THAILAND Law and Practice Contributed by: Jutharat Anuktanakul, Suphakorn Chueabunchai and Pitchaya Roongroajsataporn, Chandler Mori Hamada Limited
1.6 Data Breach Requirement Under the PDPA, where a personal data breach occurs, the data controller must act without delay and, in any event, notify the PPDPC within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to data subjects’ rights and freedoms. The controller must first identify the nature and cause of the breach and assess the associated risks, taking into account factors such as the type and sensitivity of the data involved, the number of affected data subjects, the likelihood of misuse, and the poten - tial impact on individuals. Where the breach is likely to result in a high risk, affected data subjects must also be notified without undue delay. The controller must then implement remedial and mitigation meas - ures, including containment and recovery actions, and establish preventative measures to avoid recur - rence. The PDPC has the authority to investigate data breaches, request information and impose administra - tive sanctions. In addition, affected data subjects may bring civil claims, including collective or mass actions, for damages arising from PDPA violations. In this regard, over the past year the PDPC has adopted a more proactive and assertive enforcement approach. Where a data breach is reported or detect - ed through dark web disclosures or public discussions on social media, the PDPC may initiate inquiries and summon the organisation to provide explanations and information, even before a formal notification is sub - mitted. In some cases, such summonses have been publicly announced through the PDPC’s official social media platforms, increasing reputational and regula - tory exposure. As a result, organisations are expected to exercise heightened caution and preparedness in managing data breach risks, including timely internal assessments, clear communication strategies and well-documented response measures. 1.7 Regulators The PDPC is the supervising authority under the PDPA. The PDPA also established the Office of the PDPC to support the PDPC in developing and facili - tating enforcement. Under the PDPA, the PDPC has several duties, such as:
ly or indirectly) falls outside the scope of the PDPA. Once data is irreversibly anonymised, it is no longer considered personal data and may be used without relying on a lawful basis under the PDPA. However, the process of anonymisation itself involves the pro - cessing of personal data (and often sensitive health data) and must therefore comply with the PDPA until anonymisation is completed. Note that health data may be processed without con - sent where the processing is: • necessary for medical purposes, public health, scientific research or statistics, as authorised by applicable laws; and • subject to appropriate safeguards to protect data subjects’ rights and freedoms, such as data mini - misation, access controls and security measures. This exemption may apply where companies act on behalf of healthcare providers (eg, as data proces - sors) in connection with healthcare systems or medi - cal technologies. 1.5 Processing of Personal Data in the Context of Artificial Intelligence At present, Thailand does not have a specific or bind - ing AI law governing the use of personal data in AI sys - tems or automated decision-making. As a result, the processing of personal data in AI models is regulated primarily under the PDPA, and organisations must comply with general data protection principles such as lawfulness, purpose limitation, data minimisation, transparency, security and accountability. The PDPA does not establish a dedicated risk-based classification for AI systems, nor does it prohibit specific AI use cases. In practice, organisations are expected to adopt a risk-based approach, especially where AI involves large-scale processing, sensitive personal data, or automated decision-making with significant effects. Regulators have recommended conducting Data Protection Impact Assessments (DPIAs) as a key tool to identify and mitigate privacy risks. Transparency regarding AI use, sound data gov - ernance and appropriate human oversight are there - fore treated as regulatory expectations rather than strict statutory requirements.
496 CHAMBERS.COM
Powered by FlippingBook