On 18 January 2022, a Cabinet Resolution was announced in the Royal Gazette appointing the Personal Data Protection Committee (PDPC) effective from 11 January 2022. The PDPC has the authority and duty under the Personal Data Protection Act B.E. 2562 (2019) (PDPA) to determine the details of regulations as well as establish criteria and guidance for business operators to comply with the PDPA.

This announcement follows a recent statement from the Ministry of Digital Economy and Society that there will be no further delays in the full enforcement of the PDPA, which will take place on 1 June 2022.

Therefore, all business operators who collect, use and/or disclose personal data, in particular B2C service providers, should make all necessary preparations now for the full enforcement of the PDPA in four months.

Blumenthal Richter & Sumet has a leading Data Protection practice and has provided a readiness-preparedness checklist and roadmap to compliance with the PDPA below. We have also teamed up with Prime Solution and Services Co., Ltd. to provide a one-stop service for the PDPA using PCU3ED software on:

• Data Mapping and Record of Processing Activities (RoPA)
• Consent Management
• Cookies Consent Management
• Data Subject Rights
• Data Masking with HSM
• Data Loss Prevention 

BRS has advised a number of clients on PDPA matters. Our recent highlights include advising:

the National Institute of Development Administration (NIDA), a higher education institution, on complying with the PDPA in Thailand. We are conducting trainings and workshops as well as data mapping and gap analysis. In addition, our team is advising the Data Protection Officer on compliance with the PDPA, preparing all legal document templates and further advising on appropriate software to ensure compliance with the PDPA for staff, students and third parties of NIDA

one of the world’s most well-known luxury fashion houses on Thai laws and agreements applicable to promotion campaigns to be launched in Thailand. We are also advising the client on compliance with the PDPA using sophisticated software-based data privacy tools in the provision of our services including for conducting gap analyses and preparing documentation required by law

the leading data center and cloud service provider which is a subsidiary of one of Thailand’s largest private companies on ensuring compliance with the PDPA during the data center implementation process

on gap analyses and other services under the PDPA for a financial public company providing support to SMEs; an operator of private hospitals; an eco-friendly industrial zone with infrastructure and public utilities in the Southern Economic Corridor of Thailand; a distributor public company in fashion and lifestyle products; a cosmetic surgery clinic; a water supply public company; a private not-for-profit international school in Bangkok; and a British international school.