PDPA and its supporting Notifications

The new era of personal data protection in Thailand has begun since the Personal Data Protection Act (“PDPA”) has fully been implemented since 1 June 2022, after the long postponement. To comply with the PDPA, the four Notifications have been approved and published in the Royal Gazette on 21 June 2022, with the purpose of relieving the enforcement of punishment specified under the PDPA, especially for SMEs.

The details of those 4 Notifications are as follows.

  1. The first Notification is aimed at exempting SMEs from compliance with the PDPA’s practices on the recording of processing activities.
  2. The second Notification is intended to relax the enforcement of the punishment.
  3. The third Notification is concerned about methods of making and recording processing activities involving personal data and security measures for personal data protection.
  4. The last Notification is set out principles for the Expert Committee in relation to execution of administrative fines for those who breach the PDPA.

In addition, the government insisted that instead of creating a burden for SMEs and community enterprises, PDPA was enacted in order to benefit people in whole and create least burden for compliance. Moreover, PDPA is meant to support the digital-driven economy which would generate more percentage of GDP of Thailand.