PDPA for businesses: the minimum you need to comply with the personal data protection law

The Personal Data Protection Act B.E. 2562 (2019), or PDPA, has been fully in force since 1 June 2022 and applies to almost every kind of business, because every business holds data on customers, employees or business partners. This article sums up the minimum a business should have in place to comply with the law.

How the PDPA applies to your business

Personal data is any information that can identify a person, directly or indirectly, such as a name, phone number, email address, national ID number, CCTV footage, or website usage data linked to an individual. A business that collects, uses or discloses such data has legal duties as a data controller.

Lawful bases for processing data

Consent is not the only basis available. Data may be processed when a lawful basis supports it, such as:

• Performing a contract, or taking steps at the data subject's request before entering into one
• Complying with a legal obligation, such as keeping data for tax or employment law duties
• The business's legitimate interests, provided they do not unduly affect the data subject's rights
• Preventing danger to a person's life, body or health
• The data subject's consent, where no other basis applies

Sensitive data, such as health data, religion or biometric data, is subject to stricter conditions and generally requires explicit consent, unless an exception set by law applies.

The minimum you should have in place

1. A privacy notice: telling data subjects what data you collect, for what purposes, how long you keep it, who you disclose it to and how they can contact the business.
2. A record of processing activities: knowing where each data set is held, who has access to it and which lawful basis applies. Certain types of small business are partly exempt under a notification of the Personal Data Protection Committee, but they should still know where their data is.
3. Security measures: both technical, such as access restrictions and encryption, and organisational, such as staff training.
4. Agreements with data processors: when others process data on your behalf, such as payroll or customer relationship management service providers.
5. A procedure for rights requests: data subjects have the right to request access to their data, its correction or deletion, to object, or to have its use suspended. The business should have a channel for receiving requests and act on them within the period set by law.
6. A data breach response procedure: if a breach poses a risk to the rights of data subjects, you must notify the Office of the Personal Data Protection Committee within 72 hours of becoming aware of it, and also notify the data subjects if the risk is high.
7. A data protection officer (DPO): must be appointed where the conditions set by law are met, for example where the core activities require regular monitoring of large amounts of data.

Penalties

Failure to comply with the PDPA can lead to civil liability, including punitive damages, criminal penalties in some cases, and administrative fines of up to THB 5 million per case. It also damages the trust of customers and business partners.

How to get started

1. Survey the data the business holds in every system: paper documents, files and online systems.
2. Set the lawful basis and retention period for each data set.
3. Prepare or update your privacy notices and your agreements with service providers.
4. Train staff and test the breach response procedure.

Frequently asked questions

Do we have to ask customers for consent every time?

No, not if another lawful basis supports the use of the data, such as performing a contract, although you must still give the details in a privacy notice. Asking for consent when it is not needed can create extra work and confusion when data subjects withdraw their consent.

What do we need to do if we install CCTV in the office?

Put up signs to let people know, limit who can view the footage, set a suitable retention period, and do not install cameras in places where they would unduly intrude on privacy.

Is employee data covered by the PDPA?

Yes, it is covered as well. The business should inform employees about how their data is collected and used, and protect sensitive data, such as health data, with stricter measures.

Let us help you set up data protection

Kerwin & Vance advises on both the legal and the IT side of PDPA compliance, from surveying your data and preparing the documents to security measures. Find out more about our Law & Intellectual Property and Technology services, or book a consultation with us.

This article provides general information only and is not legal advice on any specific case. The rules may change with notifications of the Personal Data Protection Committee, so consult a specialist before taking action.