Thailand's PDPA

"To pass on our deep understanding of IT risk and control to the society"

Essential Information of PDPA

Thailand's Personal Data Protection Act B.E. 2562 ("PDPA") was announced and published in the Royal Thai Government Gazette on May 27th, 2019, to protect data privacy and stipulate the compliance liabilities. Nevertheless, PDPA allows a 1-year transition period for the compliance planning (i.e. deadline to implement all compliance measures is May 27th, 2020). Under PAPA, personal data means any information relating to a person that enables the identification of such person, whether directly or indirectly, but not including the information of the deceased person. The liabilities under PDPA include (i) fine up to THB 5 million, (ii) imprisonment up to 1 year, and (iii) compensation for actual damages plus punitive damages up to 2 times of such actual damages. Please note that the director(s) and a responsible person(s) could also be liable in