Notifications on Personal Data Protection

On 1 June 2022, the Personal Data Protection Act B.E. 2562 (2019) ("PDPA") became fully effective after a two-year long postponement of the effective date of key operative provisions.

On 20 June 2022, four Notifications of the Personal Data Protection Committee were published in the Government Gazette, clarifying the rules for implementation of the following provisions of the PDPA:

• The Notification of the Personal Data Protection Committee Re: An Exemption from the Records of Processing Activities of the Data Controller which is a Small Business B.E. 2565 (2022);
• The Notification of the Personal Data Protection Committee Re: Criteria and Procedures in Preparing and Maintaining Records of Personal Data Processing Activities for the Data Processor B.E. 2565 (2022);
• The Notification of the Personal Data Protection Committee Re: Security Measures of the Data Controller B.E. 2565 (2022); and
• The Notification of the Personal Data Protection Committee Re: Criteria on Determining an Order to Impose an Administrative Fine of the Expert Committee B.E. 2565 (2022).

This Update provides a summary of these Notifications.