[Editor's note: Since the drafting of this article for the ALB May issue magazine the law was subsequently postponed to 1 June 2022.]
Thailand’s first data privacy law, the Personal Data Protection Act B.E. 2562 (2019) (“PDPA”) has been temporarily postponed until 31 May 2021. Assuming that there is no further postponement, the PDPA will become largely enforceable on 1 June 2021. However, to date, the necessary supplementary regulations have not been issued, therefore rendering some parts of the PDPA incomplete and subsequently unenforceable. In February of 2021, the Ministry of Digital Economy and Society, the Office of Personal Data Protection Commission, and Chulalongkorn University jointly arranged unofficial public hearing sessions for Group 1 of the subordinate laws. This was to discuss the regulations urgently required to clarify certain details of the PDPA to enable businesses to understand and comply with the PDPA. The hearings were divided into seven sessions according to the type of industry. Academics from Chulalongkorn University presented the concepts of the draft regulations and responded to questions raised by the participants. The supplementary regulations under this Group 1 are:
- Rules and procedure for obtaining consent from data subjects;
- Notification of the purposes for and details of the processing of personal data;
- Appropriate measures for the processing of sensitive data;
- Rules and protective policy for the transfer of personal data from Thailand to overseas;
- Preparation of records for the processing of personal data, appropriate measures on the right to access the personal data of data subjects, and data breach notification;
- Security measures for the processing of personal data;
- In relation to an appointment of data protection officer, the criteria regarding the controller or amount of data processed; and
- Complaint and administrative procedures.
During the hearing drafts of the supplementary regulations were not presented, only guidelines and frameworks indicating how each may look. Given the current status of the supplementary regulations and necessary process, it is unlikely that these supplementary regulations will be issued on or before 1 June 2021. It is important to be aware that even without the supplementary regulations, the PDPA itself is materially enforceable and companies must take the necessary measures to comply with these already-functional provisions before they become effective on 1 June 2021.
Pranat Laohapairoj
Partner
E: pranat.l@mhm-global.com
Chandler MHM
36th Floor, Sathorn Square Office Tower
98 North Sathorn Road
Silom, Bangrak Bangkok
10500, Thailand
W: www.chandlermhm.com
