Data Protection Enforcement

     

Note that companies are required to appoint a DPO in case they are regularly, and ongoing monitoring personal data or large scale of personal date is monitored. The case signals to all companies in Thailand that enforcement efforts under the PDPA will increase and it is prudent to check compliance with data protection regulations.

      

Generally, companies are required to keep records on data protection activities. However, exemptions apply to certain small organizations. Now, the supervising authority has issued a new regulation, mainly expanding the scope of eligible small organizations. 

     

Now, the scope of such organizations comprises: SMEs according to the law on SME promotion, community enterprises or social enterprises, cooperatives, cooperative unions, agriculturist’s groups, foundation, association, religious organizations and non-profits, juristic persons in condos or other housing projects, household businesses or similar and sole proprietorships. Organizations falling under one of the mentioned exemptions are not required to keep records on data protection activities. 

    

Note that organizations wanting to make use of the exemption should