Support Centre

Thailand

Summary

Law: Personal Data Protection Act 2019 ('PDPA')

Regulator: Personal Data Protection Committee ('PDPC')

Summary: The PDPA is the first consolidated legislation providing general data protection within Thailand and entered into effect on 1 June 2022. The PDPA is based on the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR') and contains many similar provisions, although they differ in areas such as anonymisation. More specifically, the PDPA introduces obligations for data controllers and data processors including lawful grounds of data collection, use, and disclosure, restrictions on data transfers to foreign countries, and requirements for breach notification, as well as rights for data subjects. The Ministry of Digital Economy and Society ('MDES') and PDPC have released draft secondary laws and guidelines to clarify the provision of the PDPA in areas such as data security, data transfers to foreign countries, as well as requirements for data protection officer appointment and the conducting of Data Protection Impact Assessments. The PDPA was among a set of digital related bills, including the Cybersecurity Act 2019, which were developed in 2019 to address contemporary technological developments.

News

Insights

September 2024

Thailand: Key considerations for multi-national corporations in cross-border data transfer under the Personal Data Protection Act

The Personal Data Protection Act B.E. 2563 (A.D. 2019) of Thailand (PDPA), effective from June 1, 2022, is the key legislation of Thailand that provides comprehensive protection for personal data. Local and foreign entities that collect, use, or disclose personal data of data subjects in Thailand are subject to the PDPA. Cross-border data transfers are subject to stringent requirements under the provisions of the PDPA and the applicable rules issued under the PDPA. Multinational corporations (MNCs) are required to have in place adequate data protection measures for the purpose of their cross-border data transfer activities.

Kowit Somwaiya and Usa Ua-areetham, from LawPlus Ltd., provide an overview of the key considerations for MNCs to consider when implementing cross-border data transfer mechanisms. The overview is focused on the key requirements for the Binding Corporate Rules (BCRs) and the Data Transfer Agreement (DTA) as set out in relevant notifications issued by the Personal Data Protection Committee (PDPC) under the PDPA, such as the implementing rules on the criteria for protecting personal data sent or transferred abroad according to Section 28 of the PDPA (PDPC rules).

November 2023

Thailand: Update on proposals for AI regulations

The rapid ascent of artificial intelligence (AI) has paved the way for a new era of innovation and is reshaping our daily lives. The emergence of generative AI, a content-generating tool, is a recent example of how quickly these developments can take place. However, they increasingly challenge the applicability of current laws, demanding tailored regulations. Kritiyanee Buranatrevedhya and Burin Saekow, from Baker & McKenzie LLP, discuss the proposed updates to manage these changes.  

June 2023

Thailand: Overview of the new Royal Decree regulating onshore and offshore digital platforms

In line with the intent of the law under the Electronic Transactions Act B.E. 2544 (2001) (ETA) to maintain financial and commercial security and strengthen the reliability and credibility of data message systems, the Royal Decree on Regulating the Digital Platforms which are Subject to Prior Notification B.E. 2565 (2022) (the Digital Platform Royal Decree) was enacted under the ETA. It was recently published in the Government Gazette on December 23, 2022. After a 240-day grace period, the Digital Platform Royal Decree will become fully effective on August 20, 2023.

Kritiyanee Buranatrevedhya and Thananya Chaikamonsuk, from Baker & McKenzie Limited Attorneys at Law, dissect the Digital Platform Royal Decree, with a particular focus on obligations of digital platform service operators.

September 2022

Thailand: Operationalising PDPA - Lawful basis, sensitive personal data, and data processing safeguards - Part four

The Personal Data Protection Act 2019 ('PDPA') came into full force and effect on 1 June 2022. It governs the processing (i.e. the collection, use, and disclosure) of personal data of data subjects residing in Thailand carried out by businesses, defined as persons or legal entities who are data controllers or data processors. The PDPA protects the rights of data subjects and recognises the need of businesses for processing personal data for appropriate and limited purposes.

Part one provides an overview of the key notification and consent requirements that businesses must meet to comply with the PDPA. Part two discusses the requirements set out in the PDPA in relation to data transfers and localisation. Part three explores the PDPA's provisions on vendor management, breach reporting, and legal liability. As part four of the Insight series on the operationalisation of the PDPA, Nopparat Lalitkomon and Thammapas Chanpanich, from Tilleke & Gibbins, give an overview over lawful bases for processing, sensitive personal data, and data-processing safeguards under the PDPA.

September 2022

Thailand: Operationalising PDPA - Vendor management, breach reporting, and legal liability - Part three

The Personal Data Protection Act 2019 ('PDPA') came into full force and effect on 1 June 2022. It governs the processing (i.e. the collection, use, and disclosure) of personal data of data subjects residing in Thailand carried out by businesses, defined as persons or legal entities who are data controllers or data processors. The PDPA protects the rights of data subjects and recognises the need of businesses for processing personal data for appropriate and limited purposes.

Part one provides an overview of the key notification and consent requirements that businesses must meet to comply with the PDPA. Part two discusses the requirements set out in the PDPA in relation to data transfers and localisation. As part three of the Insight series on the operationalisation of the PDPA, Dhiraphol Suwanprateep and Thananya Chaikamonsuk, from Baker & McKenzie Limited Attorneys at Law, explore the PDPA's provisions on vendor management, breach reporting, and legal liability. Part four gives an overview over lawful bases for processing, sensitive personal data, and data processing safeguards under the PDPA.

September 2022

Thailand: Operationalising PDPA - Data transfers and localisation - Part two

The Personal Data Protection Act 2019 ('PDPA') came into full force and effect on 1 June 2022. It governs the processing (i.e. the collection, use, and disclosure) of personal data of data subjects residing in Thailand carried out by businesses, defined as persons or legal entities who are data controllers or data processors. The PDPA protects the rights of data subjects and recognises the need of businesses for processing personal data for appropriate and limited purposes.

Part one provides an overview of the key notification and consent requirements that businesses must meet to comply with the PDPA. As part two of the Insight series on the operationalisation of the PDPA, Dhiraphol Suwanprateep and Thananya Chaikamonsuk, from Baker & McKenzie Limited Attorneys at Law, discuss the requirements set out in the PDPA in relation to data transfers and localisation. Part three explores the PDPA's provisions on vendor management, breach reporting, and legal liability. Part four gives an overview over lawful bases for processing, sensitive personal data, and data processing safeguards under the PDPA.

August 2022

Thailand: Operationalising PDPA - Notification and consent requirements - Part one

The Personal Data Protection Act 2019 ('PDPA') came into full force and effect on 1 June 2022. It governs the processing (i.e. the collection, use, and disclosure) of personal data of data subjects residing in Thailand carried out by businesses, defined as persons or legal entities who are data controllers or data processors. The PDPA protects the rights of data subjects and recognises the need of businesses for processing personal data for appropriate and limited purposes.

As part one of the Insight series on the operationalisation of the PDPA, Kowit Somwaiya and Usa Ua-areetham, from LawPlus Ltd., provide an overview of the key notification and consent requirements that businesses must meet to comply with the PDPA. Part two discusses the requirements set out in the PDPA in relation to data transfers and localisation. Part three explores the PDPA's provisions on vendor management, breach reporting, and legal liability. Part four gives an overview over lawful bases for processing, sensitive personal data, and data processing safeguards under the PDPA.

Company

Our Policies

Your Rights

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
© OneTrust, LLC. All Rights Reserved.
The materials herein are for informational purposes only and do not constitute legal advice.