Thoughts before Appointing Data Protection Officer

1. Legal Requirement

The requirement to designate a Data Protection Officer (the “DPO”) under the Personal Data Protection Act B.E. 2562 (2019) (the “PDPA”) has imposed significant concerns on organizations. Both data controllers and data processors have a duty to appoint the DPO. However, it is worth noting that not every organization is required to appoint the DPO.

Pursuant to Section 41 of the PDPA, the DPO must be appointed in the following circumstances:

(a) the processing activities of your organization in the collection, use, or disclosure of personal data require regular monitoring or system, by reason of having a large number^[1]of personal data as prescribed by the Personal Data Protection Committee (the “Committee”);
(b) the core activity of your organization is the collection, use, or disclosure of sensitive data; and
(c) the data controller or the data processor is a public authority as prescribed by the Committee.

In this regard, your organization may not need the DPO if it does not fall under the above circumstances. Nevertheless, in the case where your organization is not required to designate the DPO, designating the DPO may be advisable in order to show legal responsibility and be more conservative with the data subjects. Please note that relevant sub-regulations concerning the appointment of the DPO may shed more light on this matter, however it is still under consideration.

2. Should internal personnel or external party be appointed as your DPO?

The DPO can be an employee of your organization or a service provider under contract with your organization. In considering whether the DPO should be appointed internally or externally, the following points should be taken into account.

3. Desirable Skills and Qualifications

Currently, the PDPA only prescribes the duties of the DPO. The DPO may be able to perform other duties or tasks, but such other duties or tasks must not be against or contrary to the performance of the duties as the DPO under the PDPA. Even though the skills and qualifications of the DPO are not specified under the PDPA, the legal duties of the DPO provide an understanding of what skills and qualifications the DPO should have.

Below is the table of desirable skills and qualifications of the DPO.

The lists above are only examples of the desirable skills and qualifications of the DPO. If the DPO appointed in your organization does not possess these skills or qualifications, there is no legal offense whatsoever. 

4. Suggestion

Before the appointment of the DPO, your organization should check whether it needs to appoint the DPO or not (i.e., this depends on the nature of the processing activities in your organization as explained in 1. above). The DPO can be an individual or a group of people appointed internally or externally. The business and corporate culture, the capability of personnel, and the processing activities/system of your organization should be looked into before making any decision on the DPO appointment. Lastly, the DPO should have desirable skills and qualifications in order to perform its duties smoothly and effectively in your organization.

This is intended merely to provide a regulatory overview and not to be comprehensive, nor to provide a legal advice. Should you have any questions on this or on other areas of law, please contact any of our authors.

^[1] For your information, according to the draft sub-regulations of the PDPA, “large scale” means either when the data controller or the data processor has in its possession personal data of more than (1) 50,000 data subjects or (2) 5,000 data subjects in the case of sensitive data processing, within any 12-month period.