Personal data protection act Thailand: Exemption for SMEs
The Thai Personal Data Protection Act B.E. 2562 (PDPA) came into effect on 1 June 2022. Small businesses are exempt from implementing the data protection act. This is regulated in one of four organic acts, or “notifications”, issued by the Office for Digital Economy and Society (DES) to clarify specific issues under the PDPA. However, there are recording obligations regarding the handling of sensitive personal data.
Under the PDPA notification on the exemption from record-keeping duties of SMEs, B.E. 2565 (Exemption), which came into effect on 21 June 2022, small business operators are exempt from the enforcement of the PDPA.
The exemption applied the following entities/organisations:
- Community enterprises
- Social enterprises
- Cooperatives or a group of farmers
- Foundations, associations, non-profit organisations
- Household business
- SMEs under the Small and Medium Enterprises Promotion Act B.E. 2543:
| Type of Enterprise | Type of Business Operation | Employment / Year | Annual Income |
| Small | Manufacturing business | No more than 50 employees | Not exceeding THB 100 million |
| Service providers, wholesalers, and retailers | No more than 30 employees | Not exceeding THB 50 million | |
| Medium | Manufacturing business | More than 50, but no more than 100 employees | More than 100 million, but not exceeding THB 150 million |
| Service providers, wholesalers, and retailers | More than 30, but no more than 100 employees | More than 50 million, but not exceeding THB 300 million |
However, exempted SMEs are still required to maintain data processing records relating to sensitive personal data.
We can advise you on how to properly document the handling of sensitive personal data.Bunnasomboon Chaiparinya (Aaron), Partner, JTJB International Lawyers Co., Ltd., Bangkok, Thailand
The other notifications focused on the following:
- Duty of the personal data processor to create and maintain records of the data processing activities
- Security measures to be implemented by the data controller
For further information please contact:
Bunnasomboon Chaiparinya (Aaron), Partner, JTJB International Lawyers Co., Ltd., Bangkok, Thailand
Email: aaron@jtjb.com or chirasin@jtjb.com