On 25 December 2023, Thailand’s Personal Data Protection Committee (PDPC) published two subordinate regulations regarding cross-border transfer of personal data under the Personal Data Protection Act B.E. 2562 (2019) (PDPA) in the Government Gazette. These two rules are (1) Whitelist Notification; and (2) the Binding Corporate Rules (BCRs) and Appropriate Safeguards Notification, both of which will come into force on 24 March 2024.
Businesses may need to revisit which cross-border transfer option is appropriate for their specific circumstances, particularly considering whether their existing BCRs (for the Office of the PDPC’s approval) or appropriate safeguards (e.g., existing contractual clauses) are in compliance with the requirements set out by these new subordinate rules.

On 27 October 2023, Thailand’s Personal Data Protection Committee published for public consultation two new draft rules regarding cross-border transfer of personal data. These two draft rules, namely: (1) Draft Whitelist Notification and (2) Draft Binding Corporate Rules and Appropriate Safeguards Notification, upon becoming effective as binding laws, will serve to expand the available options for making a lawful transfer of personal data outside Thailand in compliance with the Personal Data Protection Act B.E. 2562.

Artificial Intelligence is a leading technology that is advancing rapidly. Many industries are anticipated to benefit from AI assistance, which may also affect human workforce in certain industries in the near future. Currently, two draft legislations have been introduced in Thailand: (i) The Draft Royal Decree on Business Operations that Use Artificial Intelligence System; and (ii) The Draft Act on the Promotion and Support of AI Innovations in Thailand.

The Notification of the Personal Data Protection Committee re: Designation of a Data Protection Officer under Section 41 (2) of the Personal Data Protection Act B.E. 2562 (2019) B.E. 2566 (2023) (“PDPC Notification re: DPO Designation”) has been published in the Government Gazette on 14 September 2023. This notification will be effective from 13 December 2023. While most of the requirements under the PDPC Notification re: DPO Designation remain unchanged from its draft version, the published version specifies a minimum number of data subjects that would trigger the large-scale criteria and the data controller’s obligation to designate a data protection officer.

The National Broadcasting and Telecommunications Commission (NBTC) has recently released a new Notification on Measures to Protect the Rights of Telecommunications Service Users Related to Personal Data, Rights to Privacy, and Liberty to Communicate through Telecommunications (“Telecommunications Data Protection Notification”). This Telecommunications Data Protection Notification repealed and replaced the existing NTC (National Telecommunications Commission, now the NBTC) notification on data protection, which had been applicable to telecommunications business operators since 2006.

Following our previous newsletter, on 21 August 2023, the Royal Decree on the Operation of Digital Platforms, which are Subject to Prior Notification B.E. 2565, came into full effect. Existing business operators are required to comply with certain obligations.

Following years of market domination by the conventional automobile industry, EV technology is now emerging as an environment-friendlier alternative, opening up various new opportunities for businesses as well as consumers all around the world. EV development permeates the whole chain of the present automotive industry, from the manufacturing and distribution sectors to subscription and ride-sharing or ride-hailing businesses. To operate an EV business in Thailand, there are certain legal concerns you need to take into account.

Request a copy For over 40 years, the team at Baker McKenzie, Bangkok has assisted foreign individuals and international companies who are seeking investment opportunities in Thailand. Doing Business in Thailand is your personal guide to the key aspects of Thai law that significantly affect the way business is conducted…

Along with the Thailand Personal Data Protection Act (please see our previous client alert Get Ready: The First Thailand Personal Data Protection Act Has Been Passed), the Cybersecurity Act was also approved and endorsed by the National Legislative Assembly on 28 February 2019. Please see below a key summary of…

After numerous attempts over almost two decades (please see our series of client alerts below), the Thailand Personal Data Protection Act was finally approved and endorsed by the National Legislative Assembly on 28 February 2019 (“PDPA”). The PDPA will be submitted for royal endorsement and subsequent publication in the Government…