The Ministry of Digital Economy and Society ('MDES') published, on 23 May 2022, draft notifications and guidelines under the Personal Data Protection Act 2019 ('PDPA'). In particular, the MDES had introduced eight draft notifications and guidelines under the PDPA to supplement the data protection requirements in Thailand, including:

• exemptions for records of processing for small businesses;
• rules and procedures on records of processing activities;
• security measures for data controllers and data processors;
• guidelines and methods for obtaining consent;
• guidelines for the purpose and details of collection, use, and disclosure of personal information;
• procedures for the appointment of expert committees;
• complaint mechanisms and management for violations of the PDPA; and
• rules for enforcement and administrative penalties for violations of the PDPA. 

You can access the draft notifications and guidelines here and here, both only available in Thai.