You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

October 7, 2022

Thailand Opens Public Hearing Period on Measures for Cross-Border Transfer of Personal Data

Subscribe to Updates

Thailand’s Office of the Personal Data Protection Committee (PDPC) has opened a public hearing period on its draft notification regarding cross-border transfer of personal data. The public hearing is open through October 24. The notification, once issued, will supplement the principle of cross-border transfer of personal data outside of Thailand set out in the Personal Data Protection Act (PDPA).

The notification sets out the following key matters:

Definitions

  • “Transfer of personal data” means any sending or transferring of personal data by a transferor of personal data, either by way of a physical transfer or a remote transfer through a computer system or an internet network to the recipient of the personal data. It does not include sending personal data through an intermediary by transiting between computer systems or internet networks, or any storing or retaining of personal data, either permanently or temporarily, by a cloud computing service provider, whereby the personal data transferor and the personal data recipient (1) are not making the order, (2) are not involved with any data selection or the content of the personal data sent and received through the computer systems or internet networks, or (3) have the purpose of entering into an agreement or any juristic act.
  • “Binding corporate rules” means the agreed terms or policy on personal data protection made between the personal data transferor and the personal data recipient to establish appropriate measures for safeguarding personal data within a group of corporations or companies.
  • “Standard contractual clauses” means the contractual terms made between the personal data transferor and the personal data recipient to establish appropriate measures for safeguarding personal data.
  • “Code of conduct” means a code that sets out the obligations of a personal data transferor and a personal data recipient outside of Thailand.
  • “Certification” means an undertaking in relation to safeguarding personal data, in order to establish appropriate personal data safeguarding measures.

Binding Corporate Rules

For cross-border transfers within a group of corporations or companies, binding corporate rules (BCRs) can be established and submitted to the PDPC for approval. The BCRs must adhere to the following minimum standards:

  • The effectiveness and legally binding nature of the BCRs apply to each company or entity within the group, including the data recipient, data processor, and data transferor, and the members belonging to the group, as well as their employees, staff, or persons related to the transfer or receipt of personal data within the group.
  • The BCRs must comply with Thai laws on personal data protection.
  • The BCRs must contain certification of data subject rights under the PDPA and sub-regulations.
  • The BCRs must contain measures on personal data protection in relation to personnel, processes, and security measures in accordance with the required technology standards for personal data protection.

Appropriate Safeguards

In accordance with section 29, paragraph 3, of the PDPA, a personal data transferor may transfer personal data to a recipient outside of Thailand when procuring appropriate safeguard measures by way of “standard contractual clauses,” “code of conduct,” or “certification.” Such appropriate safeguards must at least ensure the enforceability of the data subject’s rights and effective legal remedial actions, as provided in the annexes of the notification.

The appropriate safeguards must at least have the following:

  • Effectiveness and legal enforceability.
  • Compliance with Thai laws on personal data protection.
  • Certification of data subject rights under the PDPA and sub-regulations.
  • Measures on personal data protection in relation to personnel, process, and security measures in accordance with the required technology standards for personal data protection.

The standard contractual clauses must be filed with the PDPC. The appropriate safeguard measures must be enforceable under Thai law, and they must provide data subject rights under Thai law. Such rights must also be enforceable and provide remedial rights for data subjects as stipulated under Thai law.

The notification also sets out standard contractual clauses for controller-to-controller and controller-to-processor international transfers. The clauses primarily stipulate the obligations of the transferor and the recipient, recognize the enforceability of the PDPA provisions on personal data protection, and ensure the ability of data subjects to exercise their rights (in the form of third-party rights).

For more information from Tilleke & Gibbins’ data privacy team regarding the draft notification, or any aspect of compliance with PDPA requirements, please contact Athistha (Nop) Chitranukroh at [email protected], Nopparat Lalitkomon at [email protected], Gvavalin Mahakunkitchareon at [email protected], or Thammapas Chanpanich at [email protected].

Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

October 17, 2023
On June 20, 2023, Vietnam’s new Law on Protection of Consumers’ Rights (“CPL 2023”) was officially promulgated, followed two days later by a new Law on E-Transactions (“LOET 2023”). The new laws, which will both take effect from July 1, 2024, replacing the CPL 2010 and the LOET 2005, respectively, provide new regulations for e-commerce platforms and will impact e-commerce activities in Vietnam. Some of the more significant changes are outlined below. Law on Protection of Consumers’ Rights Regulation of offshore entities: Previously, the CPL 2010 regulated only organizations and individuals in the territory of Vietnam. Under the CPL 2023, both onshore and offshore agencies, organizations, and individuals related to protecting consumers’ rights are regulated. In other words, Vietnam intends to monitor and manage activities of platforms with no legal presence in Vietnam. Remote transactions: Previously, the laws on consumer protection regulated “remote contracts.” The CPL 2023 introduces and defines “remote transactions” as transactions made online, by electronic means or by other means wherein consumers cannot check or have direct contact with products, goods or services before participating in the transaction. In addition, the CPL 2023 also provides for additional responsibilities of business entities offering remote transactions such as adequately and precisely providing consumers with information when entering into these remote transactions, including the rights of consumers in case of incomplete or inaccurate provision of information and complaint handling mechanisms. Online businesses: The CPL 2023 introduces “online businesses,” which are defined as (i) those trading products, goods, and services via their self-established platforms or digital platforms or (ii) those establishing or operating intermediary digital platforms. According to the Vietnam Competition Commission in a recent workshop, the definitions of “digital platforms” and “intermediary digital platforms” can be referred to in the LOET 2023 (see below). Under this new category, online
Read More
October 10, 2023
The Royal Decree issued under the Revenue Code B.E. 2481 (1938) on the Exemption from Taxes (No. 779) B.E. 2566 (Royal Decree No. 779), which came into force on August 16, 2023, provides exemptions from corporate income tax (CIT) and value-added tax (VAT) for qualifying transfers of digital tokens for investment. Transfers of these digital investment tokens—as opposed to securities transfers—have been subject to taxes. By establishing CIT and VAT exemptions, Royal Decree No. 779 introduces incentives in order to promote digital investment tokens as a new alternative tool for fundraising. The authorities hope that this will stimulate investment in the country’s economic system and elevate the standards for digital assets in Thailand. The key points of Royal Decree No. 779 are summarized below. Digital Investment Token Definition Royal Decree No. 779 and relevant digital asset regulations define “digital investment tokens” as a type of digital tokens that grant the holder the right to invest in a project or business, with the holders of the digital investment tokens receiving a share of revenue or profits as a return on their investment. In this way, digital investment tokens resemble securities. Tax Exemptions Primary Market Royal Decree No. 779 exempts companies and registered partnerships that legally issue and offer digital investment tokens for sale to the public (i.e., the primary market) from CIT and VAT on income or the value of the tax base earned from the sale. These exemptions apply to all primary market issuance from May 14, 2023, onward. However, the relevant notifications of Thailand’s Securities and Exchange Commission only allow limited companies (private and public) incorporated under Thai law to offer digital tokens for sale. Therefore, registered partnerships will not yet be able to benefit from the tax exemptions in Royal Decree No. 779. If a digital token
Read More
October 2, 2023
Thailand’s National Broadcasting and Telecommunications Commission (NBTC) has issued the Notification of the NBTC Re: Measures to Protect Telecommunications Service Users’ Rights Regarding Personal Data, Privacy Rights, and Freedom of Telecommunications to replace the previous 2006 notification of the same name. The replacement notification supports compliance with the Personal Data Protection Act B.E. 2562 (2019) (PDPA), modernizes the regulations in response to technological change and the convergence of digital business, and enhances the protection of telecommunications users’ personal data, privacy rights, and freedoms. Key aspects of the replacement notification are highlighted below. User Data and Consent The notification specifies that “user’s personal data” includes name, address, ID number, mobile number, usage information, and user behavior that can identify the user. “User” does not include resellers of telecommunications services. To collect, use, or disclose users’ personal data for a purpose other than telecommunications service, service providers must obtain each user’s consent prior to or at the time of collecting the data. The consent (whether written or electronic) must be separate from the telecommunications service agreement. Service providers must clarify the purpose of collecting data, and they must honor users’ rights to opt in and opt out by providing clear and convenient channels for users to withdraw any of their information or cancel any services offered by the operator. Service providers must add an electronic channel for receiving requests from users to review, access, edit, change, or obtain a copy of their data. The electronic channel must also allow requests from users to suspend use or disclosure of their personal data and withdraw consent to collect, use, or disclose their personal data. In addition, service providers must have a system for verifying the identity of users who want to exercise the rights listed in this paragraph. Data Collection and Storage Collection
Read More
September 26, 2023
On September 14, 2023, Thailand’s Personal Data Protection Committee (PDPC) published a notification on the requirements for the appointment of a data protection officer (DPO) in the Government Gazette, taking effect on December 13, 2023. The notification on appointing a DPO lays out the criteria for what constitutes processing of personal data requiring “regular monitoring of the personal data or the system” by reason of “having large-scale personal data,” which requires data controllers and data processors to appoint a DPO under the Personal Data Protection Act B.E. 2562 (PDPA). Criteria After a hearing on the draft DPO appointment notification in July, the published version has been slightly amended while the main criteria for appointment of a DPO are still the same. These have been finalized as follows: When determining whether processing of personal data requires regular monitoring due to having large-scale personal data, only the “core activity” of the data controller or data processor is to be taken into consideration. The term “core activity” denotes an essential and integral activity directly related to the primary operations of the data controller or data processor and does not include any supplementary business activities (e.g., human resources and information technology activities). “Processing activities that require regular monitoring of personal data” refers to activities relating to tracking, monitoring, analyzing, or predicting the behavior, attitude, or profile of individuals, and generally involves the processing of personal data in a systemic manner on a usual or regular basis. Examples include membership card programs, credit scoring, insurance premium consideration, fraud prevention, processing of personal data by computer network system service providers or telecommunications operators, behavioral advertising, and so on. To determine whether processing activities constitute “large-scale processing of personal data,” various factors are considered: Volume, type, or nature of personal data processed; Duration or permanence of
Read More