PDPA Cross-Border Data Transfer (SCC / BCR)
โอนข้อมูลข้ามพรมแดน PDPA (SCC / BCR) · § CrossBorder
Quick Answer
SCC + Transfer Impact Assessment bundle from THB 45,000 — data-flow mapping, gap vs PDPC adequacy list, SCC drafting (aligned with EU SCC 2021), 5-dimension TIA scoring (law, safeguards, redress, oversight, contract).
Timeline: Assessment 5 days · Draft SCC 5 days · Vendor negotiation 2–4 weeks.
Official fee: No official fee (BCR filing with PDPC is currently free).
Legal Basis
PDPA §§28–29 and PDPC Cross-Border Transfer Notification 2023 — must use adequacy, SCC, BCR, or a §28(3) derogation.
Who Needs This
SaaS using foreign AWS/GCP regions, MNCs sending HR data to headquarters, ecommerce using foreign payment gateways, and clinics sending lab tests abroad.
Required Documents
- Vendor list with destination countries
- Categories of data transferred
- SCC or DPA proposed by vendor
- Evidence of adequacy or safeguards
Common Pitfalls
- Assuming Google/AWS = safe without executing an additional DPA
- Using EU SCC verbatim without adapting to Thai law
- Skipping TIA when the vendor is in a non-adequate country
Typical Use-cases
- HR data transfers to US parent company
- IVF clinic sending embryo genetic data to a US lab
- Startup using OpenAI API — needs DPA + TIA
FAQ
- Which countries are adequate?
- As of 2026 the PDPC has not published an adequacy list — default to SCC or BCR.
- Must SCCs be filed with the PDPC?
- No filing required, but keep them for audit and record them in the ROPA.
- Are BCRs only for intra-group transfers?
- Yes — for intra-group transfers, subject to prior PDPC approval.
Other Legal Services
Request a quote — Call 083-249-4999 · LINE @NYC168 · contact@ilc.ltd






