Get exclusive insights on privacy laws, compliance strategies, and product updates delivered to your inbox
Thailand’s Personal Data Protection Act (PDPA) was adopted into law on May 28, 2019, after being published in the Royal Thai Government Gazette a day earlier.
Explore more privacy compliance insights and best practices
Like the GDPR, the aim of the PDPA is to safeguard Thai data owners from the illegal collection, use, or sharing of their personal information.
The scope of the PDPA covers businesses that are not headquartered in Thailand that market goods or services to Thai residents, or track their behavior.
Most importantly, this law is applicable regardless of whether any payment is required for these activities or not.
Some of the core similarities between the PDPA and GDPR include;
Under the PDPA, the legal bases for processing personal data include consent, legal obligation, public interest, and legitimate interest.
On the other hand, individual privileges include, but are not limited to the rights to access, erasure, or modify.
Lastly, the PDPA also aims to establish a Personal Data Protection Committee (PDPC), which is similar to the GDPR’s Data Protection Authorities (DPAs).
It goes without question that the key definitions in Thailand’s PDPA are inspired by the GDPR. They include;
Personal Data; broadly described as information that can directly or indirectly pinpoint an individual. However, this definition does not include the data of a deceased individual, or private business information such as contact details, titles, or location.
Data Controller; The PDPA identifies a data controller as the authority that determines the means and purpose of collecting, using, and sharing personal data.
Data Processor; According to the PDPA, a data processor is any individual or party that gathers, uses, or shares personal information as directed by the data controller.
Sensitive Personal Data; This is information related to a data subject’s race, political views, religious beliefs, criminal background, genetic information, health data, sexual preference, biometric information, as well as trade union membership
Primarily, the PDPA is focused on safeguarding data owners from the illegal collection, use, or disclosure of personal data.
Like the GDPR, websites will be expected to have a simple and clear language in their privacy policies, seek active consent from users at the point of collecting, and sharing the data with third parties, as well as outlining the purpose of collecting this information.
As such, the rights of data owners under the PDPA include;
Similar to the GDPR, Thailand’s PDPA explicitly states that clear, express consent must be sought on or before the collection of personal information. The law goes to make it clear that consent requests should not be misleading or deceptive.
Another crucial aspect regarding consent requirements under the PDPA is that data owners are allowed to withdraw their consent at any time. However, this withdrawal does not affect the collection, processing, or sharing of personal information that had been legitimately consented to.
However, the law also exempts the need for consent for the collection of personal information in specific circumstances. They include;
Concerning minors, Thailand’s data privacy law requires parental consent for data subjects below 10 years old. This provision differs from the GDPR which requires parental consent for all children below the age of 16.
This regulation will establish the Personal Data Protection Committee (PDPC). The PDPC will be responsible for the enforcement of the PDPA and guarantee compliance through the development of guidelines and implementation of a data protection framework.
Companies found in violation of Thailand’s data privacy law will be liable to both criminal and civil fines. Each offense is likely to attract administrative penalties of up to TBH 5 million, which is equivalent to $165,000.
Apart from the fines, the PDPA also allows courts to enforce punitive compensations of up to double the amount of the actual damages and a one-year prison sentence.
Lastly, the PDPA allows data owners to lodge class action lawsuits.
It is vital for businesses to begin assessing their data processing practices and take the necessary measures to ensure compliance. Some of the steps include:
