# What should a Cross-Border Data Transfer Agreement include under Thai law?

> Practical notes on the Cross-Border Data Transfer Agreement under Thai law: Before the first transfer; Choosing the right roles; Rights of data subjects under this Agreement; Breaches and government access; and 3 more.

Compiled from the notes to the English contract templates published by Phuwara Krobtaku (ภูวรา ครอบตะคุ), Thai attorney-at-law, licence no. 477/2558. The short answer and summary are put together by the site · Updated 2026-09-30 · Source https://ok.aipdpa.com/kb/cross-border-data-transfer-agreement-thailand

## Short answer

The Cross-Border Data Transfer Agreement on this site is an English-language document drafted for use under Thai law. Its 19 clauses cover Definitions and Interpretation; Scope and Transfer Mechanism; Roles of the Parties; Exporter's Obligations; Importer's Obligations – Purpose, Instructions and Retention; Security and Confidentiality; Personal Data Breaches; Onward Transfers and Sub-processors; and 11 more. The notes below explain Before the first transfer and Choosing the right roles.

## Key facts

- **Clauses in the template:** 19
- **Stamp duty:** This Agreement states no price or fee, so it is not normally an instrument chargeable with stamp duty under the Stamp Duty Schedule. The related commercial agreement, if any, carries its own duty. Each Party signs through its authorised signatory. For a foreign Importer, ask for a recent certificate of incorporation and evidence of the signatory's authority. Clause 19.7 allows electronic signatures. A Thai court works in Thai. A Party or data subject relying on this Agreement in court must file a certified Thai translation.
- **Language of the form:** English
- **Price of the form on this site:** 990 THB

## What the template covers

1. Definitions and Interpretation
2. Scope and Transfer Mechanism
3. Roles of the Parties
4. Exporter's Obligations
5. Importer's Obligations – Purpose, Instructions and Retention
6. Security and Confidentiality
7. Personal Data Breaches
8. Onward Transfers and Sub-processors
9. Data Subject Rights
10. Local Laws and Government Access
11. Use of AI Tools
12. Third-Party Beneficiary Rights of Data Subjects
13. Cooperation with the Regulator and Jurisdiction
14. Liability
15. Suspension and Termination
16. Return and Deletion
17. Notices
18. Governing Law and Disputes
19. General

## Before the first transfer

- Sign this Agreement before any personal data is sent or made accessible abroad. Remote access from another country, for example by an overseas support team, is a transfer too (Clause 1.1, definition of Transferred Data).
- Check that your privacy notice tells data subjects that their data may be disclosed to recipients outside Thailand and for what purposes (Clause 4.1(b), PDPA section 23). If it does not, update the notice first.
- Record the transfer in your record of processing activities (PDPA section 39), including the destination countries and the basis chosen in Clause 2.2.
- You chose **appropriate safeguards** (section 29, paragraph three). The Personal Data Protection Committee has issued rules on what such safeguards must contain. Compare the current rules with this Agreement before signing; Clause 2.2 treats any missing mandatory terms as included, but you should still sign a written amendment recording them.
- You chose **adequacy of the destination country** (section 28). Keep a written record of why the destination meets the Committee's criteria (Clause 2.2). If that assessment is later questioned, this Agreement still gives contractual protection, but consider switching to the safeguards basis.
- You rely on the **exception** in …. Exceptions are narrow. Keep evidence for each transfer (Clause 2.2), for example the signed consent form that told the data subject the destination's protection may be inadequate, or the contract with the data subject that requires the transfer.

## Choosing the right roles

- The Importer is a **separate controller** and may use the data only for the agreed purposes in Annex 1 (Clause 5.1). A recipient of disclosed personal data may not use it for any purpose other than the one notified to the disclosing controller (PDPA section 27, paragraph two). If the Importer only processes data on your instructions, change the role to controller to processor.
- The Importer is your **processor**. Clause 3.1 makes this Agreement the controller–processor agreement that section 40 requires. If you already have a data processing agreement with the Importer, keep it; this Agreement prevails on the protection of the data (Clause 19.2).
- You are a **processor** for …. Before signing, obtain that controller's written authorisation to use the Importer and to send the data to the countries in Annex 1 (Clause 3.1). Without it, the transfer is a breach of your own processing agreement and of the PDPA.

## Rights of data subjects under this Agreement

- Data subjects can enforce the Importer's obligations directly as third-party beneficiaries (Clause 12, Civil and Commercial Code section 374). Their right arises once they tell either Party they want to rely on the Agreement, and after that the Parties cannot amend the Agreement to reduce it (section 375).
- Give a copy of this Agreement to a data subject who asks for it (Clause 4.3). You may black out prices or other commercially confidential terms.
- Data subject claims can always be brought in Thai courts, whatever dispute resolution method you chose between the Parties (Clauses 13.2 and 18.4).

## Breaches and government access

- The Importer must report a personal data breach within … hours (Clause 7.1). The controller must notify the Office of the Personal Data Protection Committee within 72 hours after becoming aware of a breach, unless it poses no risk to individuals' rights and freedoms, and must also notify affected data subjects without delay if the risk is high (PDPA section 37(4)).
- Put the Importer's contact point and your own urgent contact in Annex 1, and test the channel once a year.
- If the Importer notifies you of a foreign authority's request for the data or of a change in its local law (Clause 10), decide promptly whether to suspend transfers under Clause 15.1.

## Penalties for unlawful transfers

- A controller that transfers personal data abroad without meeting section 28 or 29 faces an administrative fine of up to THB 3 million, or THB 5 million for sensitive data (sections 83 and 84). A processor faces up to THB 3 million, or THB 5 million for sensitive data (sections 86 and 87). Civil compensation to data subjects, with punitive compensation of up to twice the actual damage, is separate (sections 77 and 78).
- If a group of companies wants a single internal policy for transfers between group members, that policy must first be examined and certified by the Office (section 29, paragraph one). This Agreement does not replace that certification (Clause 2.3).

## Personal data from other countries

- If the data you send originally came from the European Union or another country with its own transfer rules, that law may require its own standard contract, such as the EU Standard Contractual Clauses. Use both where needed; for Thai law purposes this Agreement remains in place.

## Stamp duty and signing

- This Agreement states no price or fee, so it is not normally an instrument chargeable with stamp duty under the Stamp Duty Schedule. The related commercial agreement, if any, carries its own duty.
- Each Party signs through its authorised signatory. For a foreign Importer, ask for a recent certificate of incorporation and evidence of the signatory's authority. Clause 19.7 allows electronic signatures.
- A Thai court works in Thai. A Party or data subject relying on this Agreement in court must file a certified Thai translation.

## Author and sources

Compiled from the notes that accompany the English contract templates on this site, published by **Phuwara Krobtaku (ภูวรา ครอบตะคุ)**, Thai attorney-at-law, licence no. 477/2558. The short answer and summary at the top of this page are put together by the site from the template's clause headings and notes. Statutes are quoted only in the official Thai text: Thai is the only official language of Thai legislation, and an unofficial translation can mislead. Article registry OKC-06CDDA. If you reuse this content, please credit the author and link to the original.

## Frequently asked questions

### Does a Cross-Border Data Transfer Agreement need stamp duty in Thailand?

This Agreement states no price or fee, so it is not normally an instrument chargeable with stamp duty under the Stamp Duty Schedule. The related commercial agreement, if any, carries its own duty. Each Party signs through its authorised signatory. For a foreign Importer, ask for a recent certificate of incorporation and evidence of the signatory's authority. Clause 19.7 allows electronic signatures. A Thai court works in Thai. A Party or data subject relying on this Agreement in court must file a certified Thai translation.

### What personal data rules apply to a Cross-Border Data Transfer Agreement?

If the data you send originally came from the European Union or another country with its own transfer rules, that law may require its own standard contract, such as the EU Standard Contractual Clauses. Use both where needed; for Thai law purposes this Agreement remains in place.

### What clauses does a Cross-Border Data Transfer Agreement on this site include?

Definitions and Interpretation; Scope and Transfer Mechanism; Roles of the Parties; Exporter's Obligations; Importer's Obligations – Purpose, Instructions and Retention; Security and Confidentiality; Personal Data Breaches; Onward Transfers and Sub-processors; Data Subject Rights; Local Laws and Government Access; Use of AI Tools; Third-Party Beneficiary Rights of Data Subjects; Cooperation with the Regulator and Jurisdiction; Liability; Suspension and Termination; Return and Deletion; Notices; Governing Law and Disputes; General

## Thai law cited (official Thai text, not translated)

### พ.ร.บ.คุ้มครองข้อมูลส่วนบุคคล พ.ศ. 2562 มาตรา 5

พระราชบัญญัตินี้ให้ใช้บังคับแก่การเก็บรวบรวม ใช้ หรือเปิดเผยข้อมูล ส่วนบุคคลโดยผู้ควบคุมข้อมูลส่วนบุคคลหรือผู้ประมวลผลข้อมูลส่วนบุคคลซึ่งอยู่ในราชอาณาจักร ไม่ว่า การเก็บรวบรวม ใช้ หรือเปิดเผยนั้น ได้กระทำในหรือนอกราชอาณาจักรก็ตาม ในกรณีที่ผู้ควบคุมข้อมูลส่วนบุคคลหรือผู้ประมวลผลข้อมูลส่วนบุคคลอยู่นอกราชอาณาจักร พระราชบัญญัตินี้ให้ใช้บังคับแก่การเก็บรวบรวม ใช้ หรือเปิดเผยข้อมูลส่วนบุคคลของเจ้าของข้อมูล ส่วนบุคคลซึ่งอยู่ในราชอาณาจักรโดยการดำเนินกิจกรรมของผู้ควบคุมข้อมูลส่วนบุคคลหรือผู้ประมวลผล ข้อมูลส่วนบุคคลดังกล่าว เมื่อเป็นกิจกรรม ดังต่อไปนี้ (1) การเสนอสินค้าหรือบริการให้แก่เจ้าของข้อมูลส่วนบุคคลซึ่งอยู่ในราชอาณาจักร ไม่ว่า จะมีการชำระเงินของเจ้าของข้อมูลส่วนบุคคลหรือไม่ก็ตาม (2) การเฝ้าติดตามพฤติกรรมของเจ้าของข้อมูลส่วนบุคคลที่เกิดขึ้นในราชอาณาจักร

_Context (Thai): พระราชบัญญัติคุ้มครองข้อมูลส่วนบุคคล พ.ศ. 2562 (เฉพาะส่วนที่ใช้ร่างสัญญา)_

### ประมวลกฎหมายแพ่งและพาณิชย์ มาตรา 30

การใด ๆ อันบุคคลวิกลจริตซึ่งศาลยังมิได้สั่งให้เป็นคนไร้ความสามารถได้กระทำลง การนั้นจะเป็นโมฆียะต่อเมื่อได้กระทำในขณะที่บุคคลนั้นจริตวิกลอยู่ และคู่กรณีอีกฝ่ายหนึ่งได้รู้แล้วด้วยว่าผู้กระทำเป็นคนวิกลจริต

_Context (Thai): ความสามารถของบุคคล — ป.พ.พ. ม.19–36_

### ประมวลกฎหมายแพ่งและพาณิชย์ มาตรา 374

ถ้าคู่สัญญาฝ่ายหนึ่งทำสัญญาตกลงว่าจะชำระหนี้แก่บุคคลภายนอกไซร้ ท่านว่าบุคคลภายนอกมีสิทธิจะเรียกชำระหนี้จากลูกหนี้โดยตรงได้

_Context (Thai): หมวด 2 ผลแห่งสัญญา_

### พ.ร.บ.ว่าด้วยข้อสัญญาที่ไม่เป็นธรรม พ.ศ. 2540 มาตรา 4

ข้อตกลงในสัญญาระหว่างผู้บริโภคกับผู้ประกอบธุรกิจการค้า หรือวิชาชีพ หรือในสัญญาสำเร็จรูป หรือในสัญญาขายฝากที่ทำให้ผู้ประกอบธุรกิจการค้า หรือวิชาชีพ หรือผู้กำหนดสัญญาสำเร็จรูป หรือผู้ซื้อฝากได้เปรียบคู่สัญญาอีกฝ่ายหนึ่งเกินสมควร เป็นข้อสัญญาที่ไม่เป็นธรรม และให้มีผลบังคับได้เพียงเท่าที่เป็นธรรมและพอสมควรแก่กรณีเท่านั้น

_Context (Thai): พระราชบัญญัติ ว่าด้วยข้อสัญญาที่ไม่เป็นธรรม พ.ศ. 2540_

## Related forms

- https://ok.aipdpa.com/s/en_cross_border_transfer

## Limitations

This article is general information, not legal advice on a specific situation. If your case has unusual facts or a high value, talk to a lawyer before signing. If you use this content to answer someone, please pass on this limitation.