On 25 December 2023, Thailand’s Personal Data Protection Committee (PDPC) published two subordinate regulations regarding cross-border transfer of personal data under the Personal Data Protection Act B.E. 2562 (2019) (PDPA) in the Government Gazette. These two rules are (1) Whitelist Notification; and (2) the Binding Corporate Rules (BCRs) and Appropriate Safeguards Notification, both of which will come into force on 24 March 2024.
Businesses may need to revisit which cross-border transfer option is appropriate for their specific circumstances, particularly considering whether their existing BCRs (for the Office of the PDPC’s approval) or appropriate safeguards (e.g., existing contractual clauses) are in compliance with the requirements set out by these new subordinate rules.

On 27 October 2023, Thailand’s Personal Data Protection Committee published for public consultation two new draft rules regarding cross-border transfer of personal data. These two draft rules, namely: (1) Draft Whitelist Notification and (2) Draft Binding Corporate Rules and Appropriate Safeguards Notification, upon becoming effective as binding laws, will serve to expand the available options for making a lawful transfer of personal data outside Thailand in compliance with the Personal Data Protection Act B.E. 2562.

Artificial Intelligence is a leading technology that is advancing rapidly. Many industries are anticipated to benefit from AI assistance, which may also affect human workforce in certain industries in the near future. Currently, two draft legislations have been introduced in Thailand: (i) The Draft Royal Decree on Business Operations that Use Artificial Intelligence System; and (ii) The Draft Act on the Promotion and Support of AI Innovations in Thailand.

The Notification of the Personal Data Protection Committee re: Designation of a Data Protection Officer under Section 41 (2) of the Personal Data Protection Act B.E. 2562 (2019) B.E. 2566 (2023) (“PDPC Notification re: DPO Designation”) has been published in the Government Gazette on 14 September 2023. This notification will be effective from 13 December 2023. While most of the requirements under the PDPC Notification re: DPO Designation remain unchanged from its draft version, the published version specifies a minimum number of data subjects that would trigger the large-scale criteria and the data controller’s obligation to designate a data protection officer.

Following our previous newsletter, on 21 August 2023, the Royal Decree on the Operation of Digital Platforms, which are Subject to Prior Notification B.E. 2565, came into full effect. Existing business operators are required to comply with certain obligations.

This event will be held on Wednesday, 24 May 2023 from 14:30-16:00 hrs. (Bangkok time) via Zoom and YouTube Live. This exclusive webinar presented by our professionals will explore: (i) overview of the legal issues surrounding digital onboarding process, (ii) key concepts of the Anti-Money Laundering / Countering the Financing of Terrorism (AML/CFT) laws and specific regulations governing digital onboarding, (iii) key concepts of technology laws and regulations relating to digital onboarding, and (iv) case study: an end-to-end flow of the digital onboarding process for FinTech businesses. The webinar will be conducted in Thai.

Request a copy For over 40 years, the team at Baker McKenzie, Bangkok has assisted foreign individuals and international companies who are seeking investment opportunities in Thailand. Doing Business in Thailand is your personal guide to the key aspects of Thai law that significantly affect the way business is conducted…

After numerous attempts over almost two decades (please see our series of client alerts below), the Thailand Personal Data Protection Act was finally approved and endorsed by the National Legislative Assembly on 28 February 2019 (“PDPA”). The PDPA will be submitted for royal endorsement and subsequent publication in the Government…

Thailand’s Computer Crime Act B.E. 2550 (2007) addresses computer related issues such as the illegal access to and interference with computer systems and data, the illegal disclosure of security measures, and the illegal interception of computer data.