THAILAND Law and Practice Contributed by: Jutharat Anuktanakul, Suphakorn Chueabunchai and Pitchaya Roongroajsataporn, Chandler Mori Hamada Limited
generally applies as a supplementary framework to such laws. Certain sector-specific or special laws may impose stricter requirements relating to security, gov - ernance or compliance than those prescribed under the PDPA. Accordingly, organisations must assess on a case-by-case basis whether any specific or indus - try-related laws apply to their operations, and ensure compliance with the higher or more stringent stand - ards where applicable. 1.2 Rights and Obligations The general principles for the processing of personal data under the PDPA are broadly aligned with the sev - en principles of the GDPR, and can be summarised as follows. • Lawfulness, fairness and transparency – personal data must be processed lawfully, fairly and trans - parently, with clear information provided to data subjects. • Purpose limitation – personal data must be col - lected for specific and legitimate purposes and not used beyond those purposes, unless permitted by law. • Data minimisation – only personal data that is necessary for the stated purpose may be collected and processed. • Accuracy – personal data must be accurate, up to date, and corrected where necessary. • Storage limitation – personal data must not be retained longer than necessary, unless retention is required by law. • Integrity and confidentiality (security) – appropriate technical and organisational measures must be in place to protect personal data. • Accountability – data controllers are responsible for PDPA compliance and must be able to demon - strate such compliance. Lawful Bases for Processing Personal Data Under the PDPA Under the PDPA, personal data may be processed only where a lawful basis applies. If no lawful basis is
• Consent – freely given, informed and explicit (espe - cially for sensitive personal data). • Research and statistics – necessary for research or statistical purposes, subject to appropriate safe - guards for data subjects’ rights and freedoms. • Contractual necessity – necessary for entering into or performing a contract with the data subject. • Legal obligation – necessary to comply with appli - cable laws. • Vital interests – necessary to prevent danger to life, body or health. • Public task/public interest – necessary for tasks carried out in the public interest or under official authority. • Legitimate interests – necessary for legitimate interests of the controller or a third party, provided such interests do not override the data subject’s fundamental rights and freedoms. Data Subject Rights Under the PDPA Under the PDPA, data subjects are entitled to the fol - lowing rights. • Right of access – to request access to and obtain a copy of their personal data. • Right to rectification – to request correction of inaccurate or incomplete personal data. • Right to erasure (right to be forgotten) – to request deletion or anonymisation of personal data when it is no longer necessary or unlawfully processed. • Right to restriction of processing – to request temporary suspension of processing in specific circumstances. • Right to data portability – to request personal data in a structured, commonly used and machine-read - able format, where applicable. • Right to object – to object to processing based on legitimate interests, direct marketing or other grounds prescribed by law. • Right to withdraw consent – to withdraw consent at any time, without affecting prior lawful process - ing. • Right to lodge a complaint – to lodge a complaint with the Personal Data Protection Committee (PDPC).
available, consent must be obtained. Key lawful bases include the following.
494 CHAMBERS.COM
Powered by FlippingBook