Following the PDPA’s full enforcement in 2022, key subordinate regulations remained pending, including those on the examination and certification of Binding Corporate Rules (“BCRs”), creating uncertainty for multinational groups transferring personal data within their group companies. To address this gap, the PDPC issued the Regulation on the Examination and Certification of Binding Corporate Rules effective from 17 February 2026, clarifying Thailand’s framework for intra-group cross-border personal data transfers. AA company may transfer personal data from Thailand to another country within the same corporate group, even where the destination country may not have adequate data protection standards, if the group has put in place an internal personal data protection policy known as the BCRs, provided that these BCRs must set clear and enforceable rules to ensure that personal data transferred overseas will still be protected to a standard comparable to the PDPA and are reviewed and certified by the PDPC Office in accordance with the applicable regulation (i.e., PDPC Office Regulation on BRCs).
Pursuant to the PDPC Office Regulation on the Examination and Certification of Binding Corporate Rules, an applicant seeking certification of draft BCRs must meet the following qualifications: (i) being part of a qualifying group of companies; (ii) being incorporated under Thai law; and (iii) having an establishment in Thailand. The application, draft BCRs, and all supporting documents must be submitted in Thai.
In reviewing the draft BCRs, the PDPC Office will consider whether the BCRs contain the required components and principles, including the following:
- Legal effect and enforceability;
- Effective implementation and enforcement to ensure that the policy is duly and consistently complied with in practice;
- The obligation of all group members to cooperate with and comply with the orders and guidance of the PDPC Office;
- Provisions ensuring the protection of personal data, including the rights of data subjects and complaint mechanisms in relation to personal data transferred overseas within the same group of companies;
- Personal data protection measures, which must include, at a minimum, the fundamental principles of personal data protection and appropriate security measures in accordance with the minimum standards prescribed by law; and
- Accountability and other supporting mechanisms.
For BCRs that have already been approved under the legal framework of the EU, the UK, or other Whitelist Countries, the relevant business operator may be eligible for an accelerated review process in Thailand. In such case, the applicant may submit evidence of the existing BCR approval issued by the relevant supervisory authority, together with the approved BCR documentation and a Thai BCR addendum, in Thai, to the PDPC Office.
PDPC Thailand Clarifies Binding Corporate Rules for Cross-Border Data Transfers_Bangkok Global Law