You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

January 24, 2024

IAPP Global Legislative Predictions 2024 – Thailand

Subscribe to Updates
International Association of Privacy Professionals

Thailand’s Personal Data Protection Act came into full effect on 1 June 2022 and various subordinate regulations have since been issued by the Personal Data Protection Committee. These include regulations on security measures to be implemented by data controllers, data breach notification requirements, a mandatory obligation to appoint a data protection officer when the processing activity requires regular monitoring of personal data or a system due to the large scale of personal data, administrative measures and data processors’ record of processing activities.

As some areas under the PDPA still require further clarifications, a series of public consultations for the remaining draft subordinate regulations is anticipated in 2024. Potential areas include data protection impact assessments and cross-border transfers of personal data, which are crucial for organizations and particularly for entities with establishments in other jurisdictions.

PDPA enforcement by Thai regulators was silent until the last quarter of 2023, when the PDPC published details about complaints that have been lodged to the Expert Committee. The committee is designated by virtue of the PDPA and has the power to make determinations related to imposing administrative fines and other penalties. Enforcement in 2024 is expected to become more active and potentially more serious, which means organizations should pay closer attention to ensure compliance with the PDPA.

Similar to the GDPR, the PDPA also has extraterritorial effect. Once the subordinate regulation on international cooperation has been issued by the PDPC, this should clarify how PDPA enforcement against organizations located outside of Thailand will be conducted by Thai regulators.

With respect to sector-specific data protection legislation, in September 2023, Thailand’s National Broadcasting and Telecommunications Commission issued the Notification of the NBTC Re: Measures to Protect Telecommunications Service Users’ Rights in regard to Personal Data, Privacy Rights, and Freedom of Telecommunications, which replaces the previous notification. The notification aims to enhance the protection of personal data and privacy rights for telecommunication users and to align its data protection requirements with the provisions of the PDPA. The development of specific data protection laws for other sectors is still silent.

 

Athistha (Nop) Chitranukroh and Gvavalin Mahakunkitchareon provided this update as part of the “IAPP Global Legislative Predictions 2024” from the International Association of Privacy Professionals. Tilleke & Gibbins also provided the Vietnam update.

Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

July 19, 2024
Tilleke & Gibbins has contributed the Cambodia, Myanmar, Thailand, and Vietnam chapters to How the Use of Artificial Intelligence Is Regulated in Southeast Asia, a comparative resource published by Drew Network Asia (DNA). The guide provides an accessible introduction to artificial intelligence (AI) and examines how ASEAN member states are approaching governance, regulation, and responsible deployment of AI technologies. The publication begins by outlining core AI concepts and summarizing the ASEAN Guide on AI Governance and Ethics, which reflects the region’s collective approach to promoting innovation while addressing risks. It then presents a comparative overview of nine ASEAN jurisdictions, highlighting emerging national strategies, regulatory developments, and institutional frameworks. Each country chapter responds to a consistent set of ten practical questions. These cover whether a national AI strategy has been issued; the extent to which dedicated AI laws or sectoral regulations apply; the existence of relevant judicial decisions; available guidelines and government support schemes; regulators responsible for AI oversight; approaches to liability, copyright, and data protection; and key considerations for organizations deploying AI technologies. By consolidating developments across the region, the guide serves as a useful reference for businesses exploring AI-related opportunities or compliance obligations in Southeast Asia. As regulatory approaches continue to evolve, readers seeking jurisdiction-specific advice are encouraged to contact the practitioners listed in each chapter. The full guide is available for download using the button below or directly from the DNA website.
Read More
July 10, 2024
The need for privacy and security has grown in tandem with the rapid proliferation of internet-enabled technologies. This is a major concern for consumers and individuals, and governments are increasingly mindful of online threats to their national security and their citizens. All of this represents an imposing challenge for companies—especially now that technology has enabled them to operate with relative ease across jurisdictions throughout the world.
Read More
July 5, 2024
The landscape of intellectual property (IP) has transformed alongside advancements in technology, transitioning from traditional methods to modern online approaches. A growing number of IP infringers are moving their illegal activities to the online sphere, particularly through the sale of counterfeit goods on their websites, social media, or e-commerce platforms. In response to these shifting pressures, Thailand implemented the Computer-Related Crime Act B.E. 2550 (CCA) on July 18, 2007, and amended it in 2017, aiming to enhance the effectiveness of combating online infringement by empowering government officials to request that the court block computer data (called “website-blocking”) that infringes upon other parties’ intellectual property rights, as per section 20(3) of the CCA. From 2018 to May 2024, Thailand’s Criminal Court and Central Intellectual Property and International Trade Court have issued 53 orders to block more than 1,779 infringing URLs. One significant recent development is the Criminal Court’s establishment of the Technology Crime Division, which has been operating since April 1, 2024. Its purpose is to address criminal offenses that occur through electronic means, which should then be handled in an effective and prompt manner by judges who have expertise on technological crimes. In addition, several current measures to combat technology crime, including section 20(3) of the CCA, require court orders for the prevention of electronic criminal offenses or online infringement. The Technology Crime Division has the jurisdiction to consider and grant these orders, which will help expedite the approval process and ensure review by specialized judges. Scope of the Technology Crime Division The announcement of the establishment of the Technology Crime Division within the Criminal Court was published in the Government Gazette on March 18, 2024, with operations commencing on April 1, 2024. The Technology Crime Division is empowered to: Consider and adjudicate technology crime cases, except cases falling
Read More
July 4, 2024
The rapid development and deployment of artificial intelligence in various industries is increasingly attracting the attention of regulators, who aim to encourage the progression of AI technologies while ensuring their responsible use. Recent regulatory developments around the world, including in the European Union and Southeast Asia, serve as evidence of this emerging trend. Here we shall discuss the effect of AI regulatory approaches in the  EU on Southeast Asian countries. Approach and Action The EU Artificial Intelligence Act has been officially adopted by EU colegislators and will enter into force 20 days after its publication in the EU Official Journal.[1] Most of its provisions will apply two years after its entry into force. The act establishes a harmonized EU legal framework, aiming at ensuring that AI systems placed on and utilized in the EU market are safe, have managed risks, and are aligned with EU fundamental rights and values. Countries in Southeast Asia, predominantly governed by civil law systems, often adopt statutory frameworks similar to those in the EU when addressing new legal matters. In the rapidly developing field of AI, Southeast Asian countries are adopting a wait-andsee approach toward global regulatory trends. This cautious stance allows them to observe and analyze international developments in AI regulation before crafting their own frameworks. Compared to the EU, countries in Southeast Asia are generally more focused on using AI for national development. Common themes include building human resource capability, developing ecosystems and building infrastructure. Some countries emphasize governance and ethics more than others. Over the past five years, governments across Southeast Asia have been focusing on promoting AI by implementing national policies to strengthen AI promotion and governance. While there may be less regional integration in the approach to AI of countries in Southeast Asia, there are some efforts to create
Read More