Thailand Personal Data Protection Act: Exception For SMEs To Record Of Processing Activities (RoPA)

Thailand's Personal Data Protection Act (PDPA) imposes RoPA requirements. Just as we discussed exceptions to Legitimate Interest rules under the PDPA in our previous article (see here: https://fosrlaw.com/pdpa-thailand-exception-to-rule-of-section-19/), it's crucial to understand the significance of the Notification (a "Notification" in Thailand is akin to a regulation) titled Exemption to the Record of Processing Activities Requirement for Data Controllers that are Small Businesses B.E. 2565 (2022) (RoPA Exemption Notification). This notification directly impacts the compliance obligations of small and medium-sized businesses under the PDPA.

According to the RoPA Exemption Notification, a Data Controller considered a "small or medium size business" is exempt from the obligation to prepare and maintain a Record of Processing Activities (RoPA) under Section 39 of the PDPA (with some exceptions). The authority overseeing the PDPA, the Personal Data Protection