Manage user consent online and meet PDPA compliance

Personal data is broadly defined as any information relating to a person, that can be used to identify such a person, whether directly or indirectly, but not including the information of deceased persons. 

Personal data involves general data, such as name, phone number, physical addresses, credit card numbers, location etc. while data such as racial, sexual, religious, health, political, and biometric information are considered sensitive personal data.

Personal data that is considered ‘sensitive’ under PDPA includes information related to racial or ethnic background, political views, affiliations with cults, religious or philosophical beliefs, sexual conduct, criminal history, health information, disabilities, trade union details, genetic data, biometric information, or any data that might impact the data subject in the same manner. 

The PDPA imposes certain restrictions for transferring personal data outside of Thailand. Organizations are allowed to transfer personal data outside of Thailand if they have an adequate data protection standard per the rules of the Personal Data Protection Committee (PDPC). The PDPC will issue the list of countries or organisations based on their “adequacy decision”.

In the absence of an adequacy decision, businesses may rely on the legal basis under  PDPA, Binding Corporate Rules (BC) and Standard Contractual Clauses (SCC). 

The PDPC published two notifications in December 2023 regarding the cross-border transfer of personal data.  Businesses that require international data transfer need to ensure that they comply with the new requirements by 24 March 2024.

The Personal Data Protection Committee (PDPC) is the regulatory authority for the Personal Data Protection Act (PDPA) in Thailand. The PDPC is responsible for drafting and issuing future sub-regulations under the PDPA, promoting and supporting the protection of personal data, issuing notifications or orders regarding PDPA, and establishing rules/guidelines for data controllers and processors.

As GDPR has extra-territorial scope, businesses in Thailand that collect and process the personal data of EU/EEA may be required to comply with the provisions of GDPR. 

Meanwhile, the PDPA was heavily influenced by the EU’s GDPR and has extraterritorial applicability. It applies to any organization that collects, uses and discloses the personal data of individuals in Thailand.

Thailand’s Personal Data Protection Act (PDPA) mandates that a data controller should promptly notify any personal data breach within 72 hours to the Personal Data Protection Committee (PDPC) and the data subjects (only if there is a substantial risk to the rights and liberties of the data subject) unless it can be substantiated that no such risk exists.

The PDPC sets out elaborate requirements for personal data breach notification, you can find a summary here. 

Here are some links you can refer to for additional reading:

• Official Text: Personal Data Protection Act 2019
• Simplified Guide to Thailand’s PDPA