ThailandPersonal Data Protection Act, cross-border transfer
Personal Data Protection Act B.E. 2562 (2019), Section 28
In force since .
A cross border transfer rule binding private bodies.
- Audit expectation
- none
What it requires
- An app transferring the personal data of an individual in Thailand to a recipient in another country must ensure the destination has an adequate data protection standard, following the Committee's prescribed rules, unless a statutory exception such as informed consent to an inadequate destination applies.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does the consent exception in Section 28, which requires that the data subject 'has been informed of the inadequate Personal Data protection standards of the destination country or international organization', require the controller to describe the destination's standards to the data subject, or only to tell the data subject that the destination is not adequate?
- Who submits to the Committee a 'problem with regard to the adequacy of Personal Data protection standards' under Section 28, when the text gives no subject for 'shall be submitted to the Committee to decide'?
What it makes you log
Logging duty
Section 28 lets a controller send personal data abroad only to a destination with adequate protection standards, unless a listed exception applies (compliance with law, informed consent, contract necessity, protection of life, substantial public interest). It sets no record, log or retention duty, and refers disputed adequacy to the Committee for decision.
- Kind
- None
- As of
What this law does
Section 28 requires that where a Data Controller sends or transfers personal data to a foreign country, the destination country or international organization must have an adequate data protection standard and the transfer must follow rules the Personal Data Protection Committee prescribes, subject to exceptions including legal compliance, informed consent where the data subject is told the destination's standard is inadequate, and contract necessity. This is an adequacy-based restriction; no data-localization mandate was found.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .