Thailand Releases Draft Notification On Data Protection Officer Appointment

On July 13, 2023, Thailand's Personal Data Protection Committee (PDPC) published a draft notification on the requirements for appointment of a data protection officer (DPO).

Under the Personal Data Protection Act B.E. 2562 (PDPA), data controllers or data processors must appoint a DPO if:

• The data controller or data processor is a state agency as prescribed by the PDPC (the list of state agencies was published in the Government Gazette on July 18, 2023);
• The activities of the data controller or data processor in relation to the processing of the personal data require "regular monitoring of the personal data or the system," by reason of "having large-scale personal data" as prescribed by the PDPC; or