You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

January 24, 2024

IAPP Global Legislative Predictions 2024 – Thailand

Subscribe to Updates
International Association of Privacy Professionals

Thailand’s Personal Data Protection Act came into full effect on 1 June 2022 and various subordinate regulations have since been issued by the Personal Data Protection Committee. These include regulations on security measures to be implemented by data controllers, data breach notification requirements, a mandatory obligation to appoint a data protection officer when the processing activity requires regular monitoring of personal data or a system due to the large scale of personal data, administrative measures and data processors’ record of processing activities.

As some areas under the PDPA still require further clarifications, a series of public consultations for the remaining draft subordinate regulations is anticipated in 2024. Potential areas include data protection impact assessments and cross-border transfers of personal data, which are crucial for organizations and particularly for entities with establishments in other jurisdictions.

PDPA enforcement by Thai regulators was silent until the last quarter of 2023, when the PDPC published details about complaints that have been lodged to the Expert Committee. The committee is designated by virtue of the PDPA and has the power to make determinations related to imposing administrative fines and other penalties. Enforcement in 2024 is expected to become more active and potentially more serious, which means organizations should pay closer attention to ensure compliance with the PDPA.

Similar to the GDPR, the PDPA also has extraterritorial effect. Once the subordinate regulation on international cooperation has been issued by the PDPC, this should clarify how PDPA enforcement against organizations located outside of Thailand will be conducted by Thai regulators.

With respect to sector-specific data protection legislation, in September 2023, Thailand’s National Broadcasting and Telecommunications Commission issued the Notification of the NBTC Re: Measures to Protect Telecommunications Service Users’ Rights in regard to Personal Data, Privacy Rights, and Freedom of Telecommunications, which replaces the previous notification. The notification aims to enhance the protection of personal data and privacy rights for telecommunication users and to align its data protection requirements with the provisions of the PDPA. The development of specific data protection laws for other sectors is still silent.

 

Athistha (Nop) Chitranukroh and Gvavalin Mahakunkitchareon provided this update as part of the “IAPP Global Legislative Predictions 2024” from the International Association of Privacy Professionals. Tilleke & Gibbins also provided the Vietnam update.

Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

September 26, 2023
On September 14, 2023, Thailand’s Personal Data Protection Committee (PDPC) published a notification on the requirements for the appointment of a data protection officer (DPO) in the Government Gazette, taking effect on December 13, 2023. The notification on appointing a DPO lays out the criteria for what constitutes processing of personal data requiring “regular monitoring of the personal data or the system” by reason of “having large-scale personal data,” which requires data controllers and data processors to appoint a DPO under the Personal Data Protection Act B.E. 2562 (PDPA). Criteria After a hearing on the draft DPO appointment notification in July, the published version has been slightly amended while the main criteria for appointment of a DPO are still the same. These have been finalized as follows: When determining whether processing of personal data requires regular monitoring due to having large-scale personal data, only the “core activity” of the data controller or data processor is to be taken into consideration. The term “core activity” denotes an essential and integral activity directly related to the primary operations of the data controller or data processor and does not include any supplementary business activities (e.g., human resources and information technology activities). “Processing activities that require regular monitoring of personal data” refers to activities relating to tracking, monitoring, analyzing, or predicting the behavior, attitude, or profile of individuals, and generally involves the processing of personal data in a systemic manner on a usual or regular basis. Examples include membership card programs, credit scoring, insurance premium consideration, fraud prevention, processing of personal data by computer network system service providers or telecommunications operators, behavioral advertising, and so on. To determine whether processing activities constitute “large-scale processing of personal data,” various factors are considered: Volume, type, or nature of personal data processed; Duration or permanence of
Read More
September 21, 2023
Myanmar’s Ministry of Commerce has announced its E-commerce Guidelines to regulate stakeholders engaging in e-commerce. The guidelines—which were issued on September 5, 2023, and took immediate effect—are mandatory for e-commerce business operators (both entities and individuals), and failure to comply with the guidelines’ requirements may result in penalties under relevant laws. The E-commerce Guidelines come as Myanmar seeks to increase its regulation of e-commerce activities. The guidelines were preceded by a July 2023 notification requiring e-commerce business operators to register their activities with the Ministry of Commerce by January 21, 2024. Definitions “E-commerce” is defined as the sale of goods or services on the internet or other digital platforms. The term also covers sales promotions, marketing, logistics, ordering, and delivery. An “e-commerce platform entrepreneur” is a person who manages an e-commerce platform where two or more entrepreneurs can conduct e-commerce. An “e-commerce business operator” is a person operating or authorized to operate e-commerce activities. This includes e-commerce platform entrepreneurs, entrepreneurs selling on e-commerce platforms, and sellers through social media platforms. Electronic Contracts Acceptable forms of electronic contracts, which must comply with the Electronic Transactions Law, Contract Act, and other relevant laws, include: Click-wrap, click-through, and web-wrap contracts; Browse-wrap contracts; and Agreements between seller and buyer on social media platforms, such as by accepting or rejecting an offer via direct message. Samples of contract forms are appended to the guidelines. Consumer Protection Disclosure notices for consumers must be comprehensible, correct, consistent, simple, accessible, and visible. They can be written in Myanmar language, English, or Myanmar language and another language. They must also comply with the relevant provisions of the Consumer Protection Law. The guidelines provide that if the agreed delivery date is eclipsed by more than 15 days, the consumer may terminate the contract and request a full refund of
Read More
August 31, 2023
When your company suffers a data breach, taking prudent, careful action can limit and perhaps even rectify some of the damage. First of all, it is important to document everything, starting with the time the data breach was discovered. Secure the data systems and preserve all evidence so that investigators can determine what happened, and begin following the protocol that all companies handling personal data should have in place to guide their data breach response. It is also crucial to seek timely legal assistance to ensure that every aspect of the response is planned and carried out according to the law. While applicable legal advice for each situation can only be obtained by consulting a legal advisor, this guide gives an overview of what companies in Southeast Asian jurisdictions can expect if they suffer a data breach. This guide from Tilleke & Gibbins is a quick-reference resource covering key regulatory issues regarding data breach responses in Cambodia, Laos, Myanmar, Thailand, and Vietnam. The full guide can be downloaded through the button below.
Read More
August 23, 2023
Introduction The idea of the metaverse rose to prominence in the public discourse in 2021, most notably when Facebook renamed itself Meta and announced a new focus on launching a virtual, immersive world. The initial excitement around the metaverse has since faded, with worsening economic conditions having a particularly acute effect on companies in the technology sector. When Meta CEO Mark Zuckerberg announced in March 2023 that artificial intelligence (AI) was the company’s “single largest investment,” many took this as a sign of the company shifting focus away from the metaverse. However, there remains significant interest in the metaverse from both businesses and consumers. Zuckerberg himself reaffirmed Meta’s focus on the metaverse, highlighting how developments in AI will improve virtual reality (VR) and augmented reality (AR) technology. Meanwhile, Roblox, a metaverse gaming platform, announced that in Q1 2023, its number of daily active users had increased to 66 million. Most recently, the announcement by Apple of its new ‘Vision Pro’ AR headset is reported to have renewed interest in the metaverse among developers. A particular area of interest in the developing metaverse is digital fashion and retail. In its Metaverse Fashion Trends Report 2022, Roblox found that nearly three in four users aged 14 to 24 spend money on digital fashion items. Roblox itself has partnered with fashion brands Burberry, Gucci, Tommy Hilfiger, and others, to offer experiences and items for use on the platform. In March 2023, Decentraland, a metaverse platform with a decentralized governance structure, hosted the Metaverse Fashion Week, featuring brands such as Adidas, Coach, and DKNY. As businesses continue to invest and look for opportunities to expand into the metaverse, whether through traditional e-commerce or more innovative digital asset offerings, it is important that they consider the ways in which new and existing laws apply
Read More