PDPA Personal Data Protection Act for Working People

The Personal Data Protection Act, or Personal Data Protection Act, is a law that protects the personal data of "natural persons", giving them the right to correct, access or delete data provided to organizations, etc., and setting out roles and responsibilities, including penalties if organizations do not comply.

What is considered “personal information”?”

• National ID card number, first name – last name
• address
• telephone number
• Email
• Financial information
• ethnicity
• Religion or Philosophy
• Sexual behavior
• Criminal history
• Health information

What rights do personal data owners have?

• Rights to receiveNotification
• RightsRequest access to dataPersonal
• The right to requestTransfer dataPersonal
• The right to requestEdit informationPersonal
• RightsObject to collectionUse or disclose personal information
• The right to requestDelete or destroyor make personal data non-identifiable
• The right to requestSuspend data usagePersonal

If you do not comply, what are the penalties?

• Civil penalties Civil penalties provide for actual compensation for damages suffered by the data subject as a result of the breach, plus an additional punitive damages of up to twice the actual damages.
• Criminal penalties Criminal penalties include both imprisonment and fines, with a maximum imprisonment of 1 year or a fine of 1 million baht, or both. If the offender is a company (legal entity), one may wonder who will be imprisoned, because the company cannot go to jail. In this case, the executives, directors, or individuals responsible for the operations of the company may be imprisoned instead.
• Administrative penalties Fines range from 1 million baht to a maximum of 5 million baht, with the maximum fine of 5 million baht being for non-compliance with the PDPA in terms of the use of, or disclosure of, or transfer of sensitive personal data abroad. This administrative penalty is separate from the compensation for damages resulting from civil and criminal penalties.

Thank you for information from: Personal Data Protection Act B.E. 2562