The Ministry of Digital Economy and Society ('MDES') published, on 6 September 2021, its draft secondary laws under the Personal Data Protection Act 2019 ('PDPA'), following public hearings. In particular, the MDES had created eight secondary laws under the PDPA to supplement and further establish the requirements of data protection legislation. The eight secondary laws address respectively:

• the criteria and methods for obtaining consent from personal data subjects;
• the notification of purpose and use of data for processing:
• the appropriate measures for the processing of personal data in accordance with Article 26 of the PDPA;
• the determination of rules and policies for protection of personal data sent or transferred to foreign countries, including the rules for the storage of data within and outside of Thailand;
• the right of access and requirements of record processing, with specific rules relating to, among other things:
  • personal data collected by providing a description of the type of owner;
  • the purpose of processing each type of personal data;
  • the name and information about the data controller, agents, and data protection officer ('DPO');
  • the duration of retention and deletion of various types of personal data;
  • rights and methods of accessing personal data including the conditions for requesting access rights;
  • general description of the security measures for processing of personal data;
• the security standards of processing personal information;
• the role of the DPO; and
• the complaints mechanism for the data protection authory and its administrative enforcement.

You can access the draft secondary laws, only available in Thai, here.