Thailand Personal Data Protection Act (PDPA)
Key highlights of PDPA:
Personal DataAny information relating to a Person, which enables the identification of such Person, whether directly or indirectly, but not including the information of the deceased Persons in particular.
Data Subject RightsThe PDPA provides the data subject rights, which largely mirror those provided by the GDPR.
Data ControllerA Person or a juristic person having the power and duties to make decisions regarding the collection, use, or disclosure of the Personal Data.
Privacy AssessmentsControllers are required to perform and document Data Protection Impact Assessments for each processing activity “that presents a heightened risk of harm” to consumers.
Know the difference between Virginia’s CDPA, CCPA and CPRA?
Download this whitepaper to know more about the key differences between the provisions of Virginia’s new privacy law called CDPA, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). It provides an overview of each law’s requirements, highlighting their similarities and differences. Although there are some similarities in all the active privacy laws, the framework, and definitions of CDPA carries its unique requirements and guidance.
Data Subject Rights under Thailand Personal Data Protection Act (PDPA) (Section 30-35)
- Right to information access (Section 30)
The data subject is entitled to request access to and obtain copy of the Personal Data related to him or her, which is under the responsibility of the Data Controller, or to request the disclosure of the acquisition of the Personal Data obtained without his or her consent. - Right to data portability (Section 31)
The Data Controller shall arrange such Personal Data to be in the format which is readable or commonly used by ways of automatic tools or equipment and can be used or disclosed by automated means. - Right to object the collection use or disclosure of personal data (Section 32)
The data subjects have the right to object or opt out of the collection, use, or disclosure of the personal data linked to them; if the data was collected with exemption to consent and the Data Controller is unable to prove that it was for legitimate interest grounds, or to exercise legal claims. - Right to erasure (Section 33)
The data subject shall have the right to request the Data Controller to erase or destroy the Personal Data or anonymize the Personal Data to become the anonymous data which cannot identify the data subject. - Right to ask data controller to restrict the use of the personal data (Section 34)
The data subjects have the right to request the data controller to restrict the use of their personal data when it is no longer necessary to retain such Personal Data for the purposes of such collection. - Right to accurate and up-to-date personal data (Section 35)
The Data Controller shall ensure that the Personal Data remains accurate, up-to-date, complete, and not misleading - Right to withdraw consent (Section 19)
The data subject may withdraw his or her consent at any time. The withdrawal of consent shall be as easy as to giving consent, unless there is a restriction of the withdrawal of consent by law, or the contract which gives benefits to the data subject.
Appointment of Data Protection Officer (Section 41)
The Data Controller and the Data Processor shall designate a data protection officer in the following circumstances:
- The Data Controller or the Data Processor is a public authority as prescribed and announced by the Committee.
- The activities of the Data Controller or the Data Processor in the collection, use, or disclosure of the Personal Data require a regular monitoring of the Personal Data or the system, by the reason of having a large number of Personal Data as prescribed and announced by the Committee.
- The core activity of the Data Controller or the Data Processor is the collection, use, or disclosure of the Personal Data according to section 26.
How Mandatly helps you achieve Thailand's PDPA compliance?
Mandatly’s PDPA compliance solution goes above and beyond automation and includes comprehensive privacy risk management features that enable you to make effective business decisions and eliminate privacy risks.
Consumer RightsEnd-to-end DSAR fulfillment solution with automated identity verification and data discovery to fulfill the consumer request timely, securely, and efficiently.
Data Inventory and MappingMaintain your data sources and map data flows to meet the PDPA "Lookback" requirements.
Privacy AssessmentsBundled with intelligence to uncover and assess privacy risks that your business can be exposed to.
Privacy NoticesGenerate privacy notices for your website or applications to keep your customers informed about how their Personal Information is collected, processed, and shared.
Do not sell my informationEnables customers to opt-out of the cookie based and non-cookie based sale of personal information.
AnalyticsReporting features are built into the system to get a holistic view of the compliance program for different stakeholders.
Recent Articles
Navigating the Evolving Data Privacy Landscape: Insights and Updates for 2024
Navigating the Evolving Data Privacy Landscape: Insights and Updates for 2024Understanding New Data Privacy LawIn the ever-ex...
The Role of Employee Training in GDPR Compliance and Data Security
The Role of Employee Training in GDPR Compliance and Data SecurityOverview: GDPR Training For EmployeesIn today's rapidly evo...
Explore the Link Between Cybersecurity and GDPR Compliance
The Intersection of GDPR & CybersecurityWhat is GDPR?Enforced since May 2018, GDPR is a comprehensive set of regulations ...
International Data Transfers: Understanding Legal Frameworks
Cross Border Data Transfer & Legal FrameworkA Legal Framework For Data ProtectionBefore delving into the legal mechanisms...
Navigating the Complex Landscape of Data Privacy Compliance
Data Privacy Compliance in E-commerce: Navigating the Complex LandscapeIn the digital age, data privacy has emerged as a crit...
EU-U.S. Data Privacy & GDPR: A Symbiotic Bond
The GDPR and the EU-US Data Privacy Framework: A Symbiotic RelationshipEU-US Data Privacy Shield FrameworkThe EU US Data Priv...