You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

July 29, 2021

Video: Compliance Catalysts – PDPA Subordinate Regulations

Subscribe to Updates

Following the enactment of Thailand’s Personal Data Protection Act (PDPA) in May 2019, Tilleke & Gibbins’ dedicated data protection team in Bangkok has been committed to monitoring, participating in, and providing updates on the development of the new law and supporting legislation.

Following the first public hearing on subordinate regulations, held by the Office of the Personal Data Protection Committee (PDPC) in February 2021, the firm’s data protection team produced a video series called “Compliance Catalysts – PDPA Subordinate Regulations,” in order to provide easily accessible, bite-sized information on the key elements of the PDPA, the practical impact of the proposed regulations, and the requirements for business operators.

The series is available in both English and Thai, and you can watch every episode below.

 

Ep. 1: Criteria and Procedures for Requesting Consent from Data Subjects

During this episode, Athistha (Nop) Chitranukroh and Nopparat Lalitkomon provide an overview of consent requirements under the PDPA, discuss binding and non-binding consent forms, and look at the PDPC’s “negative list,” which exhibits unacceptable or invalid methods for requesting consent (e.g., broad or catch all consent requests).

The English video is provided below. The Thai version can be accessed at this link.

 

Ep. 2: The Notification of the Purposes and Details of Personal Data Processing

In this episode, Nopparat Lalitkomon is joined by Auradee Wongsaroj to discuss notification requirements for data controllers. The video is divided into three sections:

  • Detailed information that data subjects need to be notified of prior to processing their data;
  • Change of purposes for data collection after a subject has already been notified; and
  • Notification requirement exemptions.

The English video is provided below. The Thai version can be accessed at this link.

 

Ep. 3: Appropriate Protective Measures for Personal Data Processing – Section 26

During this episode, Gvavalin Mahakunkitchareon and Nopparat Lalitkomon dive into the draft general regulations applicable to sensitive personal data (e.g., data related to biometrics, health, race, religion, etc.), as well as specific measures required for conducting criminal background checks or processing other data related to criminal records.

The English video is provided below. The Thai version can be accessed at this link.

 

Ep. 4: Criteria and Policies on Personal Data Sent or Transferred Overseas

In this episode, Athistha (Nop) Chitranukroh and Nopparat Lalitkomon provide an overview of the requirements for cross-border data transfers under the PDPA, including discussions on the definition of “sending” and “transferring” personal data under the law, the extraterritorial impact of the PDPA, and binding corporate rules (BCRs).

The English video is provided below. The Thai version can be accessed at this link.

Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

March 1, 2023
Thammapas Chanpanich, an associate at the firm’s corporate and commercial group in Bangkok, was recently featured on the The JSIG Privacy Deep-Dive podcast, which explores the latest trends and developments in data privacy law through interviews with leading experts and practitioners in the field. In the episode, Thammapas joined host Larisa Munteanu for a wide-ranging discussion on data privacy. Thammapas, a Certified Information Privacy Professional (CIPP/E), shared her experience in achieving the certification and her recent attendance at the AIJA – International Association of Young Lawyers Awards in Singapore. She also discussed with the host the progress of data privacy laws in Thailand, and the international influence of the European Union’s General Data Protection Regulation (GDPR). Thammapas offered insights into the challenges and opportunities presented by data privacy regulations, and how companies can best navigate the complex regulatory landscape. Thammapas is a member of Tilleke & Gibbins’ technology group, and she regularly advises clients on data protection and privacy issues. The full podcast is available below.
Read More
December 10, 2021
Suebsiri Taweepon, a partner in Tilleke & Gibbins’ intellectual property group, and Nopparat Lalitkomon, a senior associate in the firm’s corporate and commercial group, were recently invited to be guest contributors for True Digital Park’s (TDPK) Thailand GameChanger—a weekly podcast that explores the startup ecosystem in Thailand and across Southeast Asia. During the session, Suebsiri and Nopparat shed light on a number of common legal pitfalls for Thai startups, including discussions on: the importance of getting internal and external legal documents right from the start; non-disclosure agreements and whether or not they’re enforceable; what needs to change for more startups to incorporate in Thailand; and regulations around cryptocurrencies, non-fungible tokens, and asset fractionalization. A recording of the video podcast is available below.  
Read More
September 1, 2021
On August 31, Tilleke & Gibbins lawyers from across the region teamed up with the Australian Chambers of Commerce in Cambodia, Laos, and Myanmar to offer a session on the legal environment for e-commerce in each jurisdiction. The speakers included Aye Thuzar Hlaing, associate in Tilleke & Gibbins’ Myanmar office; Chandavya Ing, associate in the firm’s Phnom Penh office; Dino Santaniello, head of Tilleke & Gibbins in Laos; Jay Cohen, partner and director of the Phnom Penh office; and Yuwadee Thean-ngarm, director of the firm’s Myanmar office. Together they provided an overview of the regulatory framework for e-commerce businesses, discussed licensing requirements that may be applicable in each jurisdiction, explained disclosure requirements, addressed the principles of online contracts, and covered sanctions for unlawful activity in each country. A full video recording of the webinar can be viewed below.
Read More
March 31, 2021
On March 30, Dino Santaniello, head of Tilleke & Gibbins’ Laos office; Jay Cohen, partner and director of the firm’s Cambodia office; Ross Taylor, counsel in the firm’s Myanmar office; and Sochanmalisphoung Vannavuth, an associate in the Cambodia office, delivered a webinar explaining data compliance obligations in their respective countries. The webinar, which was organized in conjunction with the Australian Chambers of Commerce in Cambodia, Laos, and Myanmar, aimed to give business operators in these jurisdictions a clear understanding of their compliance duties relating to personal data. In this webinar, each speaker addressed the following topics: Regulations and legal provisions that affect the handling of personal data in Cambodia, Laos, and Myanmar; Definitions of personal data and identification of relevant parties; Legal requirements for and limitations on the collection and processing of personal data; Duties imposed upon data controllers; and Penalties for breaching local data protection laws. Full video recordings of each section of the webinar are available (by country) below. Cambodia   Laos   Myanmar
Read More