You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

August 22, 2023

Thailand Details Partial Exemption of Data Controllers’ Duties

Subscribe to Updates

On August 17, 2023, the Thai government rolled out a royal decree that provides certain exemptions to data controllers’ obligations under the Personal Data Protection Act B.E. 2562 (PDPA). The royal decree, which will come into effect after the lapse of 150 days from its publication in the Government Gazette, reflects the government’s ongoing quest to strike a balance between privacy, state interests, and the data protection regulatory burden on organizations.

The royal decree seeks to clarify the circumstances in which data controllers—including business operators and state agencies—are exempt from certain PDPA requirements on the collection, use, and disclosure of personal data and data subject rights. In doing so, it establishes three foundational pillars in considering exemptions:

  • Collection or requests for personal data are to be for the public interest pursuant to the purpose and scope prescribed by any law authorizing a state agency to carry out a certain action, without imposing an undue burden on the data controller responsible for disclosing the personal information.
  • Data controllers can share personal data without the data subject’s consent if legally authorized state agencies request it and specify the statutory provisions granting authority to request the data.
  • Data subjects and data controllers of requested personal data must have the right to submit complaints to the PDPA’s Expert Committee or seek its expertise for clarification or determination.

Under the three foundational pillars, data controllers will be partially exempted from certain requirements under the PDPA when the following state agencies request personal data:

  • The National Anti-Corruption Commission or other government entities with mandates aligned with anticorruption laws;
  • The Revenue Department, Customs Department, Excise Department, or other governmental units operating under taxation laws;
  • Local governmental bodies recognized by the Personal Data Protection Committee (PDPC), or any government unit with mandates as per the laws related to land and building taxation;
  • The Secretariat of the Cabinet, executing responsibilities as defined by the laws concerning the royal prerogatives of the monarch; and
  • State agencies acting in line with laws concerning significant public interests.

The exemption further extends to the collection, use, and disclosure of personal data by data controllers for international legal matters, covering deportation, extradition, and combating transnational organized crime.

Even with certain provisions exempted, the core duties of data controllers in ensuring data security and accuracy of personal data remain. Data controllers are still obligated to implement security standards meeting the criteria to be set forth by the PDPC within 120 days of publication of the royal decree in the Government Gazette. In certain circumstances, data controllers must also promptly act on a state agency’s instruction to correct and update data subjects’ personal data.

For more details on any aspect of compliance with Thailand’s data protection laws and regulations, please contact Tilleke & Gibbins data privacy specialists Nopparat Lalitkomon at [email protected] or Gvavalin Mahakunkitchareon at [email protected].

Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

January 2, 2024
Myanmar’s Ministry of Commerce (MOC) has released updated information regarding the registration fees for online retail businesses. The fees and criteria, which are included in the MOC’s Export/Import Newsletter No. 17/2023 dated December 28, 2023, are laid out below. Registration Fees The official registration fees vary depending on the applicant type: Companies or other commercial organizations: MMK 70,000 (approx. USD 33.5) for registration and renewal; MMK 3,000 (approx. USD 1.5) for each amendment. Small and medium enterprises (SMEs): MMK 50,000 (approx. USD 24) for registration and renewal; MMK 3,000 (approx. USD 1.5) for each amendment. Individual applicants: 30,000 MMK (approx. USD 14.5) for registration and renewal; MMK 3,000 (approx. USD 1.5) for each amendment. Validity Period Registrations approved from January 1, 2024, will be valid for two years from the date of grant. The requirement for online retail businesses to register their operations was announced in July 2023. Based on statements from the MOC, online retail businesses need to complete their registration by late January 2024 to avoid potential enforcement actions. Regarding SMEs, the MOC will also evaluate their SME registration certificate issued by the Agency Office under the Small and Medium Enterprises Development Law 2015. For assistance completing the registration process, or for more details on any aspect of online retail operations in Myanmar, contact Tilleke & Gibbins at [email protected].
Read More
December 15, 2023
As part of its membership in Lex Mundi, Tilleke & Gibbins has published an updated edition of its Guide to Doing Business in Thailand for 2023. This guide outlines the key factors for starting and operating a business in the Thai market. Issues covered include: Investment incentives Financial facilities Exchange controls Import and export regulations Structures for doing business Requirements for the Establishment of a Business Operation of the Business Cessation or Termination of the Business Labor legislation, relations, and supply Tax Immigration requirements This publication is part of Lex Mundi’s Country Guides series prepared by member firms in more than 100 jurisdictions worldwide. The guides serve as a useful resource for planning international business strategy and researching new markets. The full Guide to Doing Business in Thailand is available through the button below.
Read More
December 15, 2023
Vietnam’s new Law on Electronic Transactions No. 20/2023/QH15 (LOET 2023) was promulgated by the National Assembly on June 22, 2023, and will replace the existing Law on Electronic Transactions No. 51/2005/QH11 (LOET 2005) when it enters into effect on July 1, 2024. The LOET 2023 is aimed at facilitating transactions carried out in an electronic environment in all sectors. Derived from the fundamental principles of the LOET 2005, the LOET 2023 is similarly considered a framework law, developed based on the Model Law on E-Commerce of the United Nations Commission on International Trade Law (UNCITRAL). The main points of interest of the LOET 2023 are summarized below. 1. Scope of Application Unlike the LOET 2005, which explicitly excludes certain areas such as the issuance of certificates of land use rights and birth certificates from the scope of application, the LOET 2023 covers all areas without exception. However, the LOET 2023 will still not interfere with the regulations of substantive laws that stipulate the content, conditions, and forms of transactions in their respective areas (Article 1.2). The LOET 2023 also provides that it will only be applicable if other laws either allow or remain silent on the electronic execution of transactions; otherwise, if another law specifically does not permit a transaction to be carried out electronically, such law shall apply (Article 1.3). This emphasizes that the applicability of the LOET 2023 depends on the electronic readiness of specific sectors. 2. Enabling E-Transactions in All Sectors For traditional transactions or contracts to be legally valid, they typically require written documentation, the signatures of the involved parties, and the seals of organizations or companies, if required by substantive laws or common practice. Additionally, certain sectors mandate further steps like notarization or certification, such as in property transactions like house sales or inheritance
Read More
December 8, 2023
In a significant development on December 5, 2023, the Central Bank of Myanmar (CBM) issued Letter No. FE-1/2937 granting authorized dealer licensed banks (ADLBs) the authority to freely transact in foreign currency trades, buying and selling at the market exchange rate for Myanmar kyat (MMK) as proposed by buyers and sellers through online trading platforms. Offshore remittances, however, must comply with the remittance criteria set by the Foreign Exchange Supervisory Committee. The online trading platform Refinitiv, initiated in June 2022 under the CBM’s guidance, facilitates the buying and selling of foreign currency between ADLBs and between banks and customers. The initiative was implemented in accordance with CBM Letter No. FE-1/789, dated June 21, 2023. The platform’s inception saw the exchange rate set at over MMK 2,900 per USD 1. Then, in August 2023, the CBM ordered banks and traders to limit foreign exchange transactions to an approved online trading platform, again with the exchange rate fixed at MMK 2,900 per USD 1. Transactions outside of online trading platforms continue to be governed by the exchange rate set by the CBM of 2,100 MMK per USD 1. Conversion Rules for Exporters On December 6, 2023, the CBM issued Notification No. 26/2023 lowering the percentage of Myanmar companies’ export earnings in foreign currency subject to mandatory conversion into MMK from 50% to 35% at the current official exchange rate set by the CBM at USD 1 to MMK 2,100. This mandatory conversion must follow the requirements for mandatory conversion of foreign currency, which remain in effect. For more details on foreign exchange developments, or on any aspect of financial regulations in Myanmar, please contact Tilleke & Gibbins at [email protected].
Read More