You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

December 24, 2019

Thailand’s Personal Data Protection Act – Requirements for Employers

Subscribe to Updates
Taylor Vinters – International Employment Law Update

If an employer collects employees’ personal information, the employer must comply with the Personal Data Protection Act (PDPA).

Thailand’s PDPA, which was enacted earlier this year, contains significant new requirements for employers that collect employees’ (called “data subjects” in the PDPA) personal information. Most sections of the PDPA will become effective on May 27, 2020, so employers should be aware of their duties and liabilities.

Important PDPA requirements that relate to employers include the following:

  • Employees’ personal information can be collected only to the limited extent necessary for the employer’s lawful purpose.
  • Employers cannot collect employees’ personal information from any source apart from the employees themselves.
  • Employers must prevent employees’ personal information from being disclosed, lost, or altered.
  • Employers must delete employees’ personal information after a certain time period.
  • Employers must receive consent from employees to collect, use, or disclose the employees’ personal information.
  • Employers must inform a special government-run Personal Data Committee if an employees’ personal information is leaked.

Employers who violate the PDPA could face civil or criminal liability, as well as administrative fines, depending on the claim and breach.

Civil Liability

If an offender is found to be civilly liable (e.g. an employee sues the employer for damages arising from a breach of the PDPA), the court can order the offender to pay punitive damages capped at twice the actual damages.

Criminal Liability

The PDPA also contains criminal liability for certain offences. Penalties are set at a maximum of six months’ imprisonment, a fine of up to THB 1 million (approximately EUR 30,000), or both. If the offender is a corporate entity, and the offence is committed because of an order or act by a director, manager, or any associated persons responsible for the act, those individuals would face criminal liability and be subject to the above penalties. Moreover, a person who has a duty to order or perform any act but fails to carry out his or her duty, resulting in the company committing an offence, is also criminally liable and subject to the above penalties.

Administrative liability

Companies can also face administrative fines for violation of the PDPA, which range from THB 500,000 to THB 5 million (approximately EUR 15,000 to EUR 150,000).

Comment

If an employer collects, uses, or discloses employees’ personal information, then the employer should be aware of the PDPA’s requirements. Otherwise, the employer can face criminal, civil, or administrative penalties.

Related Professionals

Practices

Employment

Location

RELATED INSIGHTS​ 

February 22, 2021
Following the recent imposition of sanctions on Myanmar individuals and companies by the US, the UK and Canada have now imposed new sanctions. As with the US sanctions, these new measures impact UK and Canadian citizens and companies, and non-UK and non-Canadian companies and citizens with interests in those jurisdictions. The EU has indicated that it is planning to issue similar sanctions in the near future. New UK Sanctions In addition to the 16 individuals already sanctioned by the UK government, on February 18, 2021, the UK government announced that three individuals have been sanctioned for serious human rights violations and are now subject to asset freezes and travel bans. The full list of Myanmar individuals and companies sanctioned by the UK is available on the website of the Office of Financial Sanctions Implementation. Breaches of UK financial sanctions are criminal offences punishable in the UK by up to 7 years imprisonment and heavy fines. New Canadian Sanctions Also on February 18, timed to coincide with the UK sanctions, new Canadian sanctions were imposed on nine individuals. As with the UK, Canada already had a number of individuals in the Myanmar military on its sanctions list, and the new additions bring the total number of individuals sanctioned by Canada to 54. All assets of these individuals in Canada are now frozen, and they are banned from travelling to Canada. Canadian businesses or entities may not do business with any of the 54 individuals. Full details of the impact of the sanctions are available on the Government of Canada’s website, as is a database of the Myanmar individuals and companies subject to them. Breach of Canadian sanctions carries with it up to 5 years’ imprisonment in Canada and/or a large fine. Other Countries The EU is reportedly drawing up sanctions
Read More
January 26, 2021
On January 1, 2021, the government of Vietnam issued Decree No. 152/2020/ND-CP dated December 30, 2020, providing guidance concerning foreigners working in Vietnam (Decree 152). Foreign investors and expatriates should be aware of some notable new points.
Read More
January 12, 2021
Due to the resurgence of the COVID-19 pandemic in Thailand since December, 2020, Thailand’s Ministry of Labor recently published two regulations under the Social Security Act (SSA) in the Government Gazette: The Regulation on Entitlement to Compensatory Benefits in the Event of Unemployment Due to Force Majeure from the Pandemic of Dangerous Communicable Disease Under Relevant Law Relating to Communicable Diseases B.E. 2563 (2020) (the Force Majeure Regulation); and The Regulation on Determination of the Amount of Contributions to the Social Security Funds B.E. 2563 (2020) (the SSF Contribution Regulation). Details of the two regulations are provided below. The Force Majeure Regulation This regulation is similar to a previous regulation from April, 2020, during the first wave of the pandemic, stating that the definition of force majeure under the Social Security Act B.E. 2533 (1990) (the SSA) includes hazards from pandemics of dangerous communicable diseases (including COVID-19). This definition therefore affords protection to insured persons (i.e., employees) in the event that the COVID-19 pandemic results in their being unable to work, or their employers being unable to operate their business normally. This regulation allows the Social Security Office (SSO) to pay compensation to employees who: are insured persons who qualify to receive compensatory benefit in case of unemployment in accordance with the SSA; have to cease working temporarily during the period from December 19, 2020 onwards; and do not receive wages from their employer during the temporary cessation. This applies only if the circumstances above result from the following force majeure events related to hazards from COVID-19 (or other pandemics of dangerous communicable diseases that affect the public under the Communicable Diseases Act B.E. 2558 (2015)): The employee cannot work, or the employer does not allow the employee to work, because of quarantine or to comply with a COVID-19
Read More
November 3, 2020
Many Thai and international companies have expanded rapidly into Myanmar in recent years, in what had seemed to be an unstoppable expansion of cross-border trade resulting from the country’s emergence back onto the global stage. For those companies, the COVID-19 situation in Myanmar has been a cause for much concern and uncertainty—doubly so for those who had hired staff in the jurisdiction, as a lack of clarity regarding their obligations as employers was compounded by a lack of information on the situation on the ground.
Read More