Article 21
Content
If a cross-border transfer of personal data is carried out by a non-government agency under any of the following circumstances, the central government authority in charge of the industry concerned may impose restrictions on such transfer:
1. where major national interests are involved;
2. where an international treaty or agreement so stipulates;
3. where the country receiving the personal data lacks proper regulations on protection of personal data and the data subjects' rights and interests may consequently be harmed; or
4. where the cross-border transfer of the personal data to a third country (territory) is carried out to circumvent the PDPA.