Update on Sub-regulations under Thailand’s Personal Data Protection Act

With regard to the update on sub-regulations under the Personal Data Protection Act B.E. 2562 (2019) (the “PDPA”), the Personal Data Protection Committee (the “PDPC”) has thus far issued five Notifications under the PDPA, as follows:​

• Notification of the PDPC Re: Exemption from Duty to Record Activities for Data Controller deemed Small Business B.E. 2565 (2022);
• Notification of the PDPC Re: Criteria and Methods for Preparing and Retaining Records of Personal Data Processing Activities for Data Processor B.E. 2565 (2022);
• Notification of the PDPC Re: Security Measures of Data Controller B.E. 2565 (2022);
• Notification of the PDPC Re: Criteria for Consideration to Issue an Order to Impose the Administrative Fine of the Expert Committee B.E. 2565 (2022); and
• Notification of the PDPC Re: Prohibited Qualifications and Characteristics, Term of the Position, Retirement from the Position and Other Operations of the Expert Committee B.E. 2565 (2022).

The Notifications in Items 1-4 were published in the Government Gazette on 20 June 2022 and aside from the Notification in Item 2 (which shall come into force after 180 days from the date of its publication in the Government Gazette), the other three Notifications have already been enforced.

Currently, there is no official English translation of said four Notifications; however, since the said four Notifications should help clarify certain duties of business as a Data Controller and/or Data Processor under the Personal Data Protection Act B.E. 2562 (2019), we can provide you with the translations of the Notifications from Thai into English for your reference.

As for the Notification in Item 5, it was published in the Government Gazette on 11 July 2022 and has already been enforced. Currently, there is no official English translation of this Notification; however, since this Notification is not directly related to the duties and responsibilities of the Data Controller and/or Data Processor, we have therefore not provided the English translation of such Notification at this stage.

In addition to the said five Notifications, we expect there to be further sub-legislations as well as official guidance from the related authority in the near future.

This is intended merely to provide a regulatory overview and not to be comprehensive, nor to provide legal advice. Should you have any questions on this or on other areas of law, please do not hesitate to contact:

Chanakarn Boonyasith
Partner

Pimsiri Harnpanicharoen           
Attorney-at-Law 

Authors