THAILAND Trends and Developments Contributed by: Jutharat Anuktanakul, Suphakorn Chueabunchai and Pitchaya Roongroajsataporn, Chandler Mori Hamada Limited
Implementation of appropriate security measures (beyond documentation) Preparing documentation alone (such as privacy poli - cies or consent forms) is not sufficient to fulfil PDPA obligations. Organisations must implement appropri - ate security measures proportionate to their specific risks, including technical, organisational and admin - istrative safeguards. This has become increasingly critical in light of more active and substantive enforce - ment by the Thai regulator. Vendor governance and DPAs as operational controls Processor arrangements must be audited (particularly with IT vendors, cloud/hosting providers, outsourced call centres and destruction service providers), con - firming:
DPO decision-making and evidence trail Where DPO designation is required (or where the position is borderline), the assessment must be docu - mented, and it must be ensured that the DPO function has visibility and authority. High-risk processing governance (biometrics, health, identity) Biometric projects must be treated as initiatives sub - ject to “special scrutiny”, with explicit consent design, voluntariness assessment, DPIA-style risk assess - ment, retention/deletion logic and transfer controls. Cross-border transfer roadmap Where group operations rely on intra-group transfers, it must be assessed whether BCR certification is fea - sible and valuable under the new PDPC’s framework, especially where GDPR BCRs are already in place.
• contractual coverage; • security requirements; • notification obligations; and • audit/monitoring rights.
509 CHAMBERS.COM
Powered by FlippingBook