A controller or processor in Thailand with a personal data protection policy for transfers to a controller or processor abroad in the same affiliated business or group of undertakings may transfer in line with that policy, exempt from section 28, once the Office has reviewed and certified the policy; the policy, the meaning of an affiliated business and the certification rules are set by the Committee. In the absence of a section 28 Committee decision or a certified policy, a controller or processor may transfer abroad without meeting section 28 if it provides suitable protection measures that make the data subject's rights enforceable, including effective legal remedies, under the Committee's rules.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.