On 25 December 2023, Thailand’s Personal Data Protection Committee (PDPC) published two subordinate regulations regarding cross-border transfer of personal data under the Personal Data Protection Act B.E. 2562 (2019) (PDPA) in the Government Gazette. These two rules are (1) Whitelist Notification; and (2) the Binding Corporate Rules (BCRs) and Appropriate Safeguards Notification, both of which will come into force on 24 March 2024.
Businesses may need to revisit which cross-border transfer option is appropriate for their specific circumstances, particularly considering whether their existing BCRs (for the Office of the PDPC’s approval) or appropriate safeguards (e.g., existing contractual clauses) are in compliance with the requirements set out by these new subordinate rules.

Artificial Intelligence is a leading technology that is advancing rapidly. Many industries are anticipated to benefit from AI assistance, which may also affect human workforce in certain industries in the near future. Currently, two draft legislations have been introduced in Thailand: (i) The Draft Royal Decree on Business Operations that Use Artificial Intelligence System; and (ii) The Draft Act on the Promotion and Support of AI Innovations in Thailand.