UPDATE – 20th May 2020: The Personal Data Protection Act (PDPA), due to go into effect on the 27th of May 2020 has been postponed for another full year by the Thai government. We will update this page as more details are released.   PDPA refers to the Personal Data Protection Act of 2019. Regarded as Thailand’s very own adaptation of the GDPR, the data privacy regulations of this act pertain to the same key points of rights of data, data controlling and non-compliance penalties.   The act was published on the 27th of May 2019 through Thailand’s Government Gazette. However, its operational provisions are only set to go into effect on the 27th of May 2020, a full year since the PDPA was first published.   Though the core ideals behind this act are very similar to those of GDPR, it’s very important that companies operating within Thailand take the initiative to remain informed and up to date on PDPA provisions, non-compliance penalties, as well as the obligations and liberties of data controllers.  

Key Definitions in the PDPA

• Personal Data: Any and all information relating to a specific Person, which enables the identification of a Person, whether directly or indirectly, but does not include the information of deceased Persons.
• Person: A natural person.
• Data Controller: Person or a juristic person having the power and duties to make decisions regarding the collection, use, or disclosure of the Personal Data.

How is PDPA Applied?

  The PDPA sets regulations for how personal data is collected and used. This applies to all businesses located in Thailand, regardless of whether the data was collected or distributed outside the country.   The PDPA also applies to businesses located outside the kingdom, if a few conditions are met:

• When goods or services are offered to data subjects or citizens within Thailand, regardless of whether there is any payment involved.
• When monitoring data subjects or citizens’ behavior in Thailand.

What are PDPA’s lawful bases?

  There are six lawful bases that must be met in every act of collecting or using data in order to remain PDPA compliant. All other cases that these lawful bases do not cover, will require the data subject’s consent for collection, usage, and disclosure of the personal data.   The lawful purposes are:

1. for the preparation of historical documents or archives for the public interest, or relating to research or statistics, in which suitable measures to safeguard the data subject’s rights and freedoms are put in place and in accordance with any notification prescribed by the Office;
2. for preventing or suppressing danger to a person’s life, body or health;
3. where it is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract;
4. where it is necessary for the performance of a task carried out in the public interest by the data controller, or in order to exercise the official authority vested in the data controller;
5. for the legitimate interests of the data controller or any other persons, except where such interests are overridden by the fundamental rights of the data subjects with respect to their Personal Data; or
6. where it is necessary to comply with any laws to which the data controller is subject.

Consent

  Certain criteria must be met for the data subject’s consent to be considered valid:

• the consent must be explicitly made in a written statement or via electronic means;
• the data subject must be informed of the purpose of the collection, use, or disclosure of the Personal Data;
• the request for consent must be clearly distinguishable from other content provided to the data subject;
• the form of the request for consent must be easily accessible and intelligible;
• the request for consent must be in clear and plain language; and
• the request for consent must not be deceptive or misleading to the data subject in respect to its purposes.

Privacy Notice

  The privacy notice serves the purpose of keeping data subjects informed of when their data is collected and the purpose it’s used for. The data controller must provide the data subject with a privacy notice prior to or by the time the Personal Data is collected.   The notice must include the following information:

• the Personal Data to be collected;
• the purpose of the collection, usage or disclosure of the Personal Data, including the lawful basis relied on;
• whether the data subject must provide his or her Personal Data, including the consequence where the data subject does not provide the Personal Data;
• the period for which the Personal Data will be retained and, if it is not possible to specify a retention period, the expected data retention period according to the data retention standard;
• the categories of Persons or entities to whom the Personal Data may be disclosed;
• the contact details of the data controller, and where applicable, contact details of the data controller’s representative or data protection officer; and
• the rights of the data subject, which include the right to withdraw consent, the right to access and obtain a copy of the Personal Data, the right to request for the transfer of the Personal Data in machine-readable formats to other data controllers, the right to object to the collection, usage and disclosure of the Personal Data, the right to request for deletion, the right to request for suspension of use, the right to have Personal Data maintained accurately, and the right to file complaints.

Breach Notification

  A data controller is required to notify the Office of any data breach affecting Personal Data within 72 hours after becoming aware of it. If the breach is likely to pose a high risk to the rights and freedom of the data subject, the data subject must also be notified without delay.    

Security obligations

  A data controller has a duty to keep Personal Data secure, including the following:

• ensuring that there are appropriate security measures in place to prevent the unauthorized or unlawful loss, access to, use, alteration, correction or disclosure of Personal Data;
• preventing the recipient of the Personal Data (e.g. a data processor) from using or disclosing such Personal Data unlawfully or without authorization; and
• ensuring that there is a system to destroy the Personal Data once the retention period expires.

Cross Border Data Transfer

  In the event that a data controller sends or transfers Personal Data to a foreign country, the destination country that receives such Personal Data shall have adequate data protection standards, unless an exemption is met (e.g. a consent from the data subject is obtained for the transfer of the Personal Data to a country which the data protection standard that is not adequate, or the transfer is for compliance with the law). The guideline on adequate data protection standard is yet to be issued.    

Penalties

  A violation of the PDPA could result in civil liability, criminal liability and administrative fines.   For example, a data controller who collects, uses or discloses the Personal Data without consent from the data subject (where consent is required) will be liable.    

• Link to the official text (Thai language)
• Link to the English version (Unofficial translation)