On October 31, 2024, Thailand’s Office of the Personal Data Protection Committee (PDPC) opened a public consultation period on its draft notification regarding exemptions from the requirement to create and maintain records of processing activities (ROPAs) under the Personal Data Protection Act B.E. 2562 (2019) (PDPA).
This draft notification aims to amend and revoke certain aspects of the first ROPA exemption notification issued in June 2022 and outlines the criteria for data controllers to be exempted from the obligation to prepare and maintain such records. Although it is officially titled “Notification of the Personal Data Protection Committee on Exemption from Record-Keeping Requirements for Small Business Data Controllers,” this draft notification applies to all types of exempted data controllers (see list below), and not only small businesses.
The criteria under the draft notification exempt certain data controllers from the obligation to maintain ROPAs, but not from the obligation to retain information on the rejection of data subjects’ requests to exercise certain rights under the PDPA. While these criteria remain consistent with the June 2022 ROPA exemption notification, there are a few notable amendments to certain issues, as detailed below.
Types of Exempted Parties
The draft notification adds condominium and housing estate juristic persons, as well as individuals, to the list of parties eligible for an exemption, while removing internet cafes from the list.
The complete list of parties eligible for ROPA exemptions under the draft notification is as follows:
Carve-Outs from the ROPA Exemption
Parties exempted from the ROPA requirement must not be data controllers obligated to appoint a data protection officer (DPO) under the PDPA. In addition, exempted parties must still prepare and maintain a ROPA when the collection, use, or disclosure of personal data:
Under the June 2022 ROPA exemption notification, service providers required to retain computer traffic data under the law related to computer crime are not eligible for the exemption. The draft notification, however, does not currently include this stipulation.
The consultation period will be open until November 14, 2024, and the draft may be subject to additional revisions before it is finalized and made legally binding.
For more details on this draft notification, or on any aspect of compliance with the PDPA, please contact Nopparat Lalitkomon at [email protected], Napassorn Lertussavavivat at [email protected], or Wilin Somya at [email protected].