Thailand’s Personal Data Protection Act B.E. 2562 (2019) has come into effect.

The first law in Thailand to govern data protection, the Personal Data Protection Act B.E. 2562 (PDPA) sets forth requirements and responsibilities of those who collect, control and process data including both private and public entities.

The law which was first published in the Royal Gazette in May 2019 was postponed twice due to Covid-19 but was introduced on 1 June 2022. Under the new law, anyone who wishes to collect, process or disclose personal data must first receive consent from data subjects. Subjects now have the right to object to the collection, usage or disclosure of their personal data and demand for the data to be erased.

The PDPA sets forth civil, criminal and administrative penalties for breaching the act, including fines from a few thousand baht to THB5 million and imprisonment up to six months.

While many larger companies are already adhering to many of the sections of the PDPA, data suggests that understanding and adherence is limited in especially smaller companies and community enterprises. The Bangkok Post reports that, according to a PDPA readiness survey by the Thai Board of Trade and the University of the Thai Chamber of Commerce, only 8 percent of almost 4,000 businesses interviewed said they have taken measures to be fully compliant with the law, while 31 percent indicated they have not even started the process of compliance.

A few days into the new act, the Joint Standing Committee on Commerce, Industry and Banking (JSCCIB) asked the government to delay full enforcement of the PDPA until clear directions are issued and 12 organic laws completed - a process needing 18 months to complete, according to the Bangkok Post.

As a result, Digital Economy and Society Minister Chaiwut Thanakamanusorn announced just weeks after the act went into effect that regulations aimed at relaxing the enforcement of penalties were being introduced. The regulations were focused on those who did not intentionally break the law during the transition period. Chaiwut Thanakamanusorn said that the act was not aimed at creating a burden for SMEs and community enterprises.

What the PDPA means for the sponsorship industry is yet to be seen. Chaiwut Thanakamanusorn has repeatedly said entrepreneurs who are careful in dealing with their customers' information should not be worried about penalties under the PDPA, and many companies already adhere to the European Union’s General Data Protection Regulation (GDPR), on which the PDPA is built.

“We welcome the PDPA with open arms,” says Paul Poole, Founder, Managing Director and Chairman of The Sponsorship Experts. “It’s always a good idea to have set and defined standards for best practices. It lays bare the rules of the game and gives rights holders and brands the framework for offering the best services to their audiences.”

Paul Poole (South East Asia) Co., Ltd. is an independent marketing consultancy based in Bangkok, Thailand specialising in commercial sponsorship and partnership marketing, working with both rights holders and brands - acting as a catalyst by bringing them together and maximising the relationship.

We have packaged, sold and managed sponsorship and partnership opportunities for a wide range of rights holders and worked with many of the world’s leading brands to source and engage the right sponsorships and partnerships for them to maximise.

We are committed to safeguarding your right to privacy and your personal data, please find our privacy policy?here.

Please contact us for more information: Tel./Fax:?+66 2622 0605 – 7?Email:?[email protected]

This article was first published in PP(SEA)CL's June / July 2022 newsletter.