s Personal Data Protection Committee (PDPC) published for public consultation two pieces of new draft subordinate rules regarding cross-border transfer of personal data. These two draft rules, namely: (1) Draft Whitelist Notification and (2) Draft Binding Corporate Rules (BCR) and Appropriate Safeguards Notification, upon becoming effective as binding laws, will serve to expand the availability of options for making a lawful transfer of personal data outside Thailand in compliance with the Personal Data Protection Act B.E. 2562 (PDPA).
Stakeholders may provide comments on the drafts until 10 November 2023. Therefore, businesses may need to revisit which cross-border transfer option is appropriate for their cross-border transfer, particularly the compliance of the existing BCRs or Appropriate Safeguards (e.g., SCCs) (if already executed).
In more…
