Thailand's Personal Data Protection Act
Thailand’s first law on personal data collection, the Personal Data Protection Act (PDPA), will come into effect on June 1, 2022 after being signed in 2019. Similar to the GDPR, key aspects of the PDPA include data processing, collection, storage, and consent protocols. The PDPA also appoints a Personal Data Protection Committee to ensure enforcement and compliance.
Scope:
The PDPA covers all businesses operating in Thailand as well as any foreign businesses who offer products and/or services to people in Thailand
A comprehensive set of rights are guaranteed to data subjects under the PDPA, namely:
- Right to access personal data
- Right to erasure
- Right to restrict processing
- Right to correct
- Right to objection
- Right to withdraw consent
- Right to be informed
- Right to data portability
Enforcements/Penalties:
Failure to comply with the data privacy law is subject to punitive damages as well as criminal and civil fines, ranging from 500,000 baht to 5 million baht.
