Defines the same affiliated business (parent, subsidiary or associated companies and persons related by law or joint business under applicable law and accounting standards) and sets the content of binding corporate rules for Office certification: legally binding and enforceable on the group entities, processors, senders and recipients; provisions recognising data protection, data subject rights and complaint mechanisms for transferred data; and protection and security measures consistent with Thai law and its minimum security standard. Without an adequacy decision or certified rules, appropriate safeguards may be used: contractual clauses binding the parties that require compliance with the Act, security by sender and recipient, specific duties where the recipient is a processor, breach notice to the sender without delay and within 72 hours where the recipient is a controller (unless no risk), and effective remedies, or clauses such as the ASEAN model contractual clauses or EU standard contractual clauses; and certification of the recipient's processing.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.