Guide to Thailand’s Personal Data Protection Act (PDPA)
In this guide:
Overview of Thailand’s Personal Data Protection Act (PDPA)
Following an initial postponement, Thailand’s Personal Data Protection Act (PDPA) entered into force in 2022 as the country’s first consolidated data protection law. Widely considered comparable to the European Union (EU) General Data Protection Regulation (GDPR), the PDPA was enacted via Royal Decree and published in the Royal Gazette to protect individuals’ right to data privacy and establish the Personal Data Protection Committee (PDPC) to oversee enforcement of the law’s provisions. Like so many international data privacy laws, the PDPA has an extraterritorial scope to ensure all organizations collecting personal data in Thailand or on Thai residents must comply, regardless of the business location.
Put more simply, the PDPA applies broadly to the processing of personal data in Thailand, creating requirements for businesses and rights for individuals. But before diving in too deep, it’s important to define and understand the crucial terms laid out in the PDPA:
- Personal data: Information that can directly or indirectly identify a natural person. Personal data includes things like name, address, identification number, location data, online behavior, health information and more.
- Data subject: The person to whom the personal data belongs.
- Data controller: An entity or individual responsible for determining the purposes and means of processing personal data.
- Data processor: An entity or individual processing personal data on behalf of the data controller.
Another core function of the PDPA is to establish requirements for the collection, use, disclosure and transfer of “sensitive personal data” which includes race, ethnicity, political opinions, cult/religious beliefs, sexuality, health data and biometric data. Stricter consent rules apply for processing this type of information.
The PDPA includes the following key provisions, which set the legal basis for data protection in Thailand:
- Personal data must be processed fairly and lawfully.
- Personal data must be collected only for specific, explicit purposes that are legitimate and clearly communicated to the data subject at time of collection.
- The purposes for which personal data is used must be disclosed and be consistent with the communicated reasons for why it was collected initially.
- Held personal data must be accurate, updated and complete.
- Data collection must be adequate, relevant and not excessive.
- Personal data must not be kept any longer than is necessary for the expressed purposes, often referred to as data minimization.
- Collected data must be protected with appropriate security safeguards.
Data controllers and processors must register all processing activities, especially higher-risk situations, with Thailand’s PDPC. Specific obligations around data subject rights, transfers of personal data abroad, notifications in case of security breaches, and more are placed on any business operating in the country. Plus, there are even more provisions concerning the use of personal data for marketing and research purposes, and stricter rules applied to organizations processing the personal data of children. Importantly, the entire process of processing an individual’s personal data must always start with obtaining their informed, valid consent.
Valid consent requires informing data subjects of details like purpose of data processing, recipient category, data transfers abroad, period of storage, and data subject’s right to withdraw consent. Silence or inaction does not constitute consent. In this same way, the PDPA establishes rights for data subjects.
The enumerated rights for data subjects are as follows:
- Right to access: Data subjects can request access to their personal data held by a data controller.
- Right to be informed: Data subjects can request to know the purposes for which their personal data is being used.
- Right to rectification: Individuals can request corrections to inaccurate or incomplete personal data.
- Right to erasure: Data subjects have the right to request the deletion of their personal data under certain conditions.
- Right to restriction of processing: Individuals can limit the way an organization processes their personal data. When this right is exercised, the organization can still store the data but is restricted from using it for any purpose other than storage, with some exceptions for necessary usage.
- Right to data portability: Data subjects can receive their personal data in a structured, commonly-used, and machine-readable format.
- Right to object: Individuals can object to the processing of their personal data for specific purposes.
When these rights are violated by an individual or organization, a data subject can contact the PDPC to file a complaint. The PDPC has a number of powers to enforce compliance with the PDPA, including the ability to issue fines up to THB 5 million (about $145,000 US), order organizations to cease processing personal data entirely, and/or order organizations to disclose personal data breaches.
The PDPA is a significant piece of legislation that has had a major impact on the way that personal data is collected, used, and disclosed in Thailand. The PDPA is designed to protect the privacy of individuals and to ensure that personal data is handled in a responsible and ethical manner. Organizations that are subject to the PDPA must take steps to comply with its requirements or risk facing significant fines and other penalties. But this doesn’t have to be a burden; instead, it can be an opportunity for businesses to increase consumer trust and brand equity while differentiating themselves in the global marketplace.
Guarantee business compliance
Because of the many obligations placed on businesses operating in Thailand or marketing to Thai residents, ensuring compliance can feel like a massive undertaking. But it doesn’t have to be. By analyzing the international data privacy legal landscape, organizations can implement processes and protocols to maintain compliance for most of these laws at the same time. Thankfully, this is because there’s a ton of overlap in the provisions included in these laws. There are typically only slight nuances or tweaks that change country to country, although some countries like the Unites States are still lacking unified, country-wide legislation.
For Thailand’s PDPA, businesses should consider the following applicable requirements, in addition to the consent, purpose limitation and data minimization mandates mentioned above:
- Ensure transparency: Data controllers are required to provide clear information about the processing of personal data, including the purposes, methods and rights of data subjects.
- Create clear processes to support data subject rights: Organizations must be prepared to facilitate requests from data subjects exercising their rights, including the right to access, rectification, erasure, restriction of processing, data portability, and objection.
- Effective data security: Businesses are obligated to implement appropriate security measures to protect personal data from unauthorized access, disclosure, alteration, and destruction. Regular risk assessments and security audits are advisable to ensure the ongoing effectiveness of security measures.
- Data Protection Impact Assessment (DPIA): Data controllers must conduct a DPIA for high-risk processing activities to assess and mitigate the impact on data subjects’ privacy.
- Prompt data breach notification: Organizations are required to report data breaches to the PDPC and affected data subjects without undue delay. The notification should include details of the breach, the likely projected consequences, and the measures taken or proposed to address it, which is why documentation is so important.
- Special care for cross-border data transfer: Although Thailand does not explicitly require data localization, cross-border transfers of personal data are subject to additional conditions. The PDPA does indirectly encourage local storage of personal data, and businesses must always ensure the company on the receiving end of a cross-border data transfer provides an adequate level of protection or implement additional safeguards. Otherwise, approval may be needed from the PDPC before the transfer occurs.
- Appoint a Data Protection Officer (DPO): Some organizations, typically larger ones, are obligated to appoint a DPO responsible for overseeing compliance with the PDPA. The DPO acts as a point of contact between the organization, data subjects, and the PDPC.
- Recognize special categories of data: Businesses should be aware of the additional requirements for processing sensitive personal data, such as health data or biometric data.
- Establish contracts with data processors: When engaging third-party data processors, businesses must enter into written agreements that specify the scope and purpose of data processing. This must require the processor to implement appropriate security measures as well.
- Keep detailed records of processing and security activities: Data controllers should maintain records of data processing activities, including details of consent, for compliance and accountability purposes. It also helps to record all proactive actions taken to secure personal data, just in case a data breach does occur.
- Train and regularly communicate with employees: Employees handling personal data should receive training on data protection principles and compliance requirements. Creating a culture of awareness within the organization is crucial.
- Perform regular compliance audits: Conduct regular audits, ideally using a third-party, to routinely assess compliance with the PDPA and address any issues promptly.
Businesses operating in Thailand must prioritize data protection by integrating these new processes into their operations. Developing and implementing robust data protection policies, procedures, and training programs is essential to comply with the PDPA and to build trust with customers and stakeholders.
It’s important to keep up with the latest updates to the PDPA as well. For example, the law provides the possibility for sector-specific regulations to be issued. This flexibility allows for the adaptation of data protection rules to specific industries, ensuring that the law is applicable across various sectors. Because the PDPA includes language defining criminal liability for certain offenses related to the unlawful processing of personal data, there are tough repercussions for any individual violating the Act’s requirements.
Overall, the PDPA is a positive development for businesses in Thailand. While there are some negative impacts, such as increased compliance costs and operational complexity, the benefits of complying with the law, such as building trust with customers and enhancing brand reputation, outweigh the costs. By taking these steps outlined above, businesses can help to ensure that they are compliant with the PDPA while protecting the privacy of their customers.
How Privacy Bee helps
Protecting personal data while providing the required information about data usage to all users is imperative for businesses engaged in online service delivery today. New regulations are sprouting up around the word, necessitating more stringent opt-in and opt-out policies and granting consumers more rights. Consumers now have the ability to review and remove their personal data, increasing the accountability of every organization processing personal identifiable information (PII).
Despite the creation of additional regulations in more countries every year, the responsibility still falls primarily on the individual to oversee, assess, update and delete (via DSAR request) their personal data wherever it may be collected and dispersed across the internet. This task becomes a massive undertaking when working to cover an entire organization, rendering it practically impossible for a single person or small team to manage without outside professional help. Yet the identification and subsequent elimination of this data play a pivotal role in deterring cybercriminals from launching dangerous social engineering attacks against an organization.
This is where Privacy Bee emerges as the optimal solution, simplifying the time-consuming process of monitoring and eradicating employee personal data for business leaders. It’s especially effective for executives who are highly visible to the general public. Using sophisticated automation processes backed by a human service team, Privacy Bee substantially reduces a company’s attack surface and mitigates the looming threat of a data breach. Social engineering attacks are the fastest-growing data breach threat, no matter how mature an organization’s cybersecurity program is today. If it isn’t already covered, then threat actors still have a way to target your organization’s most sensitive information.
If you are already conducting risk assessments and vendor surveys, kudos to you! However, it is still essential to recognize vendors are most susceptible to a breach via subpar data privacy management, which you wouldn’t want to bleed into your organization. Privacy Bee not only minimizes the proliferation of your organization’s personal data across the vast digital landscape but also extends its protective umbrella to vendors, helping you ensure 3rd party partners do not serve as the weak link in your security defenses.
But why would anyone want to do such a thing?
In the ever-expanding, billion-dollar surveillance industry, Data Brokers and People Search Sites have assumed pivotal roles, reaping record-breaking profits by trading and transferring your organization’s information with obscure and uncontrollable entities. These entities then either publish this information or compile it to sell on again, and suddenly your personal data can be easily found after a quick Google Search. The consequences of private data exposure are far-reaching and pose significant threats if the information can be quickly obtained by malicious cybercriminals. If it’s as simple as a quick search to find you or your coworker’s information, then threat actors can launch cyberattacks at scale by targeting the most vulnerable team members with emotionally engaging messaging that turn even the most highly-trained professionals into victims. The only way to prevent this is by stopping the data flow at the source, because the consequences are simply too costly to risk.
A solitary data breach leads to massive productivity losses for all affected, expensive remediation efforts, and recurring breach incidents. This isn’t new, and is a predicament that plagues the vast majority of businesses following an initial breach. Industry estimates state as many as 83% of organizations who experienced a data breach go on to experience multiple. That is staggering, and is exactly what Privacy Bee is fighting back against. The first data breach sets off a chain reaction that inflicts short-term damage on your bottom line while eroding brand value and customer trust over time. Furthermore, there are ripple effects to consider, such as heightened employee turnover due to poaching.
Privacy Bee combats external threat actors lurking beyond your organization’s perimeters. By meticulously pinpointing every nook and cranny of the internet where sensitive data resides and swiftly purging it, Privacy Bee closes the data security gap. The service even encompasses dark web monitoring and provides timely data breach notifications if another company falls victim to an exploitation incident and potentially exposes your information in the process.
Our unwavering commitment is deeply rooted in the belief that privacy is an inalienable human right that transcends political discourse and negotiations. This is why Privacy Bee vigilantly monitors user data for security vulnerabilities while holding the surveillance industry accountable. We compel Data Brokers, People Search Sites, and more than 150,000 additional websites to expunge your stored data and opt out of further data collection to protect you, your family, and your entire organization.
Privacy Bee protection covers a wide range of potential threats, including:
- Data breaches
- Social engineering attacks
- Doxxing
- Identity theft
- Spam emails
- Telemarketing calls
- Cyberstalking
- Swatting
- Blackmail
Privacy Bee is a powerful tool for business leaders who want to protect their employee and customer data. In today’s world, where privacy is more important and harder to come by than ever, you need a trusted partner fighting to preserve your personal and organizational integrity.
