Insights

Latest News

    Trending Topics

      People

      Careers

      About

      About

      • About Us
      • The Rouse Network
      • The Rouse Difference
      • Rouse Connect

      Grass Roots

      • Climate Change
      • Mitrataa
      • Rouse Cares

      Thailand’s Personal Data Protection Act further extended

      Published on 07 May 2021 | 2 min read

      The Personal Data Protection Act BE 2562 (PDPA), published in the Government Gazette on May 27, 2019, was originally scheduled to become fully effective on 27 May 2020. The COVID-19 pandemic was cited as a major obstacle for all affected sectors and, as a result, the Government deferred the full enforcement of the PDPA to May 27, 2021. On May 5, 2021 the Thai Cabinet, also citing the pandemic, has further postponed the enforcement of the PDPA to one year, i.e. June 1st 2022. Since the new legislation will bring significant changes to the current data protection regulatory environment and challenges for organizations doing business in Thailand, this further extension alleviates the impact of the law on stakeholders by giving them additional time to best prepare for June 1st 2022. In this article we highlight key aspects of the law and action points.

      DC: Data Controller

      DPO: Data Protection Officer

      PDPA: Personal Data Protection Act

      PDPC: Personal Data Protection Committee

       

      Grandfather provision (Section 95 of the PDPA)

      The PPDA allows the DC to continue to keep and use personal data which was collected before the PDPA becomes effective provided the collection or use is within the scope of the original purpose.

      The DC must however prepare and publicize a method for the DS to easily withdraw his or her consent through an opt-out procedure.

      Action point:

      • Whether your company has “opt out” procedure for past personal data collected. This should be in place before June 1st 2022.

       

      Cross border transfer of personal data (Sections 16.5, 28, 29 of the PDPA)

      The recipient country (e.g. Germany) of personal data collected in Thailand must have an “adequate personal data protection standards” and the migration of data must comply with the rules of the protection prescribed by the PDPC. As of today these rules have not yet been enacted. However, there is one exemption when there is a personal data protection policy with overseas to the DC’s affiliates (i.e. corporate rules), such policy shall simply be reviewed and certified by the PDPC.

      Action point:

      • Whether your company has a global personal data protection policy covering the migration of personal data to your HQ office or other offices. If not, consider developing a policy to cover Thailand.

       

      Appointment of a DPO (Section 26 of the PDPA)

      A DPO shall be appointed if the activities of the DC or DP require regular monitoring due to the large scale and/or sensitivity of personal data. The scale shall be determined by the PDPC. The DPO’s activities shall be filed to the PDPC. The DPO should be able to communicate in Thai.

      Action point:

      • Verify the size and nature of personal data in Thailand and whether this may require appointing a DPO. The law is still silent on the threshold of personal data in order to appoint a DPO. We shall await the PDPC to issue a notification on the threshold.

       

      Key actions & time frame

      Key actions to ensure compliance with the PDPA are summarized below:

      30% Complete
      Principal, Climate Change & IP Group Head and Myanmar Country Manager
      +66 2 653 2730
      Principal, Climate Change & IP Group Head and Myanmar Country Manager
      +66 2 653 2730