A destination country or international organisation has an adequate standard when it has legal measures or mechanisms consistent with Thai law, particularly controller duties on security, personal data protection measures enabling enforcement of rights and effective legal remedies, and an authority empowered to enforce data protection law there. A controller or the Office may refer adequacy questions to the Committee, which may decide case by case or publish a list of adequate destinations, and may review on new evidence; the Office prepares a report on the destination. Mere transit or storage through systems (including cloud) where no one but the sending controller or processor can access the data is not a transfer. No adequacy list had been published by March 2024.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.