Published PDPACloudData ResidencyIaaS
In short: Thailand’s Personal Data Protection Act (PDPA) does not always require personal data to stay in Thailand, but sending data abroad for storage or processing must meet legal conditions. A local cloud makes legal analysis and compliance simpler, but it does not replace your other PDPA obligations.
This article provides general information and is not legal advice.
What the PDPA says about transferring data abroad
The Personal Data Protection Act B.E. 2562 (2019) came fully into force on 1 June 2022. For sending or transferring personal data abroad, the principles in brief are:
- The destination country or organization must have adequate data protection standards, according to criteria set by the Personal Data Protection Committee
- Or the transfer must fall under an exception in the law, such as consent from the data subject after being informed of the destination’s standards, or necessity for performing a contract
- Or appropriate safeguards must be in place, such as verified internal policies within a group of companies
Beyond the PDPA, some industries, such as finance or government, may have specific requirements from their regulators. These should be checked as well.
Benefits of a local cloud
- Simpler legal analysis, because data stays in Thailand and cross-border transfer conditions do not apply to storage
- Low latency for users in Thailand
- Easier coordination with a provider in the same time zone and language
What you still need to do with a local cloud
- Establish a lawful basis for collecting and using each type of data
- Sign a Data Processing Agreement with your provider
- Put security measures in place, such as access control, encryption and backups
- Confirm that your provider has verifiable information security standards
GIST’s Starships Cloud
Starships Cloud is a local Infrastructure as a Service (IaaS) offering from Global Innovative Solutions Co., Ltd., operated under ISO/IEC 27001, whose scope covers our Cloud Service - IaaS.
Frequently asked questions on this topic
Is using an overseas cloud a PDPA violation?
Not in itself. However, sending or transferring personal data abroad must meet the PDPA's conditions, such as the destination having adequate data protection standards or falling under an exception set by law, and may be subject to further rules issued by the Personal Data Protection Committee.
Does using a local cloud mean we are fully PDPA compliant?
No. Keeping data in Thailand reduces the complexity of cross-border transfer rules, but organizations still need a lawful basis for processing, appropriate security measures and a data processing agreement with their provider.
Can this article replace legal advice?
No. This article provides general information. For decisions about where to store data, consult your legal team or your organization's Data Protection Officer (DPO).