Thailand Personal Data Protection Act – Preparing For The New Law

Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA") will come into full force on 27 May 2020. In view of the impending target date, this article provides a concise overview of the new law.

Scope of Enforcement – The PDPA applies to the collection, use or disclosure of personal data by a data controller or data processor located in Thailand, regardless of whether or not such acts occur in Thailand. If a data controller or data processor is located outside of Thailand, the PDPA applies if the data subject whose data is collected, used or disclosed is located in Thailand, provided that the data controller's or data processor's activities are:

(i) the offering of goods or services to a data subject who is located in Thailand (irrespective of whether or not the payment for such goods/services is made by the data subject); or