Duty LXD-1024
Processes personal data, in Thailand
Personal Data Protection Act, comprehensive regimesince 1 line
Personal Data Protection Act B.E. 2562 (2019), Government Gazette Vol. 136, Special Issue 69 Kor, fully enforceable · Read the law's page
- An app that collects, uses, or discloses the personal data of an individual in Thailand must obtain consent by default before processing, unless a Section 24 statutory exception applies.
Personal Data Protection Act, sensitive and biometric categoriessince 1 line
Personal Data Protection Act B.E. 2562 (2019), Section 26 · Read the law's page
- An app that captures or processes a faceprint, iris scan, fingerprint, voiceprint, or other biometric identifier from an individual in Thailand must obtain that individual's explicit consent under Section 26 before processing, unless a statutory exception applies.
Personal Data Protection Act, cross-border transfersince 1 line
Personal Data Protection Act B.E. 2562 (2019), Section 28 · Read the law's page
- An app transferring the personal data of an individual in Thailand to a recipient in another country must ensure the destination has an adequate data protection standard, following the Committee's prescribed rules, unless a statutory exception such as informed consent to an inadequate destination applies.
Personal Data Protection Act, breach notificationsince 1 line
Personal Data Protection Act B.E. 2562 (2019), Section 37(4) · Read the law's page
- An app that experiences a personal data breach affecting an individual in Thailand must notify the Personal Data Protection Committee's Office without delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to pose a risk to the affected individuals; where the breach is likely to cause high risk, the app must also notify each affected individual without delay.
Personal Data Protection Act, enforcement and private right of actionsince 1 line
Personal Data Protection Act B.E. 2562 (2019), Sections 77, 78, 84-88 · Read the law's page
- An app processing the personal data of an individual in Thailand must be prepared to answer to the Personal Data Protection Committee for an administrative fine of up to Baht 5,000,000 for a serious violation, and a data subject harmed by the app's processing may separately sue for civil damages plus punitive damages up to twice the actual compensation awarded.