Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

Thailand: PDPC publishes notification on DPO appointment, to be effective in December 2023

On September 14, 2023, the Personal Data Protection Committee (PDPC) published in the Government Gazette the notification on data protection officer (DPO) appointment, following a public consultation. The notification will enter into force 90 days from its publication in the Government Gazette, namely on December 13, 2023. 

In particular, the notification clarifies which personal data processing constitutes regular monitoring of the personal data or the system, because of large-scale personal data, which is one of the conditions that requires data controllers and data processors to appoint a DPO under the Personal Data Protection Act 2019 (PDPA).

In addition, the notification clarifies that a processing activity that requires regular monitoring of personal data refers to activities that entail tracking, monitoring, analyzing, or predicting behavior, attitudes, or profiles of individuals. Such activities involve collecting, using, or disclosing personal data in a systematic and regular way.

Moreover, the notification prescribes that, in order to determine whether processing activities constitute large-scale processing of personal data, data controllers and processors must assess:

  • the number or proportion of data subjects whose personal data is processed;
  • the volume, type, or nature of personal data processed;
  • the duration of the processing of personal data; and
  • the scope or areas of the processing of personal data.

Further to the above, the notification specifies certain cases of large-scale processing, such as the collection, use, or disclosure of personal information of more than 100,000 data subjects, when such processing is part of the core activities of a data controller or data processor.

Separately, the notification also provides that the DPO may perform other duties as long as they do not conflict with the performance of duties attributed to the DPO by the PDPA.

You can read the notification, only available in Thai, here.

Update: December 13, 2023

PDPC publishes forms for the requirement to appoint DPOs

On December 6, 2023, the PDPC published two forms for download to assist those unsure if they fall under the above-mentioned requirement:

  • a form for notifying information about DPOs; and
  • an evaluation form for the provision of DPOs according to Section 41 of the PDPA.

You can read the press release and access the forms, only available in Thai, here.