13. Chapter 13 - Personal Data Protection

This chapter will discuss and provide basic background information on the Personal Data Protection Act, B.E. 2562 (2019) (the “PDPA”), which was due to come into full effect in May 2020. However, the Royal Decree on the Organizations and Businesses of which Personal Data Controllers are Exempted from the Applicability of the Personal Data Protection Act, B.E. 2562 (2019), B.E. 2563 (2020) and its amendment, were issued to postpone the enforcement until 31 May 2022. During the postponement period, the main provisions of the PDPA including Chapter 2 (Personal Data Protection), Chapter 3 (Use or Disclosure of Personal Data), and Chapter 7 (Punishment) will not be enforced with all Personal Data Controllers in 19 business industries and three groups of organizations. Those business industries and organizations cover most types of businesses in Thailand, government agencies, foreign government agencies and international organizations, foundations, associations, religious organizations, and non-profits organizations. The PDPA is expected to be fully enforced for all Personal Data Controllers on 1 June 2022. Legally speaking, this Royal Decree does not provide postponement of enforcement for Personal Data Processors. Therefore, Personal Data Processors should perform their duties and obligations as prescribed in PDPA, such as providing security measures for prevention of loss of Personal Data.