The Thai Cabinet on 3 November 2026 approved a draft letter of intent for Thailand to join the Global Cross-Border Privacy Rules (Global CBPR) framework as a full member. The move matters to businesses that send customer data abroad, such as online shops, hotels and companies with offices in several countries. Thailand is not a member yet. The Cabinet decision is only the first step in the process.
Global CBPR is an international framework of privacy rules for transferring personal data across borders. The Ministry of Digital Economy and Society (DES), which proposed the matter, says the goal is to let Thai private companies send or transfer personal data to organisations in member countries in a reliable and convenient way.
What the Cabinet approved, and what it did not
The resolution, as released by the Public Relations Department, has three parts:
- It approves the draft letter of intent to join Global CBPR.
- It authorises the DES minister, or a designated representative, to sign the letter.
- It names the Personal Data Protection Committee Office as the lead coordinating body for Thailand's participation.
The resolution also allows the draft to be adjusted if the changes are not substantive and do not harm Thailand's interests. The DES ministry, through the committee office, can make such changes without returning to the Cabinet.
Thailand must now submit the draft letter for preliminary consideration. It will then be reviewed at the Global CBPR members' meeting (the Global Forum Assembly) in December 2026, before any endorsement. So the Cabinet has approved a draft letter, but membership has not happened. The published resolution does not say when Thailand might become a full member.
What DES says businesses could gain
DES says joining would reduce the duplicated compliance burden and costs faced by Thai businesses. Companies could use the certification standard as a central mechanism to send or transfer data across borders lawfully. DES also expects it to raise Thailand's personal data protection standards in line with international principles and narrow legal gaps between countries.
Consider a company that collects customer data in Thailand and passes it to a parent company or partner overseas. DES's proposal is a single certification standard that works for transfers to organisations in member countries, cutting repeated costs.
The scheme is a mechanism that businesses could choose to use. It is not a requirement to seek certification. The published resolution also gives no details on fees, how to apply for certification, or which bodies would carry out certification in Thailand.
How the Personal Data Protection Act fits in
According to the draft letter proposed by DES, Thailand's Personal Data Protection Act of 2019 (PDPA) recognises the Global CBPR system as a lawful mechanism for sending or transferring personal data.
The draft makes two other key points. Thailand agrees with the principles and objectives of the declaration and the Global CBPR Framework (2023). And the Personal Data Protection Committee Office, Thailand's privacy regulator, takes part in international cooperation on privacy law enforcement.
The resolution does not cover how other cross-border transfer routes under the PDPA work, or how they differ technically from Global CBPR. Companies that actually transfer data should wait for guidance from the committee office and check with their own legal advisers before deciding.
Preparing while the process continues
The National Economic and Social Development Council (NESDC) said preparation and awareness-building should be a priority for businesses. It singled out small and medium-sized enterprises (SMEs), which may have limited resources and could struggle with the cost of meeting the standard. The aim is to let more operators access and benefit from the framework.
The following points are general suggestions, not government requirements:
- Map which customer data leaves Thailand, where it goes and who receives it.
- Check whether your privacy policy clearly tells customers about overseas transfers.
- List the foreign service providers you use, such as data storage or email delivery systems.
- Assign someone inside the company to be responsible for personal data.
- Follow announcements from the committee office and DES on certification guidelines and conditions.
Mapping data flows is useful beyond Global CBPR. Once a business knows where its data goes, it can more easily judge which transfer mechanism to use when Thai agencies publish details.
For individuals whose data is involved, the draft letter says joining would reduce the risk of violations of consumers' basic rights when data is sent to overseas organisations. The real effect will only be clear after Thailand completes the membership process.
What to watch next
The December 2026 Global Forum Assembly is the key date, since Thailand's draft letter will be considered there before endorsement. Thai agencies have not said when Thailand would become a full member after that meeting, or when businesses could start applying for certification. Fees and Thai certification bodies have not been announced.
Source: Cabinet resolution of 3 November 2026, as released by the Public Relations Department, citing the proposal from the Ministry of Digital Economy and Society and the views of the National Economic and Social Development Council.
This article is adapted from ViewNews' Thai-language report.
