Thailand's Personal Data Protection Committee Issues Notification On The Deletion, Destruction, Or De-Identification/Anonymization Of Personal Data

On 13^th August 2024, Thailand's Personal Data Protection Committee (PDPC) issued a Notification on the Deletion, Destruction, or De-Identification/Anonymization of Personal Data ("Notification") effective from 11^th November 2024. This Notification outlines criteria that data controllers must comply when handling data subjects' requests to delete, destroy, or de-identify/anonymize personal data.

1. Data Subject Rights and Controller Obligations

The Notification mandates that data controllers must respond to deletion, destruction, or de-identification requests from data subjects within 90 days. If the request cannot be fulfilled within this time due to technical reasons, appropriate measures must be taken to make the personal data inaccessible.