Thailand Prepares Criteria For Personal Data Deletion, Destruction, And De-Identification

On June 14, 2024, the Personal Data Protection Committee (PDPC) released a draft notification under the Personal Data Protection Act 2019 (PDPA), setting out criteria for how data controllers must delete, destroy, and de-identify personal data.

According to the PDPA, a data subject can request that a data controller delete, destroy, or de-identify their personal data in any of the following circumstances:

• The personal data is no longer necessary for the purposes for which it was collected, used, or disclosed.
• The data subject has withdrawn their consent for the processing of the personal data, and no other lawful basis for processing remains.
• The data subject has objected to the processing of their personal data on grounds of legitimate interests or official tasks, the data controller has no other compelling grounds to refuse the request, and the data is not needed for legal claims.