THAILAND Law and Practice Contributed by: Jutharat Anuktanakul, Suphakorn Chueabunchai and Pitchaya Roongroajsataporn, Chandler Mori Hamada Limited
Chandler Mori Hamada Limited 31st and 36th Floors Sathorn Square Office Tower 98 North Sathorn Road Silom Bangrak Bangkok 10500 Thailand Tel: +662 009 5000 Fax: +662 009 5080 Email: business-development@morihamada.com Web: chandler.morihamada.com
1. Legal and Regulatory Framework 1.1 Overview of Data and Privacy-Related Laws The Personal Data Protection Act B.E. 2562 (2019) (PDPA) is the primary law regulating the processing of personal data in Thailand. As in other jurisdictions, “personal data” is defined as any data which, by itself or in combination with other data, can be used to iden - tify an individual, excluding data relating to deceased persons in particular. The PDPA focuses on the protection of data subjects whose personal data is processed, including through collection, storage, use, disclosure and other forms of processing, regardless of the original source of such personal data. Entities that determine the purposes and means of processing personal data (known as “Personal Data Controllers” or “controllers” under the PDPA) are required to have a lawful basis for process - ing any personal data and to maintain proper security measures to prevent any loss, unauthorised access, use or disclosure of personal data. These require - ments also apply to service providers that process personal data as instructed by or on behalf of a con - troller (known as “Personal Data Processors” or “pro - cessors” under the PDPA). The PDPA is based mainly on the EU General Data Protection Regulation (GDPR), and imposes obliga - tions on the private sector and government bodies (ie, both Personal Data Controllers and Personal Data
Processors) regardless of the mode of processing (ie, both automated and non-automated processing), especially regarding burden of proof. The PDPA itself applies to most activities, subject to certain exemptions, such as: • household activities; • the operation of public authorities for public safety purposes; and • media and fine arts activities carried out in accord - ance with professional ethics. For businesses regulated by specific supervisory authorities (such as banks and insurance businesses), the PDPA allows those supervisory authorities to issue the standard forms or guidelines for their operators to follow. The PDPA has explicit extraterritorial reach. If a con - troller/processor is outside Thailand, the PDPA can still apply if the relevant personal data relates to data subjects in Thailand, and the activities involve either: • the offering of goods or services to individuals in Thailand (irrespective of whether payment is required); or • the monitoring of behaviour that takes place in Thailand. In this regard, the PDPA operates alongside other laws governing non-personal data and cybersecurity, and
493 CHAMBERS.COM
Powered by FlippingBook