Thailand launches first data protection law
Thailand has enacted a new Personal Data Protection Act which governs companies’ use of personal data.
The law marks the first comprehensive piece of legislation governing data protection and the storage of private data in Thailand.
The Personal Data Protection Act, B.E. 2562 (2019) (PDPA) was passed by Thailand’s National Legislative Assembly in February this year, and was published in the Thai Royal Government Gazette last Thursday, May 27.
Publication of an act in The Gazette indicates its passage into law in Thailand, although companies will have one year to reach full compliance before the main provisions of the PDPA come into effect.
According to law firm Tilleke & Gibbins, once in effect, the law will require data controllers, such as websites, to obtain consent from subjects before they process personal data.
Data controllers will also have to step up security measures for the protection of personal data.
Penalties for non-compliance can include administrative fines of up to THB 5 million ($159,012), and criminal fines of up to THB 1 million.
While the PDPA is partly modelled on the EU’s General Data Protection Regulation 2016/679 (GDPR), law firm Baker McKenzie has advised that GDPR-compliant data controllers review their compliance with the PDPA ahead of next year.
A Personal Data Protection Committee is set to be established to issue further sub-regulations governing the storage and use of private data in Thailand.
In a statement for the firm, Dhiraphol Suwanprateep, partner at Baker McKenzie in Bangkok, advised that the sub-regulations “should be completely issued within the next two years”.
Did you enjoy reading this story? Sign up to our free daily newsletters and get stories like this sent straight to your inbox.
Today's top stories:
NPE sues Samsung over semiconductor devices
