Thailand PDPA Summary: 8 Key Things Businesses Need to Know


By Blog, Data Privacy

Thailand PDPA was adopted into law on May 28, 2019, after being published in the Royal Thai Government Gazette a day earlier.

The enforcement of Thailand’s groundbreaking data protection regulation, the Personal Data Protection Act’s(PDPA), crucial provisions focused on the collection, use, and sharing of personal information will commence on May 28, 2020.

The key principles and requirements of Thailand PDPA are adapted from the GDPR.

Nonetheless, it is important for businesses operating in Thailand or handling data of Thai residents to acquaint themselves with this regulation with the compliance deadline fast approaching.

What is Thailand PDPA?

Like the GDPR, the aim of the PDPA is to safeguard Thai data owners from the illegal collection, use, or sharing of their personal information.

Who Needs to Comply with Thailand PDPA

The scope of Thailand PDPA covers businesses that are not headquartered in Thailand that market goods or services to Thai residents, or track their behavior. 

Most importantly, this law is applicable regardless of whether any payment is required for these activities or not.

Some of the core similarities between the PDPA and GDPR include;

  •   A set of legal bases for processing personal information
  •  Individual rights
  •  Creation of a data protection oversight body

Under Thailand PDPA, the legal bases for processing personal data include consent, legal obligation, public interest, and legitimate interest.

On the other hand, individual privileges include, but are not limited to the rights to access, erasure, or modify.

Lastly, the PDPA also aims to establish a Personal Data Protection Committee (PDPC), which is similar to the GDPR’s Data Protection Authorities (DPAs).

What are the Key Definitions in Thailand PDPA?

It goes without question that the key definitions in Thailand’s PDPA are inspired by the GDPR. They include;

Personal Data; broadly described as information that can directly or indirectly pinpoint an individual.

However, this definition does not include the data of a deceased individual, or private business information such as contact details, titles, or location.

Data Controller; The PDPA identifies a data controller as the authority that determines the means and purpose of collecting, using, and sharing personal data.

Data Processor; According to Thailand PDPA, a data processor is any individual or party that gathers, uses, or shares personal information as directed by the data controller.

Sensitive Personal Data; This is information related to a data subject’s race, political views, religious beliefs, criminal background, genetic information, health data, sexual preference, biometric information, as well as trade union membership

Which Consumer Rights does Thailand PDPA Protect?

Primarily, the PDPA is focused on safeguarding data owners from the illegal collection, use, or disclosure of personal data.

Like the GDPR, websites will be expected to have a simple and clear language in their privacy policies, seek active consent from users at the point of collecting, and sharing the data with third parties, as well as outlining the purpose of collecting this information.

As such, the rights of data owners under Thailand PDPA include;

  •  The right to be informed
  • The right to access
  • The right to data portability
  •  The right to object
  • The right to erasure/right to be forgotten
  •  The right to restrict processing
  •  The right to rectify

What are the PDPA’s Consent Requirements?

Similar to the GDPR, Thailand’s PDPA explicitly states that clear, express consent must be sought on or before the collection of personal information. The law goes to make it clear that the consent requests should not be misleading or deceptive.

Another crucial aspect regarding consent requirements under the PDPA is that data owners are allowed to withdraw their consent at any time.

However, this withdrawal does not affect the collection, processing, or sharing of personal information that had been legitimately consented.

However, the law also exempts the need for consent for the collection of personal information in specific circumstances. They include;

  • The fulfillment of contractual obligations
  • Public interest
  • Legitimate interest

Concerning minors, Thailand’s data privacy law requires parental consent for data subjects below 10 years old.

This provision differs from the GDPR which requires parental consent for all children below the age of 16.

How Will Thailand PDPA be enforced?

This regulation will establish the Personal Data Protection Committee (PDPC).

The PDPC will be responsible for the enforcement of the PDPA and guarantee compliance through the development of guidelines and implementation of a data protection framework.

What are the PDPA’s Penalties for Non-compliance?

Companies found in violation of Thailand’s data privacy law will be liable to both criminal and civil fines.

Each offense is likely to attract administrative penalties of up to TBH 5 million, which is equivalent to $165,000.

Apart from the fines, the PDPA also allows courts to enforce punitive compensations of up to double the amount of the actual damages and a one-year prison sentence.

Lastly, the PDPA allows data owners to lodge class action lawsuits.

How can I prepare for Thailand PDPA?

Granted the limited time left before the May 2020 deadline, it is vital for businesses to begin assessing their data processing practices and take the necessary measures to ensure compliance.

Some of the steps include:

  • Data mapping to understand how your company collects, processes, transmits, and stores data, which includes identifying the legal basis to collect and use personal data
  • Reviewing internal policies, agreements, and practices related to personal data
  • Implementing data management processes and operating systems
  • Updating existing privacy notices and creating relevant legal documents
  • Ensuring employees and personnel are fully trained on the relevant requirements of the PDPA
  • Conducting a gap assessment to identify the current levels of compliance
  • Having processes in place that exercise the rights of individuals relating to their personal data

Learn more about Thailand PDPA by booking a 30-min call and speak to a data privacy expert.

Additional Resources you may be interested in;

Thailand PDPA v GDPR: The Key Differences