Personal Data Protection Laws Update: Thailand’s New Notification regarding the Data Controller and the Data Processor who is a public authority which are required to designate the Data Protection Officer

After the Personal Data Protection Act B.E. 2562 (2019) came into effect, the Personal Data Protection Committee (“PDPC”) issued a Notification, which states that the Data Controller and the Data Processor who is a public authority which are required to designate the Data Protection Officer B.E. 2566 (2023) (the “Notification”). The Notification was published in the Government Gazette on 18 July 2023 and shall be in force after 90 days from its publication date (by 16 October 2023).

This Notification is issued under Section 41(1) of the PDPA which requires data controllers or data processors, if they are a public authority as prescribed by the PDPC, to designate a data protection officer. The data protection officer under this Notification shall have the obligations and duties as stipulated under Section 42 of the PDPA, e.g.: 

• To give advice to the data controller or the data processor, including their employees or service providers, with respect to compliance with the PDPA; To investigate the performance of the data controller or the data processor, including their employees or service providers, with respect to the collection use, or disclosure of the personal data for compliance with the PDPA; and
•  
• To coordinate and cooperate with the PDPC Office in the circumstance where there are problems with respect to the collection, use or disclosure of the personal data undertaken by the data controller or the data processor, including their employees or service providers, with respect to the compliance with the PDPA.

As such, the Notification rules that the following public authority is required to designate its data protection officer:

• Office of the Prime Minister 
  1.1    Office of the Civil Service Commission
• Ministry of Finance
  2.1    The Comptroller General's Department
  2.2    Fiscal Policy Office
• Ministry of Foreign Affairs
  3.1    Department of Consular Affairs
• Ministry of Tourism and Sports
  4.1    Department of Tourism
• Ministry of Social Development and Human Security
  5.1    Office of the Permanent Secretary
  5.2    Department of Children and Youth Affairs
  5.3    Department of Empowerment and Development of the Life of Persons with Disabilities
• Ministry of Agriculture and Cooperatives
  6.1    Department of Agricultural Extension
  6.2    Agricultural Land Reform Office
• Ministry of Transport
  7.1    Department of Land Transport
  7.2    Department of Airports
• Ministry of Digital Economy and Society
  8.1    Office of the National Digital Economy and Society Commission
  8.2    National Statistical Office
• Ministry of Commerce
  9.1    Department of Intellectual Property
  9.2    Department of Business Development
• Ministry of Interior
  10.1    Department of Provincial Administration
  10.2    Community Development Department
  10.3    Department of Lands
• Ministry of Labour
  11.1    Department of Employment
  11.2    Department of Skill Development
  11.3    Social Security Office
• Ministry of Education
  12.1    Office of the Permanent Secretary
  12.2    Office of the Basic Education Commission
  12.3    Office of the Vocational Education Commission
• Ministry of Public Health
  13.1    Office of the Permanent Secretary
  13.2    Department of Medical Services
  13.3    Department of Disease Control
  13.4    Department of Medical Sciences
  13.5    Department of Mental Health
  13.6    Department of Health
• Other government agencies
  14.1    Bangkok
  14.2    National Savings Fund
  14.3    Student Loan Fund
  14.4    Government Pension Fund
  14.5    Expressway Authority of Thailand
  14.6    Metropolitan Waterworks Authority
  14.7    Provincial Waterworks Authority
  14.8    Metropolitan Electricity Authority
  14.9    Provincial Electricity Authority
  14.10    State Railway of Thailand
  14.11    Teachers Council of Thailand
  14.12    Krung Thai Bank Public Company Limited
  14.13    Small and Medium Enterprise Development Bank of Thailand
  14.14    Bank for Agriculture and Agricultural Cooperatives
  14.15    Export-Import Bank of Thailand
  14.16    Bank of Thailand
  14.17    Government Savings Bank
  14.18    Government Housing Bank
  14.19    Islamic Bank of Thailand
  14.20    The Transport Company Limited
  14.21    National Telecommunications Public Company Limited
  14.22    Thailand Post Company Limited
  14.23    Universities and higher education institutes of the state that have hospitals under their affiliation
  14.24    National Institute of Emergency Medicine
  14.25    Big Data Institute (Public Organization)
  14.26    Professional Qualification Institute (Public Organization)
  14.27    Deposit Protection Agency
  14.28    National Institute of Educational Testing Service (Public Organization)
  14.29    Office of the Election Commission
  14.30    Office of Insurance Commission
  14.31    The Securities and Exchange Commission
  14.32    Office of the Broadcasting Commission television business and national telecommunications
  14.33    Office of the Personal Data Protection Committee
  14.34    National Science and Technology Development Agency
  14.35    National Health Security Office

The Notification permits the data protection officer of such data controller or data processor as named above to perform other jobs or tasks. However, the data controller or data processor must certify to the PDPC Office that his/her duties or tasks do not conflict with the duties or obligations under the Personal Data Protection laws. 

In summary, while the Notification may not have a direct impact on the private sector, it remains an essential directive to ensure that the Thai standard for personal data protection is equally enforced for both public authorities and private entities, guaranteeing proper handling and safeguarding of personal data (e.g. the PDPC Office is also required to designate a data protection officer).

This is intended merely to provide a regulatory overview and not to be comprehensive, nor to provide legal advice. Should you have any questions on this matter, please do not hesitate to contact our Personal Data Protection team at pdpa_bkk@eml.nishimura.com, and our team would be pleased to assist.

Chanakarn Boonyasith
Partner
Terapat Laopatarakasem
Associate

Authors