{
  "node_id": "th-pdpa-cross-border-data-transfer-regulations-2024",
  "title": "Thailand PDPC Subordinate Regulations on Cross-Border Personal Data Transfers 2023/2024 - Green Route (Section 28) and Safeguard Route (Section 29), Effective 24 March 2024",
  "domain": "Data Protection & Privacy",
  "version": "1.0.0",
  "last_updated": "2026-06-04",
  "bluf": "Data controllers in Thailand transferring personal data internationally must comply with the two subordinate regulations under the Personal Data Protection Act (PDPA) published in the Government Gazette on 25 December 2023 and effective from 24 March 2024, choosing between the Adequacy route (Section 28, the Green Route, applicable where the destination is on the PDPC adequacy list which is currently empty) and the Appropriate Safeguards route (Section 29, the Safeguard Route, available through Standard Contractual Clauses based on ASEAN or EU models with Thai-specific obligations such as 72-hour breach reporting, certification, or binding instruments between Thai and foreign government agencies), treating all current cross-border transfers as going to non-adequate destinations requiring proper safeguards until the PDPC publishes an adequacy list.",
  "paywall": {
    "status": "LOCKED",
    "unlock_cost_usd": "0.01",
    "skyfire_id": "41779894-ece2-4163-9761-b3b1b76e19b0"
  },
  "crosswalks": {
    "_available_keys": [
      "nist_framework",
      "iso_standard",
      "industry_mapping",
      "ai_overlay_2026"
    ],
    "_note": "Full crosswalk values included in vault response"
  },
  "dependencies": [
    "gdpr-article-5-data-principles"
  ],
  "primary_citations_count": 6
}