Thailand’s Personal Data Protection Act Passes into Law

May 31, 2019

Thailand’s Personal Data Protection Act Passes into Law

Thailand’s Personal Data Protection Act B.E. 2562 (2019) (PDPA), approved by the government earlier this year, was published in the Government Gazette on May 27, 2019.

Provisions relating to the collection, use, and disclosure of personal data will come into force one year after publication. The law is written to be extraterritorial, meaning that it applies to data controllers regardless of their location. Therefore, all applicable business operators who collect or process the personal data of data subjects in Thailand must be fully compliant with the PDPA by May 27, 2020.

Restrictions on the Collection and Use of Data

Personal data, in the context of the PDPA, is an extremely broad term covering any data from which an individual can be identified—notably those belonging to customers, employees, and suppliers, etc., but potentially extending to any data held by a company in the course of their business.

The most significant restrictions on the collection and use of such data under the PDPA are:

a requirement for data controllers to obtain consent from data subjects (in writing or online) before they can process their personal data (subject to certain exceptions);
more stringent requirements for sensitive personal data;
a requirement to arrange sufficient security measures for storing personal data and sensitive personal data;
restrictions on the transfer of personal data to other countries;
data breach notification requirements; and,
a requirement for data controllers outside Thailand to appoint a representative within the jurisdiction, who will have certain rights and obligations.

Rights of Data Subjects

In addition, the PDPA grants data subjects various rights over data held by others that relates to them, including, amongst others, right of access, right to erasure, right to object, and the right to data portability. Data controllers must ensure that they honor and guarantee those rights as part of their operations.

Sanctions for Non-Compliance

Penalties for noncompliance are severe, with each offence potentially incurring administrative fines of up to THB 5 million, and criminal fines of up to THB 1 million. The court can also award punitive damages of up to twice the damage caused, and imprisonment for up to a year.

How to Prepare

Given the wide impact of these amendments, and the short grace period for compliance, prudent business operators should conduct a gap analysis in order to understand the classes of data that they currently possess; identify current levels of compliance; assess and mitigate the risks involved in each activity which falls under the PDPA; and review their internal policies, agreements, practices, and any other instruments related to personal data to resolve issues identified in the gap analysis before May 27, 2020.

Business operators should also take necessary actions to ensure that their employees and personnel are fully trained and ready to handle the PDPA in a practical and efficient manner. Business operators should also take the opportunity to review their systems—both online and offline—to ensure that any personal data under their possession is secure held.

If you have any questions, please contact Athistha (Nop) Chitranukroh at [email protected] or Gvavalin Mahakunkitchareon at [email protected].

Related Professionals

Gvavalin Mahakunkitchareon

Thailand

+66 2056 5648

Email

Athistha (Nop) Chitranukroh

Partner and Director, Corporate and Commercial

Thailand

+66 2056 5600

Email

RELATED INSIGHTS

December 24, 2024

Vietnam’s Data Revolution: Law on Data

On November 30, 2024, the Data Law was officially promulgated after an accelerated preparation process that began in February 2024. The Data Law is set to take effect on July 1, 2025. Having extraterritorial effect, the Data Law will impact both local and foreign individuals and enterprises. As noted in our previous legal update, the Data Law governs digital data, the National Data Center, the National General Database, digital data products and services, digital data management, and the rights, obligations, and responsibilities of agencies, organizations, and individuals related to digital data activities. This legal update provides an overview of the Data Law, with a deep focus on the key provisions likely to impact businesses operating or offering services in Vietnam. New Data Definition and Classification The Data Law broadly defines “digital data” as data about objects, phenomena, and events, which can include one or a combination of audio, images, numbers, text, or symbols represented in digital format (hereinafter referred to as “data”). This definition is very broad and potentially covers any information recorded or represented in digital forms, including personal and nonpersonal data (such as business data, transactional data, trade secrets, etc.). Data is further categorized into different types that can be used by public bodies. However, the rights and obligations associated with each type of data are not clearly addressed. The data classification criteria include: The nature of data sharing (shared data, private data, open data); The importance of data (core data, important data, and other data); Any other criteria to meet the requirements of data administration, processing, and protection, as determined by the data owner. While the Data Law requires private organizations to categorize data based on its level of importance, it still grants these organizations the right to categorize data based on other criteria. Cross-Border Data

December 12, 2024

Vietnam’s National Strategy on Blockchain

Vietnam is a world leader in blockchain adoption and growth, appearing near the top of most rankings of cryptocurrency ownership and blockchain investment. Although the country has taken a cautious approach toward cryptocurrency (banning the use of cryptocurrencies like Bitcoin as a means of payment, for example), the government actively supports blockchain technology and its applications in non-financial sectors. Recognizing blockchain as a core technology of the Fourth Industrial Revolution, as a part of Vietnam’s broader digital transformation agenda, the government issued Decision No. 1236/QD-TTg on October 22, 2024, providing the National Strategy for Blockchain Application and Development to 2025, with Orientation to 2030. Like the National Strategy on Digital Infrastructure, the National Strategy on Blockchain outlines a very ambitious vision to position Vietnam as a regional leader in blockchain technology. The strategy aims for Vietnam to master and apply blockchain across all socio-economic sectors, supporting the nation’s goal of becoming a stable and prosperous digital nation by 2030. The specific goals set for 2025 include developing Vietnam’s blockchain infrastructure and ensuring compliance with cybersecurity and data protection laws; advancing blockchain research through three national innovation centers; building and upgrading 10 facilities dedicated to blockchain research and workforce training; and expanding blockchain education by integrating it into university programs. The strategy also aims to establish at least one blockchain center, special zone, or area, as a pilot, to build a national blockchain network; and foster a blockchain ecosystem by promoting its application across sectors such as banking and finance, transportation, healthcare, education and training, commerce, logistics, postal services, industrial production, energy, tourism, agriculture, public services, and more. The goals for 2030 include strengthening Vietnam’s national blockchain infrastructure to support both domestic and international services, positioning Vietnam as a global and regional leader in blockchain research, application, and development. The

December 11, 2024

Vietnam Issues New Data Law

On November 30, 2024, the National Assembly of Vietnam issued a new Law on Data (“Data Law”), the first of its kind in the country. Initiated by a legislative proposal in February 2024, the Data Law underwent an accelerated preparation process and was officially promulgated just nine months later. It is worth noting that the Data Law is not the same as the Personal Data Protection Law, which is still in draft form and is expected to be submitted to the National Assembly in November 2025. The scope of application of the Data Law is broader, including not only personal data but also other types of data. The Data Law governs digital data, the National Data Center, the National General Database, digital data products and services, digital data management, and the rights, obligations, and responsibilities of agencies, organizations, and individuals related to digital data activities. Set to take effect on July 1, 2025, the Data Law is expected to have a significant impact on businesses involved in data-processing activities. Below are some key takeaways from this pivotal legislation. Cross-Border Data Transfer and Processing The Data Law recognizes and protects the freedom of cross-border data transfer and processing, as well as the legitimate rights and interests of relevant agencies, organizations, and individuals. The government is assigned the responsibility to provide detailed regulations on cross-border data transfer and processing activities, including the transfer of offshore data into Vietnam. National Data Center Resolution No. 175/NQ-CP issued by the Vietnamese government in October 2023 set out ambitious goals for a new National Data Center, which will integrate and manage human-related data from the national database, databases of ministries and central and local authorities, and other databases. The National Data Center is expected to be a core platform to provide data-related services, support policy

December 11, 2024

Thailand Releases Draft of Amended Electronic Transactions Act

Thailand has released a draft amended Electronic Transactions Act (ETA), which aims to overhaul the current version of the law from 2001 to correct its enforcement limitations and update the ETA to be consistent with current electronic transactions practice. The draft ETA is open for public comment until December 20, 2024. The draft ETA introduces a new supervisory scheme that (1) recognizes electronic transactions executed by both current and future technologies without having to enact regulations recognizing the technology, (2) replaces the licensing, registration, and notification scheme for electronic transaction service providers with a trust-mark scheme, and (3) introduces a new mechanism to regulate electronic transaction service providers. The major amendments under the draft ETA address: Relationship with other relevant laws. The draft ETA is designated as the primary law governing electronic transactions, whether between private parties or between private parties and the state. However, if specific laws—including those on electronic administrative procedures—prescribe methods for conducting particular electronic transactions, those laws will prevail. Definitions. The draft ETA revises some existing terms, such as “transaction,” which is now more clearly defined as “any act relating to civil or commercial activities, including administrative procedures, administrative contracts, and any other actions by government agencies or officials.” It also introduces new definitions, such as “biometric data,” “automated system,” and “electronic seal.” Electronic transaction reliability. The draft ETA now clearly provides that electronic transactions executed using a method or an electronic method stipulated by the Electronic Transactions Development Agency (ETDA) as reliable are themselves presumed to be “reliable.” In case of a challenge over the implementation of a certified method or certified service, the challenging party bears the burden of proof and related expenses. Electronic transferable instruments. The draft ETA adopts the UNCITRAL Model Law on Electronic Transferable Records (ETRs) in recognizing ETRs (e.g.,

You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

Industries

Practices

May 31, 2019