{"id":1669,"date":"2020-12-23T19:13:37","date_gmt":"2020-12-23T12:13:37","guid":{"rendered":"https:\/\/www.vinarcopdpa.com\/?p=1669"},"modified":"2020-12-23T19:13:37","modified_gmt":"2020-12-23T12:13:37","slug":"what-are-the-obligations-of-data-controllers-processors-for-thailand-pdpa","status":"publish","type":"post","link":"https:\/\/www.vinarcopdpa.com\/2020\/12\/23\/what-are-the-obligations-of-data-controllers-processors-for-thailand-pdpa\/","title":{"rendered":"What are the Obligations of Data Controllers & Processors for Thailand PDPA?"},"content":{"rendered":"

[et_pb_section fb_built=”1″ _builder_version=”3.22″][et_pb_row _builder_version=”3.25″ background_size=”initial” background_position=”top_left” background_repeat=”repeat”][et_pb_column type=”4_4″ _builder_version=”3.25″ custom_padding=”|||” custom_padding__hover=”|||”][et_pb_text _builder_version=”4.7.7″ background_size=”initial” background_position=”top_left” background_repeat=”repeat”]<\/p>\n

Thailand\u2019s first comprehensive regulatory framework for protecting personal information \u2013 the personal data protection act (PDPA) \u2013 came into effect on May 27, 2020. The PDPA explains<\/a> how businesses must process their customers’ personal data \u2013 i.e. collect, use, disclose, and transfer.<\/p>\n

Data controllers play a critical role here as they must ensure that day-to-day operations meet all the obligations set out for handling personal data, including the collection, use and transfer of data subjects\u2019 personal data.<\/p>\n

Data processors must comply strictly with the controller\u2019s legal instructions and not take any action outside the bounds of those instructions. This article discusses the obligations of data controllers and processors concerning Thailand PDPA laws.<\/p>\n

 <\/p>\n

Processor and Controller Obligations for Thailand PDPA<\/strong><\/h2>\n

 <\/p>\n

Collection, use and disclosure \u2013 basic elements<\/strong><\/h3>\n

 <\/p>\n

The data controller must acquire the consent of data subjects\u2019 either in writing or electronic form before or at the time of collection, use, processing or disclosure of such personal data.<\/p>\n

The collected data can only be used according to the indented purpose, which has already been relayed to the data subjects. Furthermore, the collection must be done from data subjects directly. Transferring personal data to a country outside Thailand is only allowed if recipients already have the required data protection standards in place.<\/p>\n

 <\/p>\n

Data processing notification<\/strong><\/h3>\n

 <\/p>\n

The data controller is required to inform the data subject of the purpose of data collection, the intended data retention period and the rights they are entitled to \u2013 either before or at the time of personal data collection. The only exception to this is if the data subject is already aware of such details.<\/p>\n

 <\/p>\n

Data processing records<\/strong><\/h3>\n

 <\/p>\n

Both the data processor and data controller are required to prepare and maintain records of all personal data processing activities for the data subjects\u2019 knowledge and reference and the PDPC (Personal Data Protection Commission) Office. This can either be in written or electronic form. Thailand PDPA will lay out the rules around records of processing activities in a future sub-regulation.<\/p>\n

 <\/p>\n

Data transfers<\/strong><\/h3>\n

 <\/p>\n

Even though there is no localisation required around data transfers, businesses sharing personal data with any affiliate organisations outside Thailand must follow the PDPA mechanism, which is similar to the GDPR\u2019s corporate rules. What this means is cross-border personal data transfers<\/a> are permitted as long as the data processor or data controller follows an internal policy with specific safeguards for personal data cross-border transfer to the foreign affiliate \u2013 of course, provided that this internal policy is in the knowledge of and approved by the PDPC Office.<\/p>\n

Even though the PDPC Office\u2019s criteria for cross-border transfers of personal data has not been established yet, businesses are urged to take the necessary inter-party personal data privacy measures sooner rather than later.<\/p>\n

 <\/p>\n

Data retention<\/strong><\/h3>\n

 <\/p>\n

During the personal data collection process, the data controller must inform data subjects of the set time frame or period for which the data shall be retained. This can either be done before or at the time of personal data collection.<\/p>\n

However, if it is not feasible to specify a fixed retention duration, the expected data retention duration will be defined as per the current data retention standard.<\/p>\n

 <\/p>\n

Closing thoughts on Data Controller and Data Processor Obligations<\/strong><\/h2>\n

 <\/p>\n

For reference, Chapter 3 of Thailand PDPA explains the specific obligations of a data controller \u2013 e.g. such as ensuring that all personal data is up-to-date, accurate and complete, that it is not misleading and that the necessary security measures have been taken to prevent unauthorized personal data access.<\/p>\n

In some cases, the data processor is not always a data controller \u2013 which means the data processor\u2019s obligations apply to the designated data controller: to collect, use or disclose personal data only as per the data controller\u2019s instructions and provide ample security while processing data, among other things.<\/p>\n

Ensure that you are always compliant and fully aware of your data controller\u2019s and data processor\u2019s obligations \u2013 Formiti\u2019s data privacy consultancy<\/u> has you covered.<\/p>\n

[\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row column_structure=”3_5,2_5″ _builder_version=”4.7.7″ _module_preset=”default”][et_pb_column type=”3_5″ _builder_version=”4.7.7″ _module_preset=”default”][et_pb_code _builder_version=”4.9.4″ _module_preset=”default” background_color=”#73c2e0″ hover_enabled=”0″ sticky_enabled=”0″]\t[ninja_form id=6][\/et_pb_code][\/et_pb_column][et_pb_column type=”2_5″ _builder_version=”4.7.7″ _module_preset=”default”][et_pb_blurb title=”VinarcoPDPA PDPA Assessment” url=”https:\/\/www.vinarcopdpa.com\/pdpa-assessment” _builder_version=”4.7.7″ _module_preset=”default” header_text_color=”#28952d”]<\/p>\n

We offer a globally recognized gap analysis and remediation report, which can be completed within days. Depending on your organisation\u2019s scale, our remediation consultant will conduct an onsite gap analysis assessment covering Ten core areas and seventy-three controls.<\/p>\n

[\/et_pb_blurb][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"

[et_pb_section fb_built=”1″ _builder_version=”3.22″][et_pb_row _builder_version=”3.25″ background_size=”initial” background_position=”top_left” background_repeat=”repeat”][et_pb_column type=”4_4″ _builder_version=”3.25″ custom_padding=”|||” custom_padding__hover=”|||”][et_pb_text _builder_version=”4.7.7″ background_size=”initial” background_position=”top_left” background_repeat=”repeat”] Thailand\u2019s first comprehensive regulatory framework for protecting personal information \u2013 the personal data protection act (PDPA) \u2013 came into effect on May 27, 2020. The PDPA explains how businesses must process their customers’ personal data \u2013 i.e. collect, use, disclose, […]<\/p>\n","protected":false},"author":1,"featured_media":1877,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8,11],"tags":[9,10,12,13,14,15,16,17,18,19,21,22,23,24,25,26,27,28,29,30,31],"_links":{"self":[{"href":"https:\/\/www.vinarcopdpa.com\/wp-json\/wp\/v2\/posts\/1669"}],"collection":[{"href":"https:\/\/www.vinarcopdpa.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.vinarcopdpa.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.vinarcopdpa.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.vinarcopdpa.com\/wp-json\/wp\/v2\/comments?post=1669"}],"version-history":[{"count":0,"href":"https:\/\/www.vinarcopdpa.com\/wp-json\/wp\/v2\/posts\/1669\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.vinarcopdpa.com\/wp-json\/wp\/v2\/media\/1877"}],"wp:attachment":[{"href":"https:\/\/www.vinarcopdpa.com\/wp-json\/wp\/v2\/media?parent=1669"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.vinarcopdpa.com\/wp-json\/wp\/v2\/categories?post=1669"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.vinarcopdpa.com\/wp-json\/wp\/v2\/tags?post=1669"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}