Section 1 - This Act is called the "Personal Data Protection Act, B.E.2562 (2019)"Section 2 - This Act shall come into force on the day following the date of its publication in the Government Gazette, exceptSection 3 - In the event that there is any sector-specific law governing the protection of Personal Data in any manner, any businessSection 4 - This Act shall not apply to:Section 5 - This Act applies to the collection, use, or disclosure of Personal Data by a Data Controller or a Data ProcessorSection 6 - In this ActSection 7 - The Minister of Digital Economy and Society shall be in charge under this Act, and shall have the power to
Section 8 - There shall be a Personal Data Protection Committee, consisting of:Section 9 - There shall be a selection committee of eight members having the duty to select the appropriate persons who should beSection 10 - In selecting the Chairperson in section 8 (1) or the honorarySection 11 - The Chairperson and the honorary director shall have the qualifications, and shall not be under the following prohibited characteristics:Section 12 - The Chairperson and the honorary director shall hold office for a term of four years.Section 13 - In addition to vacating office upon the expiration of the term under section 12, the Chairperson and the honorary directorSection 14 - At a meeting of the Committee, the presence of not less than one-half of all the members is required toSection 15 - Any member who has a direct or indirect interest in the matter being considered in the meeting, shall inform theSection 16 - The Committee shall have the following duties and power:Section 17 - The Chairperson, the Vice-Chairperson, and Committee shall receive a meeting allowance and other benefits in accordance with the rules prescribedSection 18 - The Committee shall have the power to appoint sub-committees for considering or performing any act as prescribed by the Committee.
Part 1 - General Provisions
Section 19 - The Data Controller shall not collect, use, or disclose Personal Data, unless the data subject has given consent prior toSection 20 - In the event that the data subject is a minor who is not sui juris by marriage or has noSection 21 - The Data Controller shall collect, use, or disclose Personal Data according to the purpose notified to the data subject priorPart 2 - Personal Data Collection
Section 22 - The collection of Personal Data shall be limited to the extent necessary in relation to the lawful purpose of theSection 23 - In collecting the Personal Data, the Data Controller shall inform the data subject, prior to or at the time ofSection 24 - The Data Controller shall not collect Personal Data without the consent of the data subject, unless:Section 25 - The Data Controller shall not collect Personal Data from any other source, apart from the data subject directly, except where:Section 26 - Any collection of Personal Data pertaining to racial, ethnic origin, political opinions, cult, religious or philosophical beliefs, sexual behavior, criminalPart 3 - Use or Disclosure of Personal Data
Section 27 - The Data Controller shall not use or disclose Personal Data without the consent of the data subject, unless it isSection 28 - In the event that the Data Controller sends or transfers the Personal Data to a foreign country, the destination countrySection 29 - In the event that the Data Controller or the Data Processor who is in the Kingdom of Thailand has putSection 30 - The data subject is entitled to request access to and obtain copy of the Personal Data related to him orSection 31 - The data subject shall have the right to receive the Personal Data concerning him or her from the Data Controller.Section 32 - The data subject has the right to object the collection, use, or disclosure of the Personal Data concerning him orSection 33 - he data subject shall have the right to request the Data Controller to erase or destroy the Personal Data, orSection 34 - The data subject shall have the right to request the Data Controller to restrict the use of the Personal Data,Section 35 - The Data Controller shall ensure that the Personal Data remains accurate, up-to-date, complete, and not misleading.Section 36 - In the case where the data subject requests the Data Controller to act in compliance with section 35, if theSection 37 - The Data Controller shall have the following duties:Section 38 - The provisions of t h e representative designation in section 37 (5) shall not apply to the following Data Controller:Section 39 - The Data Controller shall maintain, at least, the following records in order to enable the data subject and the OfficeSection 40 - The Personal Data Processor shall have the following duties:Section 41 - The Data Controller and the Data Processor shall designate a data protection officer in the following circumstances:Section 42 - The data protection officer shall have the following duties:
Section 43 - There shall be an Office of the Personal Data Protection Committee, whose objectives are to protect Personal Data, encourage andSection 44 - In addition to the Office’s duty to carry out its operations to achieve the objectives as set out in sectionSection 45 - In carrying out the Office’s operation, apart from those stipulated under section 44, the Office shall also have the powerSection 46 - The fund and properties used in the Office’s business operations shall consist of the following:Section 47 - The immovable properties that the Office acquires by the purchase or exchange using the Office’s revenue in section 46 (4)Section 48 - There shall be a commission supervising the Office of Personal Data Protection Committee consisting of a Chairperson, who is selectedSection 49 - There shall be a selection committee of eight members, consisting of the persons appointed by the Committee, having the dutySection 50 - In selecting the Chairperson and the honorary director in section 48, the selection committee shall select the persons who haveSection 51 - The Chairperson and the honorary director in section 48 shall hold office for a term of four years.Section 52 - n the case where the Chairperson or the honorary director in section 48 vacates office before the expiration of theSection 53 - At a meeting of the commission supervising the Office of Personal Data Protection Committee, the presence of not less thanSection 54 - The Commission Supervising the Office of Personal Data Protection Committee shall have the following powers and duties:Section 55 - The commission supervising the Office of Personal Data Protection Committee shall have the power to appoint a sub-committee to performSection 56 - The Chairperson and members of the commission supervising the Office of Personal Data Protection Committee, advisers of the commission supervisingSection 57 - There shall be a Secretary-General who is appointed by the commission supervising the Office of Personal Data Protection Committee andSection 58 - A person to be appointed Secretary-General must have the qualifications as follows:Section 59 - Any person holding any of the following prohibiting characteristics shall not be Secretary-General:Section 60 - The Secretary-General shall hold office for each term of four years and may be reappointed. However, the Secretary-General shall notSection 61 - In each year, the performance of the Secretary-General shall be evaluated in accordance with the period and method prescribed bySection 62 - In addition to vacating office upon the expiration of the term in section 60, the Secretary-General shall vacate office upon:Section 63 - The Secretary-General shall have the following duties andSection 64 - In the Office’s affairs related to the third party, the Secretary-Section 65 - The commission supervising the Office of Personal Data Protection Committee shall be responsible for determining salary rate and other benefitsSection 66 - In the interests of administration of the Office, the Secretary- General may request a civil official, staff, officer, or employeeSection 67 - For the civil official or government official who is working in compensation for the scholarship granted to him or herSection 68 - Accounting of the Office shall be made in accordance with international standards according to the forms and rules prescribed bySection 69 - The Office shall prepare financial statements and accountingSection 70 - The Office shall prepare an annual operation report and submit to the commission supervising the Office of Personal Data Protection
Section 71 - The Committee shall appoint one or more expert committees based upon their field of expertise, or as the Committee deemsSection 72 - The expert committee shall have the following duties andSection 73 - The data subject has the right to file a complaint in the event that the Data Controller or the DataSection 74 - In the event that a complainant does not comply with the rules provided in section 73 paragraph two, or theSection 75 - The expert committee shall have the power to order any person to submit documents or information in connection with theSection 76 - In order to act in accordance with this Act , the Competent Officer shall have the following duties and power:
Part 1 - Criminal Liability
Section 79 - Any Data Controller who violates the provisions under section 27 paragraph one or paragraph two, or fails to comply withSection 80 - ny person who comes to know the Personal Data of another person as a result of performing duties under thisSection 81 - In the case where the offender who commits the offense under this Act is a juristic person and the offensePart 2 - Administrative Liability
Section 82 - Any Data Controller who fails to comply with section 23, section 30 paragraph four, section 39 paragraph one, section 41Section 83 - Any Data Controller who violates or fails to comply with section 21, section 22, section 24, section 25 paragraph one,Section 84 - Any Data Controller who violates section 26 paragraph one or three, or section 27 paragraph one or paragraph two, orSection 85 - Any Data Processor who fails to comply with section 41 paragraph one, or section 42 paragraph two or three, shallSection 86 - Any Data Processor who fails to comply with section 40 without appropriate reasons, or fails to send or transfer theSection 87 - Any Data Processor who send or transfer the Personal Data under section 26 paragraph one or three, by not complyingSection 88 - Any representative of the Data Controller or of the Data Processor who fails to comply with section 39 paragraph oneSection 89 - Any person who fails to act in compliance with the order given by the expert committee, or fails to provideSection 90 - The expert committee shall have the power to render the punishment a s an administrative fine prescribed in this Part.Section 91 - At the early stage, the Committee shall consist of committee members under section 8 (2) and (3), and the Secretary-GeneralSection 92 - A commission supervising the Office of the Personal Data Protection Committee shall be set up within ninety days from theSection 93 - The Office shall be set up in order to operate in accordance with this Act within one year from theSection 94 - At the early stages, the Cabinet shall allocate the initial budget for the Office as necessary.Section 95 - For Personal Data that has previously been collected by a Data Controller before the effective date o f this Act,Section 96 - The issuance of the regulations and notifications in accordance with this Act shall be completed within one year from the
(1) or the honorary director in section 8 (4) together with the evidence of qualifications and no prohibited characteristics as well as the consent of such persons to the Cabinet for the appointment as the Chairperson in section 8 (1) or the honorary director in section 8 (4).
The Data Controller shall not collect, use, or disclose Personal Data, unless the data subject has given consent prior to or at the time of such collection, use, or disclosure, except the case where it is permitted to do so by the provisions of this Act or any other laws.
A request for consent shall be explicitly made in a written statement, or via electronic means, unless it cannot be done by its nature.
In requesting consent from the data subject, the Personal Data Controller shall also inform the purpose of the collection, use, or disclosure of the Personal Data. Such request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an easily accessible and intelligible form and statements, using clear and plain language, and
does not deceptive or misleading to the data subject in respect to such purpose. In this regard, the Committee may require the Data Controller to request for data subject's consent in accordance with the form and statements as prescribed by the Committee.
In requesting consent from the data subject, the Data Controller shall utmost take into account that the data subject's consent is freely given. Also, the entering into the contract, including any provisions of the service shall not be a condition to obtaining consent for the collection, use, or disclosure of Personal Data that is not necessary or not related to such contract entering, including the provisions of the service.
The data subject may withdraw his or her consent at any time. The withdrawal of consent shall be as easy as to giving consent, unless there is a restriction of the withdrawal of consent by law, or the contract which gives benefits to the data subject. However, the withdrawal of consent shall not affect the collection, use, or disclosure of personal data that the data subject has already given consent legally under this Chapter.
In the event that the withdrawal of consent will affect the data subject in any manner, the Data Controller shall inform the data subject of such consequences of consent's withdrawal.
The request for the data subject’s consent which is not in accordance with those prescribed in this Chapter shall have no binding effect on the data subject and shall no longer enable the Data Controller to collect, use, or disclose the Personal Data.
In the event that the data subject is a minor who is not sui juris by marriage or has no capacity as a sui juris person under section 27 of the Civil and Commercial Code, the request for the consent from such data subject shall be made as follows:
(1) In the event that the minor’s giving of consent is not any act which the minor may be entitled to act alone as prescribed under section 22, section 23, or section 24 of the Civil and Commercial Code, such act also requires consent of the holder of parental responsibility over the child;
(2) Where the minor is below the age of ten years, the consent shall be obtained from the holder of parental responsibility over the child.
In the event that the data subject is incompetent, the consent must be obtained from the custodian who has the power to act on behalf of the incompetent person.
In the event that the data subject is quasi-incompetent, the consent must be obtained from the curator who has the power to act on behalf of the quasi-incompetent person.
The provisions of paragraphs one, two, and three shall apply mutatis mutandis to the withdrawal of consent of the data subject, the notice given to the data subject, the exercise of rights of the data subject, the complaint of the data subject, and any other acts under this Act for the data subject who is a minor, an incompetent or quasi-incompetent person.
(1) the data subject has been informed of such new purpose, and the consent is obtained prior to the time of collection, use, or disclosure;
(1) the purpose of the collection for use or disclosure of the Personal Data, including the purpose which is permitted under section 24 for the collection of Personal Data without the data subject's consent;
The Data Controller shall not collect Personal Data without the consent of the data subject, unless:
(1) the Data Controller has informed the data subject of the collection of Personal Data from other source without delay, but shall not exceed thirty days upon the date of such collection, and has obtained the consent from the data subject;
(2) it is a collection of Personal Data which falls within the exceptions to request consent under section 24 or section 26.
The provisions with respect to notice of the new purpose in section 21, and the notice of information details in section 23 shall apply mutatis mutandis to the collection of the Personal Data which requires consent in paragraph one, except for the following circumstances:
Any collection of Personal Data pertaining to racial, ethnic origin, political opinions, cult, religious or philosophical beliefs, sexual behavior, criminal records, health data, disability, trade union information, genetic data, biometric data, or of any data which may affect the data subject in the same manner, as prescribed by the Committee, is prohibited, without the explicit consent from the data subject, except where:
it is to prevent or suppress a danger to life, body or health of the Person, w h e r e the data subject is incapable of giving consent by whatever reason;
(1) it is information that is disclosed to the public with the explicit consent of the data subject;
The Data Controller shall not use or disclose Personal Data without the consent of the data subject, unless it is the Personal Data which is collected without requirement of consent under section 24 or section 26.
In the event that the Data Controller uses or discloses the Personal Data which is exempted from consent requirement in paragraph one, the Data Controller shall maintain a record of such use or disclosure in the record under section 39.
(2) where the consent of the data subject has been obtained, provided that the data subject has been informed of the inadequate Personal Data protection standards of the destination country or international organization;
(5) where it is to prevent or suppress a danger to the life, body, or health of the data subject or other Persons, when the data subject is incapable of giving the consent at such time; public interest.
The data subject is entitled to request access to and obtain copy of the Personal Data related to him or her, which is under the responsibility of the Data Controller, or to request the disclosure of the acquisition of the Personal Data obtained without his or her consent.
The Personal Data in paragraph one must be the Personal Data that the data subject has given consent for the collection, use, or disclosure of such Personal Data according to the rules under this Act, or the Personal Data that is exempted from consent requirements under section 24 (3), or any other Personal Data referred to under section 24 as prescribed by the Committee.
(1) Where the Personal Data is collected with the exemption to consent requirements under section 24 (4) or (5), unless the Data Controller can prove that:
(2) the data subject withdraws consent on which the collection, use, or disclosure is based on, and where the Data Controller has no legal ground for such collection, use, or disclosure;
(3) put in place the examination system for erasure or destruction of the Personal Data when the retention period ends, or when the Personal Data is irrelevant or beyond the purpose necessary for which it has been collected, or when the data subject has request to do so, or when the data subject withdraws consent, except where the retention of such Personal Data is for the purpose of freedom of expression, the purpose under section 24 (1) or (4) or section 26 (5) (a) or (b) , the purpose of the establishment, compliance or exercise of legal claims, or defense of legal claims, or the purpose of compliance with the law. The provision in section 33 paragraph five shall be used to govern the erasure or destruction of Personal Data mutatis mutandis;
After the total number of Chairperson and the honorary director in section 48 have been selected, the selection committee shall submit the name of Chairperson and the honorary director in section 48 together with the evidence of qualifications and no prohibited characteristics as well as the consent of such persons to the Committee for the appointment as the Chairperson and the honorary director according to section 48.
(4) where the written consent of such data subject has been obtained for the disclosure for such specific occasion;
Any Data Controller who fails to comply with section 23, section 30 paragraph four, section 39 paragraph one, section 41 paragraph one, or section 42 paragraph two or paragraph three, or fails to obtain consent using a form or statement set forth by the Committee under section 19 paragraph three, or fails to notify the impact of the withdrawal of consent under section 19 paragraph six, or fails to comply with section 23 which applies mutatis mutandis according to section 25 paragraph two, shall be punished with an administrative fine not exceeding Baht one million.
Any Data Controller who violates or fails to comply with section 21, section 22, section 24, section 25 paragraph one, section 27 paragraph one or two, section 28, section 32 paragraph two, or section 37, or who obtains consent by deceiving or misleading the d ata subject about the purposes, or fails to comply with section 21 which applies mutatis mutandis according to section 25 paragraph two, or fails to send or transfer the Personal Data in accordance with section 29 paragraph one or paragraph three, shall be punished with an administrative fine not exceeding Baht three million.
For Personal Data that has previously been collected by a Data Controller before the effective date o f this Act, the Data Controller shall be entitled to continue to collect and use such Personal Data for the original purposes. However, the Data Controller shall prepare and publicize a consent withdrawal method to facilitate the data subject, who does not wish the Data Controller to continue collecting and using his or her Personal Data, to notify his or her withdrawal of consent easily.
