{"id":1988,"date":"2021-06-01T15:53:37","date_gmt":"2021-06-01T08:53:37","guid":{"rendered":"https:\/\/www.pacificprime.co.th\/blog\/?p=1988"},"modified":"2021-06-01T15:57:07","modified_gmt":"2021-06-01T08:57:07","slug":"thailand-postpones-the-pdpa-enforcement","status":"publish","type":"post","link":"https:\/\/www.pacificprime.co.th\/blog\/thailand-postpones-the-pdpa-enforcement\/","title":{"rendered":"Thailand postpones the PDPA enforcement: What it is and how to prepare your business for the PDPA"},"content":{"rendered":"

Businesses take note. Officially,\u00a0 Thailand postpones the PDPA or the Personal Data Protection Act<\/a> (PDPA) to June 1, 2022. Considered as the first local law designed to govern data protection in the digital age, the PDPA was originally scheduled to come into effect on June 1, 2021. However, it created multiple challenges for both local and foreign businesses alike. In addition, the ongoing COVID-19 crisis is putting extra pressure on numerous corporations. In this Pacific Prime Thailand<\/a> article, we\u2019ll go through what it is and how to prepare your business for the enactment of PDPA.<\/p>\n

Note that meanwhile, your business is still required to comply with the Data Protection Standard, as prescribed by the Ministry of Digital Economy and Society (MDES).<\/p>\n

\n

\"Corporate<\/a><\/p><\/div>\n<\/span><\/p>\n

What is the PDPA?<\/h2>\n

Taking a page from the European General Data Protection Regulation (GDRP), the PDPA is a data protection law. Key aspects of it include: data processing, data collection, data storage, and data consent protocols.<\/p>\n

Under the PDPA, you have the right to control how your personal data is collected, stored, disseminated and protected by organizations. We all have the right to know which organizations have our data, and how they use and share it. The PDPA prescribes duties and responsibilities to those who control and process our data.<\/p>\n

Below is a brief overview of several key features of the PDPA:<\/p>\n

1. An opt-out procedure must be made available<\/h3>\n

Data collectors (DCs) must make available an opt-out procedure which allows clients to withdraw his\/her consent. They must then notify their clients of this option. However, DCs can continue to keep and use personal data which was collected prior to the PDPA becoming effective. Note that this is only possible if its collection or use is within the scope of the original purpose.<\/p>\n

2. Secured cross-border transfer of personal data<\/h3>\n

Recipient countries who collect personal data in Thailand must have \u201cadequate personal data protection standards\u201d. Also, this migration of data must comply with the Personal Data Protection Committee\u2019s rules of protection.<\/p>\n

3. Data Protection Officer appointment<\/h3>\n

You should appoint a Data Protection Officer (DPO) if the personal data you process\/collect requires regular monitoring because it is sensitive and\/or large in scale. On top of that, your DPO should be able to communicate in Thai.<\/p>\n

Preparing your business for when the PDPA comes into law<\/h2>\n

Here is a non-exhaustive list of the key actions you can do to prepare before June 1st, 2022.<\/p>\n