THAILAND Trends and Developments Contributed by: Pranat Laohapairoj, Suphakorn Chueabunchai and Pitchaya Roongroajsataporn, Chandler Mori Hamada
Summary Overall, Thailand-based companies are steadily progressing towards compliance with the PDPA. Large multinational companies have taken the lead, setting an example for local entities, which have been gradually following suit. The year 2024 saw the issuance of several supplemen - tary updates aimed at strengthening enforce - ment, especially for cross-border requirement and DPO appointment. However, 2025 marks a significant milestone as it represents five years since the PDPA’s full enforcement, triggering a formal review by the authorities. This review is anticipated to assess the effectiveness of the PDPA, identify gaps in the current framework, and propose amendments or new supplemen - tal regulations to address evolving challenges in data protection and privacy. These potential updates may introduce additional compliance requirements or clarify existing ambiguities, further emphasising the importance of proac - tive measures by businesses. As enforcement is likely to intensify following the review, com - panies are strongly encouraged to deepen their understanding of the PDPA and undertake thor - ough compliance exercises as soon as possi - ble. By doing so, they can minimise – or ideally eliminate – legal and operational risks associ - ated with non-compliance while staying ahead of any forthcoming regulatory changes.
This shows that many companies do put extra care into ensuring compliance with the PDPA. The fourth positive development observed by the authors also carries a layer of complexity. Many ordinary citizens and residents in Thailand have become increasingly vocal about exercis - ing their rights under the PDPA. This shift has brought about both beneficial and problematic outcomes. On the positive side, the heightened awareness and growing likelihood of complaints have compelled businesses to accelerate their compliance efforts. However, this has also led to increased operational costs for many busi - nesses, driven not only by compliance meas - ures but also by the need to handle a surge in complaints and allegations – many of which are ungrounded or stem from misunderstandings of the law. In some cases, the authors have noticed a more concerning trend where individuals may leverage their rights under the PDPA with hid - den agendas. For example, certain data subjects use PDPA complaints strategically as a tool to negotiate compensation or settlements under unrelated legal claims, effectively weaponis - ing the rights granted by the law. This misuse poses additional challenges for businesses, as they must navigate both legitimate and oppor - tunistic claims, often at considerable financial and operational expense. While the increased awareness of data protection rights is a positive sign of the PDPA’s influence, the potential for misuse underscores the importance of educat - ing both businesses and the public on the proper application and limits of the law.
472 CHAMBERS.COM
Powered by FlippingBook