You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

December 24, 2019

Thailand’s Personal Data Protection Act – Requirements for Employers

Subscribe to Updates
Taylor Vinters – International Employment Law Update

If an employer collects employees’ personal information, the employer must comply with the Personal Data Protection Act (PDPA).

Thailand’s PDPA, which was enacted earlier this year, contains significant new requirements for employers that collect employees’ (called “data subjects” in the PDPA) personal information. Most sections of the PDPA will become effective on May 27, 2020, so employers should be aware of their duties and liabilities.

Important PDPA requirements that relate to employers include the following:

  • Employees’ personal information can be collected only to the limited extent necessary for the employer’s lawful purpose.
  • Employers cannot collect employees’ personal information from any source apart from the employees themselves.
  • Employers must prevent employees’ personal information from being disclosed, lost, or altered.
  • Employers must delete employees’ personal information after a certain time period.
  • Employers must receive consent from employees to collect, use, or disclose the employees’ personal information.
  • Employers must inform a special government-run Personal Data Committee if an employees’ personal information is leaked.

Employers who violate the PDPA could face civil or criminal liability, as well as administrative fines, depending on the claim and breach.

Civil Liability

If an offender is found to be civilly liable (e.g. an employee sues the employer for damages arising from a breach of the PDPA), the court can order the offender to pay punitive damages capped at twice the actual damages.

Criminal Liability

The PDPA also contains criminal liability for certain offences. Penalties are set at a maximum of six months’ imprisonment, a fine of up to THB 1 million (approximately EUR 30,000), or both. If the offender is a corporate entity, and the offence is committed because of an order or act by a director, manager, or any associated persons responsible for the act, those individuals would face criminal liability and be subject to the above penalties. Moreover, a person who has a duty to order or perform any act but fails to carry out his or her duty, resulting in the company committing an offence, is also criminally liable and subject to the above penalties.

Administrative liability

Companies can also face administrative fines for violation of the PDPA, which range from THB 500,000 to THB 5 million (approximately EUR 15,000 to EUR 150,000).

Comment

If an employer collects, uses, or discloses employees’ personal information, then the employer should be aware of the PDPA’s requirements. Otherwise, the employer can face criminal, civil, or administrative penalties.

Related Professionals

Practices

Employment

Location

RELATED INSIGHTS​ 

April 27, 2020
Thailand’s Ministry of Interior has proposed a second round of automatic visa extensions for non-Thai citizens in Thailand whose visas will expire on or after April 30, 2020, along with a temporary exemption from the 90-day report duty, due to the continued travel restrictions in light of the COVID-19 pandemic.On April 21, the Cabinet approved the second automatic visa extension. All types of visas will therefore be automatically extended to July 31, 2020. A temporary suspension of the 90-day report requirement has also been granted until July 31, 2020.
Read More
April 24, 2020
The Government Office of Vietnam recently announced the conclusions of Prime Minister Nguyen Xuan Phuc regarding the combat of the COVID-19 pandemic following government meetings on April 20 and 22, 2020. Accordingly, the country has now moved into long-term epidemic combat, and thus needs to practice appropriate social distancing while facilitating the supply of goods and business development. As such, the strict social distancing guidelines under Directive No. 16/CT-TTg issued on March 31, 2020, have been lifted for most localities.
Read More
April 23, 2020
On April 21, 2020, following the Prime Minister’s extension of the lockdown measures in Laos to May 3, the National Taskforce Committee for COVID-19 Prevention and Control (the Taskforce) issued guidance on what companies must do to be allowed to operate during the lockdown, entitled Instructions on the Conditions and Measures for Eligible Private Companies to Operate during the COVID-19 Outbreak. 
Read More
April 23, 2020
The tragic increase in COVID-19 cases worldwide has changed how we live and work the world over, and Cambodia has not escaped the severe business impact being seen elsewhere. As a result of these changes, many businesses in Cambodia are seeking to understand what options they have for managing their employees during this time, and the consequences of various courses of actions. The purpose of this article is to address these issues.SuspensionOverview
Read More