You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

January 24, 2024

IAPP Global Legislative Predictions 2024 – Thailand

Subscribe to Updates
International Association of Privacy Professionals

Thailand’s Personal Data Protection Act came into full effect on 1 June 2022 and various subordinate regulations have since been issued by the Personal Data Protection Committee. These include regulations on security measures to be implemented by data controllers, data breach notification requirements, a mandatory obligation to appoint a data protection officer when the processing activity requires regular monitoring of personal data or a system due to the large scale of personal data, administrative measures and data processors’ record of processing activities.

As some areas under the PDPA still require further clarifications, a series of public consultations for the remaining draft subordinate regulations is anticipated in 2024. Potential areas include data protection impact assessments and cross-border transfers of personal data, which are crucial for organizations and particularly for entities with establishments in other jurisdictions.

PDPA enforcement by Thai regulators was silent until the last quarter of 2023, when the PDPC published details about complaints that have been lodged to the Expert Committee. The committee is designated by virtue of the PDPA and has the power to make determinations related to imposing administrative fines and other penalties. Enforcement in 2024 is expected to become more active and potentially more serious, which means organizations should pay closer attention to ensure compliance with the PDPA.

Similar to the GDPR, the PDPA also has extraterritorial effect. Once the subordinate regulation on international cooperation has been issued by the PDPC, this should clarify how PDPA enforcement against organizations located outside of Thailand will be conducted by Thai regulators.

With respect to sector-specific data protection legislation, in September 2023, Thailand’s National Broadcasting and Telecommunications Commission issued the Notification of the NBTC Re: Measures to Protect Telecommunications Service Users’ Rights in regard to Personal Data, Privacy Rights, and Freedom of Telecommunications, which replaces the previous notification. The notification aims to enhance the protection of personal data and privacy rights for telecommunication users and to align its data protection requirements with the provisions of the PDPA. The development of specific data protection laws for other sectors is still silent.

 

Athistha (Nop) Chitranukroh and Gvavalin Mahakunkitchareon provided this update as part of the “IAPP Global Legislative Predictions 2024” from the International Association of Privacy Professionals. Tilleke & Gibbins also provided the Vietnam update.

Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

July 10, 2023
One of the more positive outcomes of the COVID-19 pandemic is that telemedicine has become remarkably important as an interactive system between patients and healthcare professionals. Thailand, which ranks near the top as a world medical hub, is a highly favored destination in Asia for expat workers. Currently, the Thai market has both Thai-based and foreign-based platforms with information about healthcare providers and telemedicine readily available. “Doctor Locator,” “Weed Map,” and “Find a Teeth Aligner Dentist” are examples of online platforms connecting patients with medical and telemedicine services. These digital platforms provide information about the location of specialized clinics, cannabis dispensaries, pharmacy stores, and orthodontic practitioners in Thailand. These platforms act as intermediaries between medical care businesses and consumers. As actual medical services are not offered or provided, these digital platforms do not have to be regulated under the Medical Facility Act of Thailand. However, healthcare digital platform services that act as an intermediary or conduit managing information used to connect medical clinics or cannabis dispensaries with patients or customers via a computer network are now regulated under the soon-to-be-implemented Royal Decree on Digital Platforms, regardless of whether payment is actually made via the platform. The regulatory authority for this is the Electronic Transactions Development Agency (ETDA). Under this royal decree, digital platform providers that intend to operate a digital platform service must notify the ETDA prior to initiating operations. The extent of the details to be included in the notification to the ETDA will be more comprehensive if the digital platform: has annual revenue (before expenses) for digital platform services within Thailand exceeding THB 1.8 million (approx. USD 51,200) for an individual operator or THB 50 million (approx. USD 1.42 million) for a corporate or entity operator; or has more than 5,000 users (on average) per month. Apart
Read More
June 26, 2023
Vietnam’s Ministry of Information and Communications (MIC) organized a workshop with industry representatives on June 19, 2023, to discuss its future policy direction for over-the-top (OTT) telecom services and internet data center (IDC) and cloud computing services. OTT telecom services, in the MIC’s interpretation, are communication services such as text messages or voice calls provided over the internet—for example, the services of Zalo, WhatsApp, WeChat, etc. The workshop, the first in an expected series, focused only on the discussion of policy on how to regulate these services. Light-Touch Management Approach A very positive signal of the MIC in the workshop was its clear intention to apply a “light-touch” approach to management. For cross-border provision of OTT telecom services and IDC/cloud computing services, the MIC intends to require notification and a post-check mechanism, instead of a heavy licensing or commercial arrangement regime like the one applicable to traditional telecom services. In addition, there is no limitation on foreign investment if foreigners would like to provide these services in Vietnam. With regard to domestic service providers, the MIC proposes a registration regime with a similar post-check mechanism. The MIC’s reason for registration instead of notification is because the provision of these services by domestic companies may involve setting up data center/cloud systems which require consideration of various issues including location, electricity sources, and connection with telecom infrastructure such as marine cable. However, the MIC is also hoping to make the registration process as light as possible for enterprises (for example, using online registration) to provide a favorable environment and conditions to facilitate development of the industry without obstacles or cumbersome administrative procedures for companies’ operations. For providers of these services, the MIC is also considering an exemption from the responsibility to pay fees for telecommunications activities rights, and from payment to
Read More
June 8, 2023
At a conference organized by Vietnam’s Ministry of Public Security (MPS) on June 7, 2023, government officials provided more guidance on the recently issued Personal Data Protection Decree (PDPD), which is set to take effect on July 1, 2023. Key takeaways included the following: A national portal on personal data protection for online submission of notifications and registrations will be launched before July 1, 2023. The MPS also plans to issue templates for data processing impact assessments (DPIAs) and transfer impact assessments (TIAs) in the near future. The PDPD requires data controllers, data processors, and data controller-processors to prepare a DPIA at the start of personal data processing. The MPS clarified that the DPIA is expected to be prepared and submitted once. Only changes to its content would require submission of an updated DPIA. Both DPIAs and TIAs (which are for cross-border data transfers) must be prepared in Vietnamese. Since the sale and purchase of personal data is strictly prohibited unless explicitly permitted by law, the MPS has handled approximately 14 cases involving unlawful trading of personal data, including sensitive data. Under the PDPD, sensitive data has a broader definition than under the GDPR (the European Union’s General Data Protection Regulation), and also includes location data, creditworthiness, and personal financial data. Consent is not a legal basis for the trading of personal data, including sensitive data. The 72-hour timeline for responding to a data subject’s request does not mean 72 working or business hours. Rather, it means 72 actual consecutive hours. Any organization transferring the personal data of Vietnamese citizens outside of Vietnam must comply with the PDPD, regardless of the organization’s location. For organizations incorporated overseas that must comply with the PDPD, there is no requirement to appoint a local representative (unlike the GDPR)—but appointment of a data
Read More
June 2, 2023
In Southeast Asia, artificial intelligence (AI) products and services are being leveraged across industries such as finance, healthcare, retail, agriculture, and manufacturing. Governments across the region are recognizing the benefits of harnessing AI and the positive impact of AI technology on economic development. As the rise in AI deployment creates opportunities for economic growth in Southeast Asia, regulatory and digital governance efforts should focus on ethical, inclusivity, and cybersecurity concerns to help ensure that the widespread use of AI technology in the region is sustainable. Two jurisdictions in the region that have already made significant strides in developing initiatives surrounding AI are Singapore and Thailand. Singapore Due to its more advanced technological infrastructure, Singapore was one of the first countries in the region to address AI-related issues. Singapore has been aligning its data protection policies and regulations with the changing digital landscape since 2012—the year Singapore passed its Personal Data Protection Act. In 2019, Singapore unveiled its National AI Strategy to increase the use of AI technologies and deploy “scalable, impactful AI solutions in key verticals by 2030.” The goal is to align talent, regulation, and business growth to ensure AI applications serve society. Singapore’s approach is to facilitate innovation while safeguarding consumer interests, as it strives to become one of the regional leaders in the field of AI. In terms of Singapore’s regulatory landscape, Singapore’s Personal Data Protection Commission (PDPC) oversees data and AI, including AI developers and AI-using companies, which consist of backroom operations, front-end usage companies, and distributors of equipment with AI features. The Singapore Academy of Law (SAL) oversees all laws applicable to AI systems and decides on issues that impact the AI industry. Singapore has joined various bilateral and regional trade arrangements to facilitate research, development, and collaboration in support of its growing digital
Read More