No. 136 Chapter 69 Gor

Government Gazette

27 May 2019

[Official Emblem of Royal Command]
Personal Data Protection Act,
B.E. 2562 (2019)---------His Majesty King Phra Poramenthra Ramathibodi Sisin Maha Vajiralongkorn
Phra Vajira Klao Chao Yu Huaapproved the Act on 24 May 2019,the fourth year of the present reign.
His Majesty King Phra Poramenthra Ramathibodi Sisin Maha Vajiralongkorn
Phra Vajira Klao Chao Yu Huaapproved the Act on 24 May 2019,the fourth year of the present reign.
His Majesty King Phra Poramenthra Ramathibodi Sisin Maha
Vajiralongkorn Phra Vajira Klao Chao Yu Hua hereby issues a royal command to proclaim
that:
Whereas it is deemed appropriate to issue a law concerning personal dataprotection.
This Act contains certain provisions in relation to the restriction of right andfreedom of a person, which Section 26, in conjunction with Section 32, Section 33 andSection 37 of the Constitution of the Kingdom of Thailand so permit by virtue of the law.
The rationale and necessity to restrict the rights and freedom of a person inaccordance with this Act are to efficiently protect personal data and put in place effective
remedial measures for data subjects whose rights to the protection of personal data are
violated. The enactment of this Act complies with the criteria under Section 26 of theConstitution of the Kingdom of Thailand.
His Majesty hereby issues a royal command that the Act be enacted, withadvice and consent from the National Legislative Assembly acting as the parliament, as per
the following details.
Section 1 This Act is called the “Personal Data Protection Act, B.E. 2562
Section 2 This Act shall come into effect on the date following the dateof the publication in the Government Gazette, except for the provisions of
Chapter II, Chapter III, Chapter V, Chapter VI, Chapter VII, and Section 95, andSection 96, which shall come into effect after the lapse of a period of one year from1

No. 136 Chapter 69 Gor

Government Gazette

27 May 2019

the date of its publication in the Government Gazette.
Section 3 In the event that there is any sector-specific law governing theprotection of Personal Data in any manner, any business or any entity, the provisions ofsuch law shall apply, except:(1) for the provisions with respect to the collection, use, or disclosure of
Personal Data and the provisions with respect to the rights of data subjects including
relevant penalties, the provisions of this Act shall apply additionally, regardless ofwhether they are repetitious with the above specific law.

(2) for the provisions with respect to complaints, provisions gr ant ing
power to the expert committee to issue an order to protect the data subj ect, andprovisions with respect to the power and duties of the Competent Official, including
relevant penalties, the provisions of this Act shall apply in the following circumstances:(a) in the event that such law has no provision with respect to complaints;(b) in the event that such law has the provisions giving the power tothe competent official, who has the power to consider the complaints under such law, toissue an order to protect the data subject, but such power is not equal to the power of theexpert committee under this Act; and either the competent official who has power undersuch law makes a request to the expert committee, or data subject files a complaint with theexpert committee under this Act, as the case may be.
Section 4 This Act shall not apply to:(1) the collection, use, or disclosure of the Personal Data by a Person whocollects such Personal Data for personal benefit or household activity of such Person only;(2) operations of public authorities having the duties to maintain state
security, including financial security of the state or public safety, including the duties withrespect to the prevention and suppression of money laundering, forensic science or
cybersecurity;(3) a Person or a juristic person who uses or discloses Personal Data that iscollected only for the activities of mass media, fine arts, or literature, which are only inaccordance with professional ethics or for public interest;(4) The House of Representatives, the Senate, and the Parliament, including
the committee appointed by the House of Representatives, the Senate, or the Parliament,
which collect, use or disclose Personal Data in their consideration under the duties and powerof the House of Representatives, the Senate, the Parliament or their committee, as the casemay be;(5) trial and adjudication of courts and work operations of officers in legal
proceedings, legal execution, and deposit of property, including work operations inaccordance with the criminal justice procedure;(6) operations of data undertaken by a credit bureau company and its
members, according to the law governing the operations of a credit bureau business.

2

No. 136 Chapter 69 Gor

Government Gazette

27 May 2019

The exceptions to apply all or parts of the provisions of this Act to any Data
Controller in any manner, business or entity, in a similar manner to the Data Controller inparagraph one, or for any other public interest purpose, shall be promulgated in the form of theRoyal Decree.
The Data Controller under paragraph one (2) (3) (4) (5) and (6) and the Data
Controller of the entities that are exempted under the Royal Decree in accordance withparagraph two shall also put in place a security protection of Personal Data in accordance withthe standard.
Section 5 This Act applies to the collection, use or disclosure of Personal
Data by a Data Controller or a Data Processor that is in the Kingdom of Thailand, regardlessof whether such collection, use or disclosure takes place in the Kingdom of Thailand or not.
In the event that a Data Controller or a Data Processor is outside theKingdom of Thailand, this Act shall apply to the collection, use or disclosure of Personal
Data of data subjects who are in the Kingdom of Thailand, where the activities of such Data
Controller or Data Processor are the following activities:(1) the offering of goods or services to the data subjects who are in theKingdom of Thailand, irrespective of whether the payment is made by the data subject; or(2) the monitoring of the data subject’s behavior, where the behavior takes
place in the Kingdom of Thailand.
Section 6 In this Act,
“Personal Data” means any information relating to a Person, which enables
the identification of such Person, whether directly or indirectly, but not including theinformation of the deceased Persons in particular;“Data Controller ” means a P erson or a juristic person having the powerand duties to make decisions regarding the collection, use, or disclosure of the Personal Data;“Data Processor ” means a Person or a juristic person who operates inrelation to the collection, use or disclosure of the Personal Data pursuant to the orders
given by or on behalf of a Data Controller, whereby such Person or juristic person is not
the Data Controller.
“Person” means a natural person;“Committee” means the Personal Data Protection Committee;“Competent Official” means any person appointed by the Minister toperform acts under this Act;
“Office” means the Office of the Personal Data Protection Committee;“Secretary-General” means the Secretary-General of the Personal Data
Protection Committee;“Minister” means the Minister who is in charge under this Act.
Section 7 The Minister of Digital Economy and Society shall be in charge
under this Act, and shall have the power to appoint the Competent Official to perform
acts under this Act.

3

No. 136 Chapter 69 Gor

Government Gazette

27 May 2019

Chapter I
Personal Data Protection Committee--------------------------Section 8 There shall be a Personal Data Protection Committee, consisting of:(1) a Chairperson who is selected and appointed from the persons having
distinguished knowledge, skills, and experience in the field of Personal Data protection,
consumer protection, information technology and communication, social science, law, health,finance, or any other field that must be relevant to, and useful for, the protection of Personal
Data;(2) the Permanent Secretary of the Ministry of Digital Economy and Society,shall be a Vice-Chairperson;(3) directors by position as five members consisting of the Permanent
Secretary of the Prime Minister Office, the Secretary-General of the Council of State, theSecretary-General of the Consumer Protection Board, the Director-General of the Rights andLiberties Protection Department, and the Attorney General;(4) honorary directors as nine members, selected and appointed from thepersons having distinguished knowledge, skills, and experience in the field of Personal Data
protection, consumer protection, information technology and communication, social science,
law, health, finance, or any other field that must be relevant to, and useful for, the protectionof Personal Data.
The Secretary-General shall be a director and secretary, a n d theSecretary-General shall appoint assistant secretaries from the officials of the Office notexceeding two persons.
The rules and procedures on the selection of persons to be appointed as
Chairperson and honorary directors, including the selection of the Chairperson and honorary
director to replace the Chairperson and the honorary director who vacates office before theexpiration of the term under Section 13, shall be as prescribed by the notification issued by the
Cabinet by taking into account the transparency and fairness in the selection.
Section 9 There shall be a selection committee of eight members having theduty to select the appropriate persons who should be appointed as the Chairperson in Section
8(1) or the honorary director in Section 8(4), consisting of:(1) two persons appointed by the Prime Minister;(2) two persons appointed by the President of the Parliament;(3) two persons appointed by the Ombudsman; and4

No. 136 Chapter 69 Gor

Government Gazette

27 May 2019(4) two persons appointed by the National Human Rights Commission.
In the event that the person having the appointment power in (2), (3), or (4)is unable to appoint members of the selection committee in his part within forty- five days fromthe date of notice from the Office, the Office shall nominate the persons to the Prime
Minister to consider and appoint the appropriate persons to be the selection committee on
behalf of such person having the appointment power.
The selection committee shall select one member to act as the
Chairperson of the selection committee and another one member to act as the Secretary of
the selection committee a n d the Office shall perform the duty as the administrative unitof the selection committee.
In the event that any member of the selection committee is vacant, a newmember must be selected to replace such vacancy without delay. During the time that no
new member has been selected, the selection committee shall consist of the existing members.
No member of the section committee shall be entitled to be nominated as the
Chairperson in Section 8(1) or the honorary director in Section 8(4).
Section 10 In selecting the Chairperson in Section 8(1) or the honorary director
in Section 8(4), the selection committee shall select the persons who have qualifications in
Section 8(1) or Section 8(4) as the case may be, including having the qualifications and noprohibited characteristics under Section 11 and agree to be nominated for the selection in
the same number a s t h e n u m b e r o f Chairperson to be appointed in Section 8(1)or the number of the honorary director in to be appointed in Section 8(4).
After the total number of Chairperson in Section 8(1) or the honorary
director in Section 8(4) have been selected, the selection committee shall submit the nameof Chairperson in Section 8(1) or the honorary director in Section 8(4) together with theevidence of qualifications and no prohibited characteristics as well as the consent of such
persons to the Cabinet for the appointment as the Chairperson in Section 8(1) or the honorary
director in Section 8(4).
The Prime Minister shall publish names of the Chairperson in Section 8(1) orhonorary directors in Section 8(4) who are appointed by the Cabinet in the Government
Gazette.
Section 11 The Chairperson and the honorary director shall have thequalifications, and shall not be under the following prohibited characteristics:(1) being of Thai nationality;(2) not being bankrupt, or having been dishonestly bankrupt;(3) not being an incompetent or quasi-incompetent person;(4) not having been subjected to a final judgment to imprisonment5No. 136 Chapter 69 Gor

Government Gazette

27 May 2019

regardless of whether he or she has actually been imprisoned or not, except for an offence
committed by negligence or a misdemeanor;(5) not having been fired, dismissed or discharged from official service, agovernment agency or a state enterprise or private agency on the grounds of dishonest
performance of duties or having committed severe wrongful conducts;(6) not having been removed from office according to the law;(7) not being a person holding political position, a member of local
assembly or i n a management position of local administration, a director or person holding
position responsible for the management of political party, an adviser or officer of politicalparty.
Section 12 The Chairperson and the honorary director shall hold office for aterm of four years.
Upon the expiration of the term of office under paragraph one, if a new
Chairperson or t h e honorary director has not yet been appointed, the Chairperson or thehonorary director whose term of office has expired, shall be in office to continue toperform his or her duties until a new Chairperson or honorary director assumes his or her
duties.
The Chairperson, or the honorary director, who vacates office upon the
expiration of the term, may be reappointed, but shall not seat in his or her office for more than
two terms.
Section 13 In addition to vacating office upon the expiration of the term
under Section 12, the Chairperson and the honorary director vacates office upon:(1) death;(2) resignation;(3) being dismissed by the Cabinet due to negligence in the performanceof duty, disgraceful behavior, or incapability; or(4) being disqualified, or under any of the prohibited characteristics under
section 11.
In the case where the Chairperson or t h e honorary director vacates office
before the expiration of the term, the person appointed to replace the vacant office shall be in
office for the remaining term of office of the such vacated Chairperson or honorary
director, except where the remaining term of office is less than ninety days, in which casethe appointment of a new Chairperson or a new honorary director may not have to be made.
In the case where the Chairperson or the honorary director vacates office
before the expiration of the term, the Committee shall consist of all existing members
until a new Chairperson or a new honorary director is appointed, according to paragraph6No. 136 Chapter 69 Gor

Government Gazette

27 May 2019

two, and in the case where the Chairperson vacates office before the expiration of theterm, the Vice-Chairperson shall temporarily perform duties of the Chairperson.
Section 14 At a meeting of the Committee, the presence of not less than onehalf of all the members is required to constitute a quorum.
The Chairperson shall preside over the meeting. In the case where the
Chairperson does not attend the meeting, or is unable to perform the duties, the ViceChairperson shall act as a chairperson of the meeting. In the case where the Chairperson andthe Vice-Chairperson do no attend the meeting, or are unable to perform the duties, theattending members shall elect one member among themselves to be the chairperson of themeeting.
A decision of the meeting shall be made by a majority of votes. Each member
shall have one vote. In case of equal votes, the chairperson of the meeting shall have anadditional vote as the decisive vote.
The meetings of the Committee may be may be undertaken by electronicmeans, or any other means, as prescribed by the Committee.
Section 15 Any member who has a direct or indirect interest in the matterbeing considered in the meeting, shall inform the Committee of such interest prior to themeeting, and such member shall be prohibited from attending the meeting that is consideringsuch matter.

Section 16 The Committee shall have the following duties and power:(1) to make the master plan on the operation for the promotion and protection of
Personal Data, which are coherent with national policies, n a t i o n a l strategies andr e l e v a n t n a t i o n a l plans, in order to propose to the committee of the national digital
economy and society, in accordance with the law governing development of the digital
economy and society;(2) to promote and support government agencies and the private sector incarrying out of activities in accordance with the master plan under (1), as well as toconduct the evaluation of the operation result of such master plan;(3) to determine measures or guidelines of the operation in relation to
Personal Data protection in order to comply with this Act;(4) to issue notifications or rules for the execution of this Act;(5) to announce and establish criteria for providing protection of Personal
Data which is sent or transferred to a foreign country;(6) to announce and establish guidance for the protection of Personal Data as
guidelines with which the Data Controller and the Data Processor shall comply;(7) to recommend the Cabinet on the enactment, or revision, of the7No. 136 Chapter 69 Gor

Government Gazette

27 May 2019e x i s t i n g laws or rules applicable to the protection of Personal Data;(8) to recommend the Cabinet on the enactment of the Royal Decree orreconsideration the suitability of this Act at least every five years;(9) to provide advice or consultancy on any operation for the protection of
Personal Data of the government agency and private agency, in acting in compliance with thisAct;(10) to interpret and render rulings with respect to the issues arisingfrom the enforcement of this Act;
(11) to promote and support learning skills and understanding on theprotection of Personal Data among the public;(12) to promote and support research for the development of technology
relating to the protection of Personal Data;(13) to perform any other acts as prescribed by this Act, or other laws,
which state the duties and power of the Committee.
Section 17 The Chairperson, the Vice-Chairperson, and Committee shallreceive a meeting allowance and other benefits in accordance with the rules prescribed by the
Cabinet.
The Chairperson of the sub-committees, the sub-committees, the Chairpersonof the expert committee and expert committee appointed by the Committee shall receive ameeting allowance and other benefits in accordance with the rules prescribed by theCommittee with approval of the Ministry of Finance.
Section 18 The Committee shall have the power to appoint sub-committees
for considering or performing any act as prescribed by the Committee;
In the meeting of the sub-committee, the substances of Sections 14 and 15 shallapply mutatis mutandis.
Chapter II
Personal Data Protection--------------------------Part 1 General Provisions---------------------------Section 19 The Data Controller shall not collect, use, or disclose Personal
Data, unless the data subject has given consent prior to or at the time of such collection, use, ordisclosure, except the case where it is permitted to do so by the provisions of this Act or any
other laws.

8No. 136 Chapter 69 Gor

Government Gazette

27 May 2019

A request for consent shall be explicitly made in a written statement, or via
electronic means, unless it cannot be done by its nature.
In requesting consent from the data subject, the Personal Data Controller
shall also inform the purpose of the collection, use, or disclosure of the Personal Data. Such
request for consent shall be presented in a manner which is clearly distinguishable from theother matters, in an easily accessible and intelligible form and statements, using clear and plain
language, and does not deceptive or misleading to the data subject in respect to such purpose.
In this regard, the Committee may require the Data Controller to request for data subject's
consent in accordance with the form and statements as prescribed by the Committee.
In requesting consent from the data subject, the Data Controller shall utmost
take into account that the data subject's consent is freely given. Also, the entering into thecontract, including any provisions of the service shall not be a condition to obtaining consent
for the collection, use, or disclosure of Personal Data that is not necessary or not related tosuch contract entering, including the provisions of the service.
The data subject may withdraw his or her consent at any time. The withdrawalof consent shall be as easy as to giving consent, unless there is a restriction of the withdrawalof consent by law, or the contract which gives benefits to the data subject. However, thewithdrawal of consent shall not affect the collection, use, or disclosure of personal data thatthe data subject has already given consent legally under this Chapter.
In the event that the withdrawal of consent will affect the data subject in any
manner, the Data Controller shall inform the data subject of such consequences o f
c o n s e n t ' s withdrawal.
The request for the data subject’s consent which is not in accordance withthose prescribed in this Chapter shall have no binding effect on the data subject and shall nolonger enable the Data Controller to collect, use, or disclose the Personal Data.
Section 20 In the event that the data subject is a minor who is not sui juris bymarriage or has no capacity as a sui juris person under Section 27 of the Civil andCommercial Code, the request for the consent from such data subject shall be made as follows:(1) In the event that the minor’s giving of consent is not any act which theminor may be entitled to act alone as prescribed under Section 22, Section 23, or Section
24 of the Civil a n d Commercial Code, such act also requires consent of the holder ofparental responsibility over the child.

(2) Where the minor is below the age of ten years, the consent shall beobtained from the holder of parental responsibility over the child.
In the event that the data subject is incompetent, the consent must be obtained
from the custodian who has the power to act on behalf of the incompetent person.
In the event that the data subject is quasi-incompetent, the consent must be
obtained from the curator who has the power to act on behalf of the quasi-incompetent person.
The provisions of paragraphs one, two and three shall apply mutatis

9No. 136 Chapter 69 Gor

Government Gazette

27 May 2019

mutandis to the withdrawal of consent of the data subject, the notice given to the data
subject, the exercise of rights of the data subject, the complaint of the data subject, and anyother acts under this Act for the data subject who is a minor, a n incompetent or quasiincompetent person.
Section 21 The Data Controller shall collect, use, or disclose Personal Dataaccording to the purpose notified to the data subject prior to or at the time of such collection.
The collection, use, or disclosure of Personal Data shall not be conducted in amanner that is different from the purpose previously notified to the data subject in accordancewith paragraph one, unless:(1) the data subject has been informed of such new purpose, and the consent isobtained prior to the time of collection, use, or disclosure; or(2) it can be done by the provisions of this Act or in other laws.
Part 2
Personal Data Collection--------------------------Section 22 The collection of Personal Data shall be limited to the extent
necessary in relation to the lawful purpose of the Data Controller.
Section 23 In collecting the Personal Data, the Data Controller shall inform thedata subject, prior to or at the time of such collection, of the following details, except the casewhere the data subject already knows of such details:(1) the purpose of the collection for use or disclosure of the Personal Data,
including the purpose which is permitted under Section 24 for the collection of Personal Data
without the data subject's consent;(2) notification of the case where the data subject must provide his or her
Personal Data for compliance with a legal obligation, or for the performance of the contract, or
where it is necessary to provide the Personal Data for the purpose of entering into the contract,
including notification of the possible effect where the data subject does not provide such
Personal Data.
(3) the Personal Data to be collected and the period for which the Personal
Data will be retained. If it is not possible to specify the retention period, the expected dataretention period according the data retention standard shall be specified;(4) the categories of Persons or entities to whom the collected Personal Data
may be disclosed;(5) information, address and the contact channel details of the Data
Controller, where applicable, of the Data Controller's representative or data protection officer;
and10No. 136 Chapter 69 Gor

Government Gazette

27 May 2019(6) the rights of the data subject under Section 19 paragraph five, Section 30
paragraph one, Section 31 paragraph one, Section 32 paragraph one, Section 33 paragraph one,
Section 34 paragraph one, Section 36 paragraph one, and Section 73 paragraph one.
Section 24 The Data Controller shall not collect Personal Data without theconsent of the data subject, unless:(1) it is for the achievement of the purpose relating to the preparation of thehistorical documents or the archives for public interest, or for the purpose relating to researchor statistics, in which the suitable measures to safeguard the data subject's rights and freedoms
are put in place and in accordance with the notification as prescribed by the Committee;(2) it is for preventing or suppressing a danger to a Person’s life, body orhealth;(3) it is necessary for the performance of a contract to which the data subject isa party, or in order to take steps at the request of the data subject prior to entering into acontract;(4) it is necessary for the performance of a task carried out in the public
interest by the Data Controller, or it is necessary for the exercising of official authority vested
in the Data Controller;(5) it is necessary for legitimate interests of the Data Controller or any other
Persons or juristic persons other than the Data Controller, except where such interests areoverridden by the fundamental rights of the data subject of his or her Personal Data; or(6) it is necessary for compliance with a law to which the Data Controller issubjected.
Section 25 The Data Controller shall not collect Personal Data from anyother source, apart from the data subject directly, except where:(1) the Data Controller has informed the data subject of the collection of
Personal Data from other source without delay, but shall not exceed thirty days upon thedate of such collection, and has obtained the consent from the data subject; or(2) it is a collection of Personal Data which falls within the exceptions torequest consent under section 24 or Section 26.
The provisions with respect to notice of the new purpose in Section 21, andthe notice of information details in Section 23 shall apply mutatis mutandis to the collection of
the Personal Data which requires consent in paragraph one, except for the following
circumstances:(1) the data subject has been aware of such new purposes or details;(2) the Data Controller can prove that the notice of such new purposes orinformation details is impossible or will obstruct the use or disclosure of the Personal Data, in

11

No. 136 Chapter 69 Gor

Government Gazette

27 May 2019

particular for achieving the purposes in relation to scientific, historical, or statistical research
purposes. In such cases, the Data Controller shall take suitable measures to protect the data
subject 's rights, freedoms and interests;(3) the use or disclosure of the Personal Data sh al l be c ar r i e d out onan urgent basis as required by law, and suitable measures have been implemented toprotect the data subject's interest; or(4) the Data Controller is aware of or acquires such Personal Data from his or
her duty or occupation or profession, and shall maintain the confidentiality of any of the new
purposes or information details as prescribed in Section 23 as required by law.
To notify the information details in paragraph two, the Data Controller shallprovide such information to the data subject within thirty days after the date of collection suchof Personal Data, unless the Personal Data are to be used for communication with the data
subject, the notice of information details shall be provided at the time of the firstcommunication to that data subject. If a disclosure to another Person is envisaged, the noticeof information details shall be provided prior to the time of the first disclosure.
Section 26 Any collection of Personal Data pertaining to racial, ethnic origin,political opinions, cult, religious or philosophical beliefs, sexual behavior, criminal records,
health data, disability, trade union information, genetic data, biometric data, or of any data
which may affect the data subject in the same manner, as prescribed by the Committee, isprohibited, without the explicit consent from the data subject, except where:(1) it is to prevent or suppress a danger to life, body or health of the
Person, w h e r e the data subject is incapable of giving consent by whatever reason;(2) it is carried out in the course of legitimate activities with appropriate
safeguards by the foundations, associations or any other not-for-profit bodies with a political,
religious, philosophical, or trade union purposes for their members, former members of thebodies, or persons having regular contact with such foundations, associations or not-for-profit
bodies in connection with their purposes, without disclosing the Personal Data outside ofsuch foundations, associations or not-for-profit bodies;(3) it is information that is disclosed to the public with the explicit consent
of the data subject;(4) it is necessary for the establishment, compliance, exercise or defense oflegal claims;(5) it is necessary for compliance with a legal obligation to achieve thepurposes with respect to:(a) preventive medicine or occupational medicine, the assessment ofworking capacity of the employee, medical diagnosis, the provision of health or social care,
medical treatment, the management of health or social care systems and services. In the eventthat it is not for compliance with the legal obligation, and such Personal Data is under the
responsibility of the occupational or profession practitioner or person having the duty to

12No. 136 Chapter 69 Gor

Government Gazette

27 May 2019

keep such Personal Data as confidential under the law, it must be for compliance with thecontract between the data subject and the medical practitioner;(b) public interest in public health, such as protecting against crossborder dangerous contagious disease or epidemics which may be contagious or pestilent, or
ensuring standards or quality of medicines, medicinal products or medical devices, on the basisthat there is a provision of suitable and specific measures to safeguard the rights and freedom of
the data subject, in particular maintaining the secrecy of Personal Data in accordance with theduties or professional ethics;(c) employment protection, social security, national health security,social health welfare of the entitled person by law, the road accident victims protection, or
social protection in which the collection of Personal Data is necessary for e xercising therights or carrying out the obligations of the Data Controller or the data subject, and thesuitable measures have been provided to protect the fundamental rights and interest of the data
subject;(d) it is for the scientific, historical, or statistic research purposes, or otherpublic interests which must be carried out only to the extent necessary to achieve such
purposes, and the suitable measures have been provided to protect the fundamental rights
and interest of the data subject as prescribed by the Committee; or(e) the substantial public interest, and the suitable measures have been
provided to protect the fundamental rights and interest of the data subject.
The biometric data in paragraph one shall mean the Personal Data arising fromthe use of technics or technology related to the physical or behavioral dominance of Person,
which can be used to identify such Person apart from other Persons, such as the facialrecognition data, iris recognition data or fingerprint recognition data.
In the case of the collection of the Personal Data relating to criminal record,such collection shall be carried out under the control of authorized official authority under thelaw, or the data protection measure has been implemented according to rules prescribed by theCommittee.

Part 3Use or Disclosure of Personal Data--------------------------Section 27 The Data Controller shall not use or disclose Personal Data
without the consent of the data subject, unless it is the Personal Data which is collectedwithout requirement of consent under Section 24 or Section 26.
The Person or juristic person who obtains Personal Data as a result of thedisclosure under paragraph one shall not use or disclose such Personal Data for any purpose

13No. 136 Chapter 69 Gor

Government Gazette

27 May 2019other than the purpose previously notified to the Data Controller in the request to obtain such
Personal Data.
In the event that the Data Controller uses or discloses the Personal Data whichis exempted from consent requirement in paragraph one, the Data Controller shall maintain arecord of such use or disclosure in the record under Section 39.
Section 28 In the event that the Data Controller sends or transfers the Personal
Data to a foreign country, the destination country or international organization that receives
such Personal Data shall have adequate data protection standard, and shall be carried out inaccordance with the rules for the protection of Personal Data as prescribed by the Committee
in Section 16(5), except in the following circumstances:(1) where it is for compliance with the law;(2) where the consent of the data subject has been obtained, provided that thedata subject has been informed of the inadequate Personal Data protection standards of thedestination country or international organization;(3) where it is necessary for the performance of a contract to which the data
subject is a party, or in order to take steps at the request of the data subject prior to entering into
a contract;(4) where it is for compliance with a contract between the Data Controller, andother Persons or juristic persons for the interests of the data subject;(5) where it is to prevent or suppress a danger to the life, body, or health of thedata subject or other Persons, when the data subject is incapable of giving the consent at suchtime; or(6) where it is necessary for carrying out the activities in relation to substantial
public interest.
In the event that there is a problem with regard to the adequacy of Personal
Data protection standards of the destination country or international organization, such problem
shall be submitted to the Committee to decide. The decision made by the Committee may bereviewed when there is a new evidence convincing that the destination country or internationalorganization that receives such Personal Data has developed adequate Personal Data protection
standards.
Section 29 In the event that the Data Controller or the Data Processor who isin the Kingdom of Thailand has put in place a Personal Data protection policy regarding thesending or transferring of Personal Data to another Data Controller or Data Processor who isin a foreign country, and is in the same affiliated business, or is in the same group ofundertakings, in order to jointly operate the business or group of undertakings. If such
Personal Data protection policy has been reviewed and certified by the Office, the sending ortransferring of Personal Data to a foreign country, which is in accordance with such reviewed
and certified Personal Data protection policy, can be carried out and shall be exempt fromcompliance with Section 28.

14

No. 136 Chapter 69 Gor

Government Gazette

27 May 2019

The Personal Data protection policy, the nature of the same affiliatedundertaking or affiliated business in order to jointly operate the undertaking or business, andthe rules and methods for the review and certification in paragraph one shall be as prescribedand announced by the Committee.
In the absent of a decision by the Committee in accordance with Section 28,
or the Personal Data protection policy referred in paragraph one, the Data Controller or the
Data Processor may send or transfer the Personal Data to a foreign country in exemption tocompliance with Section 28, if the Data Controller or the Data Processor provides suitable
protection measures which enable the enforcement of the data subject’s rights, including
effective legal remedial measures according to the rules and methods as prescribed andannounced by the Committee.
Chapter III
Rights of the Data subject--------------------------Section 30 T h e data subject is entitled to request access to and obtain acopy of the Personal Data related to him or her, which is under the responsibility of theData Controller, or to request the disclosure of the acquisition of the Personal Data obtained
without his or her consent.
The Data Controller shall perform as requested in paragraph one. The request
can be rejected only where it is permitted by law or pursuant to a court order, and such accessand obtaining a copy of the Personal Data would adversely affect the rights and freedoms ofothers.
In the case that the Data Controller rejects the requests in paragraph one, theData Controller shall record its rejection together with supporting reasons in the record asprescribed in Section 39.
When the data subject makes a request as in paragraph one, and such request
cannot be rejected based on the reasons in paragraph two, the Data Controller shall fulfill
the request without delay, but shall not exceed thirty days from the date of receiving such
request.
The Committee may prescribe rules for the access to and request to obtain acopy of the Personal Data in paragraph one, including the extension of the period underparagraph four, or other rules as appropriate.
Section 31 The data subject shall have the right to receive the Personal Data
concerning him or her from the Data Controller. The Data Controller shall arrange such
Personal Data to be in the format which is readable or commonly used by ways of
automatic tools or equipment, and can be used or disclosed by automated means. The data
subject is also entitled to:(1) request the Data Controller to send or transfer the Personal Data in suchformats to other Data Controllers if it can be done by the automatic means;15No. 136 Chapter 69 Gor

Government Gazette

27 May 2019(2) request to directly obtain the Personal Data in such formats that the Data
Controller sends or transfers to other Data Controllers, unless it is impossible to do so becauseof the technical circumstances.
The Personal Data in paragraph one must be the Personal Data that the data
subject has given consent for the collection, use, or disclosure of such Personal Dataaccording to the rules under this Act, or the Personal Data that is exempted from consent
requirements under Section 24(3), or any other Personal Data referred to under Section 24 asprescribed by the Committee.
The exercise of rights of the data subject in paragraph one shall not apply tothe sending or transferring of Personal Data by the Data Controller which is theperformance of a task carried out in the public interest, or for compliance with law, or such
exercise of rights shall not violate the rights and freedoms of others. In the event that the Data
Controller rejects the request by such reasons, the Data Controller shall make a record of suchrejection of the request together with reasons in the record as prescribed in Section 39.
Section 32 The data subject has t h e right to object the collection, use,
or disclosure of the Personal Data concerning him or her, at any time, in the following
circumstances:(1) Where the Personal Data i s collected with the exemption to consent
r e q u i r e m e n t s under Section 24(4) or (5), unless the Data Controller can prove that:(a) the collection, use, or disclosure of such Personal Data can bedemonstrated by the Data Controller that there is a compelling legitimate ground;(b) the collection, use, or disclosure of such Personal Data is carr iedout for the establishment, compliance or exercise of legal claims, or defense of legal claims;(2) the collection, use, or disclosure of such Personal Data i s for the
purpose of direct marketing; or(3) the collection, use, or disclosure of the Personal Data for the purpose ofscientific, historical or statistic research, unless it is necessary to performance of a task
carried out for reasons of public interest by the Data Controller.
In the event that the data subject exercises his or her right to object inparagraph one, the Data Controller shall no longer be able to collect, use, or disclose such
Personal Data. And the Data Controller shall immediately distinguish such personal dataclearly from the other matters at the time when the data subject gives the notice ofobjection to the Data Controller.
In the event that the Data Controller rejects the objection by the reasons in(1) (a) or (b) or (3), the Data Controller shall record such rejection of objection request
together with reasons in the record as prescribed in Section 39.
Section 33 The data subject shall have the right to request the Data Controller
to erase or destroy the Personal Data, or anonymize the Personal Data to become theanonymous data which can not identify the data subject, where the following ground applies:(1) the Personal Data is no longer necessary in relation to the purposes forwhich it was collected, used or disclosed;

16No. 136 Chapter 69 Gor

Government Gazette

27 May 2019(2) the data subject withdraws consent on which the collection, use, ordisclosure is based on, and where the Data Controller has no legal ground for such collection,use, or disclosure;(3) the data subject objects to the collection, use, or disclosure of the Personal
Data referred in Section 32(1), and the Data Controller can not reject to such request as
referred in Section 32(1) (a) or (b), or where the data subject exercise his or her right to object
as referred in Section 32(2); or(4) the Personal Data have been unlawfully collected, used, or disclosed
under this Chapter.
Paragraph one shall not apply to the extent that such Personal Data retention isnecessary for the purpose of freedom of expression, the purpose under Section 24(1) or (4) orSection 26(5)(a) or (b), the purpose of establishment, compliance or exercise of legal claims,
or defense of legal claims, or the purpose for compliance with the law.
Where the Data Controller has made the Personal Data public and is requested
to erase or destroy the Personal Data, or make the Personal Data become the anonymous data
which can not identify the data subject pursuant to paragraph one, the Data Controller shall be
responsible for the course of action, both the implementation of technology and the expenses
to fulfil the request, and inform other Data Controllers in order to obtain their responses
regarding the action to be taken to fulfil such request.
In the event that the Data Controller does not take action in accordance withparagraph one or three, the data subject shall have the right to complain to expert committee toorder the Data Controller to take such action.
The Committee may announce the rules for the erasure or destruction of
Personal Data, or anonymization of the Personal Data to become the anonymous data which
can not identify the data subject pursuant to paragraph one.
Section 34 The data subject shall have the right to request the Data Controller
to restrict the use of the Personal Data, where the following applies:(1) when the Data Controller is pending examination process in accordancewith the data subject's request pursuant to Section 36;(2) when it is the Personal Data which shall be erased or destroyed pursuant
to Section 33 (4), but the data subject requests the restriction of the use of such Personal Data
instead.

(3) when it is no longer necessary to retain such Personal Data for the
purposes of such collection, but the data subject has necessity to request for further retention
for the purposes of the establishment, compliance or exercise of legal claims, or defense oflegal claims;(4) when the Data Controller is pending verification with regard to Section 32(1), or pending examination with regard to Section 32 (3) in order to reject the objection
request made by the data subject in accordance to Section 32 paragraph three.
In the event that the Data Controller does not take action in accordance withparagraph one, the data subject shall have the right to complain to expert committee to orderthe Data Controller to take such action.

17

No. 136 Chapter 69 Gor

Government Gazette

27 May 2019

The Committee may prescribe and announce rules regarding the suspensionof use in accordance with paragraph one.
Section 35 The Data Controller shall ensure that the Personal Data remains
accurate, up-to-date, complete, and not misleading.
Section 36 In the case where the data subject requests the Data Controller
to act in compliance with Section 35, if the Data Controller does not take action regarding therequest of the data subject, the Data Controller shall record such request of the data subject
together with reasons, in the record as prescribed in Section 39.
The provisions of Section 34 paragraph two shall apply mutatis mutandis.

Section 37 The Data Controller shall have the following duties:(1) provide appropriate security measures for preventing the unauthorized or
unlawful loss, access to, use, alteration, correction or disclosure of Personal Data, and suchmeasures must be reviewed when it is necessary, or when the technology has changed in order
to efficiently maintain the appropriate security and safety. It shall also be in accordance with theminimum standard specified and announced by the Committee;(2) in the circumstance where the Personal Data is to be provided to other
Persons or legal persons, apart from the Data Controller, the Data Controller shall takeaction to prevent such person from using or disclosing such Personal Data unlawfully or withoutauthorization;(3) put in place the examination system for erasure or destruction of the
Personal Data when the retention period ends, or when the Personal Data is irrelevant or
beyond the purpose necessary for which it has been collected, or when the data subject hasrequest to do so, or when the data subject withdraws consent, except where the retention ofsuch Personal Data is for the purpose of freedom of expression, the purpose under Section
24(1) or (4) or Section 26 (5) (a) or (b) , the purpose of the establishment, compliance or
exercise of legal claims, or defense of legal claims, or the purpose of compliance with the law.
The provision in Section 33 paragraph five shall be used to govern the erasure or destructionof Personal Data mutatis mutandis.

(4) notify the Office of any Personal Data breach without delay and, where
feasible, within 72 hours after having become aware of it, unless such Personal Data breach isunlikely to result in a risk to the rights and freedoms of the Persons. If the Personal Data breachis likely to result in a high risk to the rights and freedoms of the Persons, the Data Controller
shall also notify the Personal Data breach and the remedial measures to the data subject without
delay. The notification and the exemption to the notification shall be made in accordance withthe rules and procedures set forth by the Committee.

(5) in the event of being the Data Controller pursuant to Section 5 paragraphtwo, the Data Controller shall designate in writing a representative of the Data Controller who
must be in the Kingdom of T hail and and be authorized to act on behalf of the Data
Controller without any limitation of liability with respect to the collection, use or
disclosure of the Personal Data according to the purposes of the Data Controller.

18No. 136 Chapter 69 Gor

Government Gazette

27 May 2019

Section 38 The provisions of t h e representative designation in Section
37(5) shall not apply to the following Data Controller:(1) the Data Controller which is a public authority as prescribed andannounced by the Committee,(2) the Data Controller which engages in the profession or business ofcollecting, using, or disclosing Personal Data, that does not have the nature pursuant to
Section 26, and does not have a large amount of Personal Data as prescribed by the Committee
in Section 41 (2).
In the event that the Data Controller in Section 5 paragraph two has a Data
Processor, the provisions of Section 37 (5) and the provisions in paragraph one shall apply tosuch Data Processor mutatis mutandis.
Section 39 The Data Controller shall maintain, at least, the following records
in order to enable the data subject and the Office to check upon, which can be either in a
written or electronic form:(1) the collected Personal Data;(2) the purpose of the collection of the Personal Data in each category;(3) details of the Data Controller;(4) the retention period of the Personal Data;(5) rights and methods for access to the Personal Data, including theconditions regarding the Person having the right to access the Personal Data and theconditions to access such Personal Data;(6) the use or disclosure under Section 27 paragraph three;(7) the rejection of request or objection according to Section 30 paragraphthree, Section 31 paragraph three, Section 32 paragraph three, and Section 36 paragraph one;and(8) details of the appropriate security measures pursuant to Section 37 (1).
The provisions in paragraph one shall apply to the representative of the Data
Controller under Section 5 paragraph two mutatis mutandis.
The provisions in (1) (2) (3) (4) (5) (6) and (8) may not apply to the Data
Controller who is a small organization pursuant to the rules as prescribed by the Committee,
unless the collection, use, or disclosure of such Personal Data is likely to result in a risk to therights and freedoms of data subjects, or not a business where the collection, use, or disclosureof the Personal Data is occasional, or involving in the collection, use, or disclosure of the
Personal Data pursuant to Section 26.

19

No. 136 Chapter 69 Gor

Government Gazette

27 May 2019

Section 40 The Personal Data Processor shall have the following duties:(1) carry out the activities related to the collection, use or disclosure of
Personal Data only pursuant to the instruction given by the Data Controller, except where such
instruction is contrary to the law or any provisions regarding Personal Data protection under
this Act;(2) provide appropriate security measures for preventing unauthorized orillegal loss, access to, use, alteration, correction or disclosure, of Personal Data, and notify
the Data Controller of the Personal Data breach that occurred; and(3) prepare and maintain records of personal data processing activities inaccordance with the rules and methods set forth by the Committee.
The Data Processor, who fails to comply with (1) for the collection, use, ordisclosure of the Personal Data, shall be regarded as the Data Controller for thecollection, use or disclosure of such Personal Data.
In carrying out the activities in accordance with the Data Processor's
obligations as assigned by the Data Controller under paragraph one, the Data Controller shallprepare an agreement between the parties to control the activities carried out by the Data
Processor to be in accordance with the Data Processor's obligations for compliance with thisAct.
The provisions in (3) may not apply to the Data Processor who is a smallorganization pursuant to the rules as prescribed by the Committee, unless the collection, use,
or disclosure of such Personal Data is likely to result in a risk to the rights and freedoms ofdata subjects, or not a business where the collection, use, or disclosure of the Personal Data is
occasional, or involving in the collection, use, or disclosure of the Personal Data pursuant to
Section 26.
Section 41 The Data Controller and the Data Processor shall designate a dataprotection officer in the following circumstances:(1) the Data Controller or the Data Processor is a public authority asprescribed and announced by the Committee;(2) the activities of the Data Controller or the Data Processor in thecollection, use, or disclosure of the Personal Data require a regular monitoring of the Personal
Data or the system, by the reason of having a large number of Personal Data as prescribed andannounced by the Committee; or(3) the core activity of the Data Controller or the Data Processor is thecollection, use or disclosure of the Personal Data according to Section 26.
In the event that the Data Controller or the Data Processor are in the sameaffiliated business or are in the same group of undertakings, in order to jointly operate thebusiness or group of undertakings as prescribed and announced by the Committee according to20

No. 136 Chapter 69 Gor

Government Gazette

27 May 2019

Section 29 paragraph two, such Data Controller or Data Processor may jointly designate a dataprotection officer. In this regard, each establishment of the Data Controller or the Data
Processor in the same affiliated business or in the same group of undertakings must be able toeasily contact the data protection officer.
The provisions in paragraph two shall apply to the Data Controller or the Data
Processor who is a public authority in (1) that is large in size or has several establishments
mutatis mutandis.
In the event that the Data Controller or the Data Processor in paragraph one
has to designate the representative according to Section 37 (5), the provisions in paragraph
one shall apply to the representative mutatis mutandis.
The Data Controller and the Data Processor shall have an obligation to informthe information of the data protection officer, contact address and contact channels to the data
subject and the Office. The data subject shall be able to contact the data protection officer withrespect to the collection, use or disclosure of the Personal Data and the exercise of rights ofthe data subject under this Act.
The Committee may prescribe and announce the qualifications of the dataprotection officer by taking into account the knowledge or expertise with respect to the
Personal Data protection.
The personal data protection officer may be a staff of the Data Controller or
the Data Processor, or a service provider under the contract with the Data Controller or the
Data Processor.
Section 42 The data protection officer shall have the following duties:(1) give advices to the Data Controller or the Data Processor, including theemployees or service providers of the Data Controller or of the Data Processor with respect tocompliance with this Act;(2) investigate the performance of the Data Controller or the Data Processor,
including the employees or service providers of the Data Controller or of the Data Processor
with respect to the collection, use or disclosure of the Personal Data for compliance with thisAct;(3) coordinate and cooperate with the Office in the circumstance where there
are problems with respect to the collection, use or disclosure of the Personal Data undertakenby the Data Controller or the Data Processor, including the employees or service providers of
the Data Controller or of the Data Processor with respect to the compliance with this Act; and(4) keep confidential the Personal Data known or acquired in the course of hisor her performance of duty under this Act.
The Data Controller or the Data Processor shall support the data protection
officer in performing the tasks by providing adequate tools or equipment, as well as facilitate
the access to the Personal Data in order to perform the duties.
The Data Controller or the Data Processor shall not dismiss or terminate the21No. 136 Chapter 69 Gor

Government Gazette

27 May 2019

data protection officer’s employment by the reason that the data protection officer performs hisor her duties under this Act. In the event that there is any problem when performing the duties,
the data protection officer must be able to directly report to the highest management person of
the Data Controller or the Data Processor.
The data protection officer may be able to perform other duties or tasks but
the Data Controller or the Data Processor must warrant to the Office that such duties or tasks
are not against or contrary to the performance of the duties under this Act.

Chapter IV
Office of the Personal Data Protection Committee--------------------------Section 43 There shall be an Office of the Personal Data Protection
Committee, whose objectives are to protect Personal Data, encourage and support thecountry’s development regarding Personal Data protection.
The Office shall act as a government agency, with the status of a juristic person.
The Office shall not be deemed a public sector under the law on administrative organizationof the state, or a state enterprise under the law on budget procedures or other laws.
The Office’s operation shall not be governed by the laws on labor
protection, labor relations, state enterprise labor relations, social security, andworkmen’s compensation. However, the staff and employees of the Office shall be entitled
to compensation at the rate not less than the rate stipulated by the laws on labor protection,social security, and workmen’s compensation.
The Office shall be deemed a government agency under the law on tort
liability of government official.
Section 44 In addition to the Office’s duty to carry out its operations toachieve the objectives as set out in Section 43 paragraph one, the Office shall have the duty toperform academic and administrative tasks for the Committee, the commission supervising
the Office of Personal Data Protection Committee, the expert committee, and the subcommittee. The Office shall also have the following duties and power:(1) To draft the master plan on the operation for the promotion and protectionof Personal Data, which are coherent with national policies, national strategies and relevant
national plans, and to draft the master plan and corrective measures regarding thedifficulties in carrying out such national level policies, strategies and plans in order to propose
to the Committee;(2) To promote and support the research for the development of technology
relating to the protection of Personal Data;(3) To analyze and verify the compliance with and accuracy of the standards
or measures, or t h e s u p e r v i s i o n m e c h a n i s m in connection with Personal
Data protection, as well as to review and certify the Personal Data protection policy
22No. 136 Chapter 69 Gor

Government Gazette

27 May 2019according to Section 29;(4) To conduct surveys, collect information, and follow the latest updates andtrends on Personal Data protection, as well as to conduct analysis and research on
Personal Data protection issues that affect the country’s development, to propose to theCommittee.
(5) To liaise with the public sector, state enterprises, local government
administration, public organizations, or other organizations of the country regarding Personal
Data protection;(6) To provide consultations to government a g e n c y and private agency
in acting in compliance with this Act;
(7) To act as the center to provide academic services or services related to
Personal Data protection to the government agency, private agencies, and the public, including
to promote and provide knowledge and understanding regarding Personal Data protection;(8) To establish course outlines and provide training of the performance of
the Data Controller, Data Processor, data protection officer, employees, service providers, orthe people in general;(9) To enter into agreements and cooperate with organizations or agencies
both domestic and international, in the matters relating to the Office’s operation carried out
under the Office’s duties and power, upon obtaining the approval from the Committee;(10) To follow-up on and evaluate compliance with this Act; and(11) To carry out other duties as assigned by the Committee, thecommission supervising the Office of Personal Data Protection Committee, the expert
committee, or the sub-committee, or as specified by law.
Section 45 In carrying out the Office’s operation, apart from those stipulated
under Section 44, the Office shall also have the power and duties to carry out the following:(1) To hold the title to, be in the possession of, and hold the property
right to properties;(2) To create rights or carry out all kinds of juristic acts to bind upon
properties, as well as to carry out any other juristic acts for the purpose of carrying out the
Office’s operation;(3) To provide and to give funding to support the Office’s operations;(4) To impose fees, maintenance fees, compensation, or service fees for the
Office’s operations according to the Office’s objectives, in accordance with the criteria andat the rate specified by the Office, with the approval of the commission supervising the
Office of Personal Data Protection Committee; and(5) To carry out any other acts that the law specifies to be the duties andpowers of the Office, or as assigned by the Committee, the commission supervising the Officeof Personal Data Protection Committee, the expert committee, or the sub-committee.
Section 46 The fund and properties used in the Office’s business operations
shall consist of the following:23

No. 136 Chapter 69 Gor

Government Gazette

27 May 2019(1) Initial budget provided by the government under Section 94 paragraphone;(2) General grants as reasonably provided by the government on a yearlybasis;(3) Subsidy from domestic or international government agencies, orinternational governmental organizations;(4) Fees, maintenance fees, compensation, service fees, or incomes incurredfrom the Office’s operations carried out under the Office’s duties and power;(5) Interests of funds or any other incomes obtained from properties of the
Office.
The funds and properties of the Office under paragraph one are required to besubmitted to the Ministry of Finance as public revenue.
Section 47 The immovable properties that the Office acquires by thepurchase or exchange using the Office’s revenue in Section 46(4) or (5) shall be under
the Office’s ownership.
Section 48 There shall be a commission supervising the Office of Personal
Data Protection Committee consisting of a Chairperson, who is selected and appointed
from a person having distinguished knowledge, skills and experience in Personal Data
protection, the Permanent Secretary of the Ministry of Digital Economy and Society, and theSecretary-General of Office of the National Digital Economy and Society Commission as
directors, and six honorary directors which ,at least three persons, are selected andappointed from persons having distinguished knowledge, skills and experience in Personal
Data protection; and other related areas which will be useful for the operation of the Office.
The Secretary-General shall be a director and secretary, and shall appoint
assistant secretaries from the officials of the Office not exceeding two persons.
The substances of Section 11 and Section 13 shall apply to the Chairperson
and the honorary director of the Commission mutatis mutandis.
Section 49 There shall be a selection committee of eight members, consistingof the persons appointed by the Committee, having the duty to select the appropriate persons
who should be appointed as the Chairperson and the honorary director in Section 48.
The selection committee shall select one member to act as the
Chairperson of the selection committee and another one member to act as the Secretary of
the selection committee a n d the Office shall perform the duty as the administrative unitof the selection committee.
In the event that any member of the selection committee is vacant, a newmember must be selected to replace such vacancy without delay. During the time that no
new member has been selected, the selection committee shall consist of the existing members.
No member of the Section Committee shall be entitled to be nominated as the
Chairperson and the honorary director in Section 48.
The rules and procedures of selection shall be as prescribed by the24No. 136 Chapter 69 Gor

Government Gazette

27 May 2019

Committee by taking into account the transparency and fairness in the selection.
Section 50 In selecting the Chairperson and t h e honorary director in
Section 48, the selection committee shall select the persons who have qualifications in
Section 48 paragraph one, including having the qualifications and noprohibitedcharacteristics under Section 48 paragraph three and agree to be nominated for the selectionin the same number as the number of Chairperson and t h e honorary director to beappointed in Section 48.
After the total number of Chairperson and the honorary director in Section 48
have been selected, the selection committee shall submit the name of Chairperson and thehonorary director in Section 48 together with the evidence of qualifications and noprohibited characteristics as well as the consent of such persons to the Committee for theappointment as the Chairperson and the honorary director according to Section 48.
The Committee shall publish names of the appointed Chairperson and thehonorary directors in Section 48 in the Government Gazette.
Section 51 The Chairperson and the honorary director in Section 48 shallhold office for a term of 4 years.
Upon the expiration of the term of office in paragraph one, the appointment of
the new Chairperson and the new honorary director must be done within 60 days. If the new
Chairperson or the new honorary director has not y e t been appointed, the Chairperson or
the honorary director whose term of office has expired, shall be in office to continue to perform
his or her duties until the new appointed Chairperson or the honorary director assumes his or
her duties.
The Chairperson, or the honorary director, who vacates office upon the
expiration of the term, may be reappointed, but shall not seat in his or her office for more than
2 terms.
Section 52 In the case where the Chairperson or t h e honorary director in
Section 48 vacates office before the expiration of the term, the commission supervising the
Office of Personal Data Protection Committee shall consist of all the existing members until
the new Chairperson or the new honorary director is appointed. In the case where the
Chairperson vacates office before the expiration of the term, the Permanent Secretary of the
Ministry of Digital Economy and Society shall temporarily perform the duties of the
Chairperson.
The new Chairperson and honorary director shall be appointed to replace thevacant office within 60 days from the date of the vacant office and shall be in office for theremaining office term of the replaced person. If the remaining office term of the Chairperson
and the honorary director is less than ninety days, the appointment of the new Chairperson or the
new honorary director may not have to be made.
Section 53 At a meeting of the commission supervising the Office of Personal
Data Protection Committee, the presence of not less than one-half of all the members is25

No. 136 Chapter 69 Gor

Government Gazette

27 May 2019required to constitute a quorum.
The Chairperson shall preside over the meeting. If the Chairperson does notattend the meeting, or is unable to perform the duties, the attending members shall elect one
member among themselves to be the chairperson of the meeting.
A decision of the meeting shall be made by a majority of votes. Eachmember shall have one vote. In case of equal votes, the chairperson of the meeting shall havean additional vote as the decisive vote.
Any member having an interest in the matter to be considered in the meetingshall be prohibited from attending such meeting.
The meeting of the commission supervising the Office of Personal Data
Protection Committee may be undertaken by electronic means, as prescribed by theCommittee.

Section 54 The Commission Supervising the Office of Personal Data
Protection Committee shall have the following powers and duties.

(1) To prescribe administration policy and give approval to the Office’s
operation plan;(2) To issue rules governing the organization, financial matters, humanresources administration, general administrative works, internal audit, including welfares
and support services of the Office;(3) To approve the annual operation plan, annual spending plan and annual
budget o f the Office;(4) To control the administration and operation of the Office and theSecretary-General to be in accordance with this Act and other related laws;(5) To appoint a selection committee for the selection of the SecretaryGeneral;(6) To determine any appeals against the administrative orders of theSecretary-General in the part of the Office’s administration;(7) To evaluate the result of the Office’s operation and the SecretaryGeneral’s work performance; and(8) To perform any other duties prescribed by this Act or other related laws as
the duties and power of the Commission Supervising the Office of Personal Data Protection
Committee or as assigned by the Committee or the Cabinet.
For the rules in (2), if there is a restriction of the power of the SecretaryGeneral in entering into a juristic act with a third party, it must be published in the
Government Gazette.

26No. 136 Chapter 69 Gor

Government Gazette

27 May 2019

Section 55 The commission supervising the Office of Personal Data
Protection Committee shall have the power to appoint a sub-committee to perform any
duties or act as assigned by the commission supervising the Office of Personal Data
Protection Committee.
The commission supervising the Office of Personal Data Protection
Committee may appoint persons having skills or experience that will be useful for the duties
performed by the commission supervising the Office of Personal Data Protection Committee
as its advisers.
The performance of duties and numbers of the sub-committee in paragraphone or persons in paragraph two shall be in accordance with those prescribed by thecommission supervising the Office of Personal Data Protection Committee.
For a meeting of the sub-committee, the substances of Section 53 shall apply
mutatis mutandis.

Section 56 The Chairperson and members of the commission supervising the
Office of Personal Data Protection Committee, advisers of the commission supervising the
Office of Personal Data Protection Committee, Chairperson and members of the subcommittee appointed by the commission supervising the Office of Personal Data Protection
Committee shall receive a meeting allowance or other benefits according to the rules
prescribed by the Committee with the approval of the Ministry of Finance.
Section 57 There shall be a Secretary-General who is appointed by thecommission supervising the Office of Personal Data Protection Committee and the SecretaryGeneral has the duty to administer the affairs of the Office.
The appointment of the Secretary-General in paragraph one shall be madein accordance with the rules and methods of recruitment, as prescribed by thecommission supervising the Office of Personal Data Protection Committee.
Section 58 A person to be appointed Secretary-General must have thequalifications as follows.

(1) being of Thai nationality;(2) being not lower than thirty-five years old but not over sixty years old;(3) having knowledge, skills and experience in the areas related to the missionof the Office and administration;
Section 59 Any person holding any of the following prohibiting characteristics
shall not be Secretary-General:(1) being bankrupt or having been dishonestly bankrupt;(2) being an incompetent or quasi-incompetent person;

27

No. 136 Chapter 69 Gor

Government Gazette

27 May 2019(3) having been subject to a final judgement to imprisonment, regardless ofwhether he or she has actually been imprisoned or not, except for an offence committed by
negligence or a misdemeanor;(4) being a civil official, staff, or employee of government agency, or state
enterprise, or other governmental organization, or local official agency;(5) being or having been an official politician, a person holding political
position, a member of the local assembly, or in a management position of local administration,
unless having been discharged from his or her office of not less than one year;(6) being or having been a director, or other political position in a politicalparty, or an officer of the political party, unless having been discharged from his or her officeof not less than one year;(7) having been fired, dismissed, or discharged from an official service ongrounds of dishonest performance of duties or having committed severe wrongful acts, or
removed from his or her office;(8) having been discharged on grounds of not passing the performance
evaluation in accordance with Section 62(4); and(9) being a direct or indirect stake person in the Office's related business.
Section 60 The Secretary-General shall hold office for each term of four years
and may be reappointed. However, the Secretary-General shall not hold office more than
two terms.
Not less than thirty days but not over sixty days before the end of the officeterm of the Secretary-General or within sixty days from the date that the Secretary-Generalvacates office before the end of the office term, the commission supervising the Office of
Personal Data Protection Committee shall appoint a selection committee to select a new
Secretary-General. The selection committee shall nominate not more than three appropriate
persons to the commission supervising the Office of Personal Data Protection Committee.
Section 61 In each year, the performance of the Secretary-General shall be
evaluated in accordance with the period and method prescribed by the commission supervising
the Office of Personal Data Protection Committee.
Section 62 In addition to vacating office upon the expiration of the term in
Section 60, the Secretary-General shall vacate office upon:(1) death;(2) resignation;(3) being disqualified under Section 58, or under any of the prohibitedcharacteristics under Section 59; or(4) being dismissed by the commission supervising the Office of Personal
Data Protection Committee due to failure to pass the performance evaluation, disgraceful28No. 136 Chapter 69 Gor

Government Gazette

27 May 2019behavior, negligence or dishonesty in the performance of duties, or incapability.
Section 63 The Secretary-General shall have the following duties and power.

(1) To manage the works of the Office for the achievements according
to the Office’s missions and in accordance with the national policies and plans, strategicplans, policy of the Cabinet, of the Committee and of the commission supervising the
Office of Personal Data Protection Committee and according to the rules, regulations or
resolutions of the commission supervising the Office of Personal Data Protection Committee;(2) To establish regulations with respect to the operations of the Office
which are not contrary to or against the laws, the Cabinet resolutions and the regulations,rules, requirements, policies, resolutions or notifications prescribed by the commission
supervising the Office of Personal Data Protection Committee;(3) To act as the supervisor of the staffs and employees of the Office andto evaluate the performance of the staffs and employees of the Office according to the Office’s
rules or regulations.

(4) To appoint the Deputy Secretary-General and the Assistant SecretaryGeneral by the approval of the commission supervising the Office of Personal Data Protection
Committee in order to act as the Secretary-General’s assistant as assigned by the SecretaryGeneral;(5) To recruit, appoint, promote, decrease or deduct the salary of, and to
take disciplinary action against the staffs and employees of the Office, as well as to dismiss
the staffs and employees of the Office according to the rules or regulations of thecommission supervising the Office of Personal Data Protection Committee;(6) To perform any act according to the regulations, rules, requirements,
policies, resolutions or notifications prescribed by the Commission Supervising the Officeof Personal Data Protection Committee.
The Secretary-General shall be responsible for the administration of the Officeand shall directly report to the commission supervising the Office of Personal Data
Protection Committee.
Section 64 In the Office’s affairs related to the third party, the SecretaryGeneral shall act as the Office’s representative. In this connection, the Secretary-General may
grant the power to any person to perform any specific work on his or her behalf
according to the rules prescribed by the commission supervising the Office of Personal Data
Protection Committee.
Section 65 The commission supervising the Office of Personal Data
Protection Committee shall be responsible for determining salary rate and other benefits of theSecretary-General according to the rules prescribed by the Cabinet.
Section 66 In the interests of administration of the Office, the Secretary-29

No. 136 Chapter 69 Gor

Government Gazette

27 May 2019

General may request a civil official, staff, officer, or employee of a public sector,
government agency, state enterprise, c i v i l local administration, public organization orother government agencies to work as its t e m p o r a r y staff or employee , p r o v i d e dt h a t t h e approval is obtained from his o r h e r supervisor or employer with anagreement made at the time of such approval. In the event that a government official isapproved to work as a temporary staff or employee, it shall be deemed that such person ispermitted to leave the original official service or employment to perform any work.
Upon the end of the term approved to work for the Office, the government
official in paragraph one shall be entitled to return and be appointed to be in office and toreceive the salary in the original official service or work unit not lower than the original levelof position and salary according to the agreement made at the time of the approval.
In the event that such government official has returned and been appointed towork in the original official service or work unit in paragraph two, the period that suchgovernment official worked for the Office shall be counted as full time working in suchoriginal official service or work unit, as the case may be, for the purpose of calculating pension
or other benefits of the same nature.
Section 67 For the civil official or government official who is working incompensation for the scholarship granted to him or her by a public sector, or government
agency and is transferred to work at the Office by the approval of his or her supervisor of theoriginal public sector or government agency, it shall be deemed that working in the Office has
reimbursed the compensation under the scholarship contract and the work period with the
Office shall be counted as a time period of compensation for the scholarship.
In the event that any government agency makes a request that the Office’s
officer who is working in compensation for the scholarship granted to him or her by the
Office to be a civil official or government official in such government agency, such
request must be approved by the Secretary-General first and it shall be deemed thatworking in such government agency h a s r e i m b u r s e d t h e compensation
under the scholarship contract and the work period with such government agency shallbe counted as the time period of compensation for the scholarship.
Section 68 Accounting of the Office shall be made in accordance withinternational standards according to the forms and rules prescribed by the commission
supervising the Office of Personal Data Protection Committee.
Section 69 The Office shall prepare financial statements and accounting
statements and send them to the auditor within one hundred and twenty days from the date of
the fiscal year-end.
The Government Audit Office or a certified public accountant approved by
the Government Audit Office shall be the Office’s auditor and shall evaluate the Office’s
expenditures and property on an annual basis and report the auditing results to the commission
supervising the Office of Personal Data Protection Committee for certification.
Section 70 The Office shall prepare an annual operation report and submit to
the commission supervising the Office of Personal Data Protection Committee and theMinister within one hundred and eighty days from the date of the fiscal year-end and shall30

No. 136 Chapter 69 Gor

Government Gazette

27 May 2019disseminate this report to the public.
The annual operation report in paragraph one must display the details of thebalance sheet which has been given an opinion by the auditor, as well as the Office’sachievement and evaluation report of the Office’s performance in the preceding year.
The evaluation of the Office’s performance under paragraph two must be
undertaken by a third party approved by the commission supervising the Office of Personal
Data Protection Committee.

Chapter V
Complaints-----------------------------------Section 71 The Committee shall appoint one or more expert committees based
upon their field of expertise, or as the Committee deems fit.
The qualifications and prohibitions, term of office, vacation from office,and other operations of the expert committee shall be in accordance with the Committee’s
notification.
Section 72 The expert committee shall have the following duties and power:(1) Consider complaints under this Act;
(2) Investigate any act of the Data Controller or the Data Processor,
including the employees or the contractors of the Data Controller or the Data Processor inconnection with the Personal Data that causes damage to the Data subject;(3) Settle disputes in connection with Personal Data; and(4) Carry out any other acts which are stipulated as the expert committee’s
duty and power under this Act or as assigned by the Committee.
Section 73 The Data subject has the right to file a complaint in the eventthat the Data Controller or the Data Processor, including the employees or the s e r v i c e
p r o v i d e r s of the Data Controller or the Data Processor violates or does not comply withthis Act, or notifications issued in accordance with this Act.
The filing, refusal of acceptance, dismissal, consideration and timeframe forthe consideration of the complaints shall be in accordance with the Committee’s rule by taking
into account the refusal of acceptance of the complaints or dismissal of the matter in the eventthat there has been the authority to consider such matter under other laws.
Section 74 In the event that a complainant does not comply with the rules
provided in Section 73 paragraph two, or the complaint filed is prohibited from being

31No. 136 Chapter 69 Gor

Government Gazette

27 May 2019

accepted f o r c o n s i d e r a t i o n under such rules, the expert committee shall not accept
such complaint for consideration.
If, after the expert committee’s consideration of the complaint pursuant to
Section 72 (1), or the investigation of any act pursuant to Section 72 (2), it is found thatsuch complaint or act has no ground, the expert committee shall issue an order to dismiss
such complaint or investigation.
If, after the expert committee’s consideration or investigation under paragraphtwo, it is found that such complaint or act can be settled, and the concerned parties arewilling to settle the dispute, the expert committee shall proceed with the dispute settlement.
However, if such complaint or act cannot be settled, or the dispute settlement fails, theexpert committee shall have the power to issue the following orders:(1) for the Data Controller or the Data Processor to perform, or rectify theiract within the specified period of time; or(2) to prohibit the Data Controller or the Data Processor from carrying out
an act which causes damage to the Data subject, or for the Data Controller to carry out any act
to cease the damage within the specified period of time;
In the event that the Data Controller or the Data Processor does not comply
with the orders provided under paragraph three (1) or (2), the provisions in connection withadministrative enforcement under the law on administrative procedure shall be appliedmutatis mutandis. In the event that the properties of the Data Controller or the Data Processor are
to be seized, attached, or sold by auction, as required by the law on administrative
procedure, the expert committee shall have the power to order such seizure, attachment, andsale by auction for such purpose.
The issuance of the order under paragraph one, two, or three (1) or (2)shall be in accordance with the criteria and methods under the Committee’s notification.
The orders of the expert committee shall be signed by the Chairperson of
the expert committee.
The order of the expert committee in this Section shall be final.
In order to proceed in accordance with this Section, when the consideration
result is issued, the expert committee shall inform the complainant of such result together withthe reasons. In case that the complaint is not accepted for consideration or dismissed as suchcomplaint has already been under consideration of an official authority under other laws, theexpert committee shall inform the complainant of the same. If the complainant wishes topropose such matter to the official authority under other laws, the expert committee shallproceed to do so and shall be deemed that such official authority has received such complaint
from the date when the expert committee has received such complaint.
Section 75 The expert committee shall have the power to order any person tosubmit documents or information in connection with the subject matter of a complaint, or
any other matter related to the protection of the Personal Data under this Act. The expert
committee shall also have the power to request any person to make a statement of facts.

32

No. 136 Chapter 69 Gor

Government Gazette

27 May 2019

Section 76 In order to act in accordance with this Act, the Competent
Officer shall have the following duties and power:(1) Request the Data Controller, the Data Processor, or any person inwriting, to provide information or submit any documents or evidence in connection with theactions or offenses under this Act;
(2) Investigate and collect facts, and report to the expert committee in theevent that the Data Controller, the Data Processor, or any person, has committed an offense
or caused damage due to their violation of or non-compliance with this Act or notifications
issued in accordance with this Act.
In carrying out the duty in (2), if there is a necessity to protect the benefitsof the Data subject or for public's interest, the Competent Officer shall file a compliant to thecompetent court to issue an order granting permission to the Competent Officer to enter thepremises of the Data Controller, or any person involved in the offense under this Act,
during the interval between sunrise and sunset or during the business hours of such premises,
to investigate and collect facts, seize, or attach documents, evidence, or any other items related
to the offense, or which has a cause to believe that they are used to commit such offense.
In order to appoint the Competent Officer, the Minister shall consider
appointing such person from the civil officials or other government officials whose position is
not lower than a civil official at the operational level or equivalent, and having thequalifications in accordance with the notification issued by the Committee.
During the performance of his or her duties under this Section, the Competent
Officer shall present his or her identification card to the relevant persons and be provided withreasonable facilitation by the relevant persons.
The identification card of the Competent Officer shall be in accordance withthe form required by the notification of the Committee.

Chapter VI
Civil Liability--------------------------Section 77 The Data Controller or the Data Processor, whose operation in
relation to Personal Data violates or fails to comply with the provisions of this Act whichcauses damages to the Data subject, shall compensate the Data subject for such damages,
regardless of whether such operation is performed intentionally or negligently, except
where the Data Controller or the Data Processor can prove that such operation was a result of:(1) a force majeure, or the Data subject’s own act or omission to act;(2) an action taken in compliance with an order of a government official
exercising its duties and power under the law;33

No. 136 Chapter 69 Gor

Government Gazette

27 May 2019

The compensation under paragraph one includes all necessary expenses
incurred by the Data subject for the prevention of the damages likely to occur, or which wasspent to suppress the damages occurred.
Section 78 The court shall have the power to order the Data Controller or the
Data Processor to pay punitive damages in addition to the actual compensation rendered by
the court as deems fit, but shall not exceeding 2 times of such actual compensation amount,by taking into account the relating circumstances such as the severity of damages incurred by
the Data subject, the interest obtained by the Data Controller or the Data Processor, thefinancial status of the Data Controller or the Data Processor, remedy provided by the Data
Controller or the Data Processor, or the Data subject’s act in contributing to cause thedamages.
The claim for compensation from the wrongful act against the Personal Data
under this Act shall be barred by prescription after the lapse of 3 years from the date thatthe injured person know of the damages and the identity of the Data Controller or the Data
Processor who is to be liable, or after 10 years from the date of which the wrongful act
against the Personal Data took place.

Chapter VII
Penalties--------------------------Part I
Criminal Liability----------------------------Section 79 Any Data Controller who violates the provisions under Section 27
paragraph one or paragraph two, or fails to comply with Section 28, which relates to the
Personal Data under Section 26 in a manner that is likely to cause other person to suffer any
damage, impair his or her reputation, or expose such other person to be scorned, hated, or
humiliated, shall be punished with imprisonment for a term not exceeding six months, or afine not exceeding five hundred thousand Baht, or both.
Any Data Controller who violates the provisions under Section 27 paragraphone or paragraph two, or fails to comply with Section 28, which relates to the Personal Data
under Section 26 in order to unlawfully benefit himself/herself or another person, shall bepunished with imprisonment for a term not exceeding one year, or a fine not exceeding one
million Baht, or both.
The offenses under this Section are compoundable offenses.

34

No. 136 Chapter 69 Gor

Government Gazette

27 May 2019

Section 80 Any person who comes to know the Personal Data of anotherperson as a result of performing duties under this Act and discloses it to any other person shallbe punished with imprisonment for a term not exceeding six months, or a fine not exceeding
five hundred thousand Baht, or both.
The provisions of paragraph one shall not be enforced against disclosures inany of the following circumstances:(1) where it is a performance of duty;(2) where it is for the benefit of an investigation, or a trial in court;(3) where it is a disclosure to a domestic or a foreign government agency
which has authority under the law;(4) where the written consent of such Data subject has been obtained forthe disclosure for such specific occasion; or(5) where it is in relation to a legal lawsuit, which is openly disclosed tothe public.
Section 81 In the case where the offender who commits the offense under
this Act is a juristic person and the offense is conducted as a result of the instructions given
by or the act of any director, manager or person, who shall be responsible for such act of thejuristic person, or in the case where such person has a duty to instruct or perform any act, butomits to instruct or perform such act until the juristic person commits such offense, such
person shall also be punished with the punishment as prescribed for such offense.

Part II
Administrative Liability----------------------------Section 82 Any Data Controller who fails to comply with Section 23,
Section 30 paragraph four, Section 39 paragraph one, Section 41 paragraph one, or Section 42
paragraph two or paragraph three, or fails to obtain consent using a form or statement set
forth by the Committee under Section 19 paragraph three, or fails to notify the impact of thewithdrawal of consent under Section 19 paragraph six, or fails to comply with Section 23 whichapplies mutatis mutandis according to Section 25 paragraph two, shall be punished with anadministrative fine not exceeding one million Baht.
Section 83 Any Data Controller who violates or fails to comply with
Section 21, Section 22, Section 24, Section 25 paragraph one, Section 27 paragraph one or35

No. 136 Chapter 69 Gor

Government Gazette

27 May 2019

two, Section 28, Section 32 paragraph two, or Section 37, or who obtains consent bydeceiving or misleading the Data subject about the purposes, or fails to comply with
Section 21 which applies mutatis mutandis according to Section 25 paragraph two, or
fails to send or transfer the Personal Data in accordance with Section 29 paragraph one orparagraph three, shall be punished with an administrative fine not exceeding three million
Baht.
Section 84 Any Data Controller who violates Section 26 paragraph one or
three, or Section 27 paragraph one or paragraph two, or Section 28 in relation to the Personal
Data under Section 26, or fails to send or transfer the Personal Data under Section 26 to be inaccordance with Section 29 paragraph one or paragraph three, shall be punished with anadministrative fine not exceeding five million Baht.

Section 85 Any Data Processor who fails to comply with Section 41 paragraphone, or Section 42 paragraph two or three, shall be punished with an administrative fine notexceeding one million Baht.
Section 86 Any Data Processor who fails to comply with Section 40 without
appropriate reasons, or fails to send or transfer the Personal Data in accordance with Section
29 paragraph one or three, or fails to comply with Section 37 (5) which applies mutatis
mutandis according to Section 38 paragraph two, shall be punished with an administrative
fine not exceeding three million Baht.
Section 87 Any Data Processor who send or transfer the Personal Data under
Section 26 paragraph one or three, by not complying with Section 29 paragraph one or three,shall be punished with an administrative fine not exceeding five million Baht.
Section 88 Any representative of the Data Controller or of the Data
Processor who fails to comply with Section 39 paragraph one which applies mutatis mutandis
according to Section 39 paragraph two, and Section 41 paragraph one which applies mutatis
mutandis according to Section 41 paragraph four, shall be punished with an administrative
fine not exceeding one million Baht.
Section 89 Any person who fails to act in compliance with the order givenby the expert committee, or fails to provide statement of facts under Section 75, or fails tocomply with Section 76(1), or fails to facilitate government officials under Section 76
paragraph four, shall be punished with an administrative fine not exceeding five hundred
thousand Baht.
Section 90 The expert committee shall have the power to render thepunishment as an administrative fine prescribed in this Part. In the event that it deems
fit, the expert committee may issue an order for rectification or a warning first.
In determining whether to issue an order to impose an administrative fine, theexpert committee shall take into consideration the severity of the circumstances of the act of36

No. 136 Chapter 69 Gor

Government Gazette

27 May 2019

offense, size of the business of the Data Controller or the Data Processor, or othercircumstances according to the rules prescribed by the Committee.
In cases where a person imposed with an administrative fine refuses to pay
such fine, the provisions concerning the execution of administrative orders under theadministrative procedure law shall apply mutatis mutandis. In cases where there is no officer to
execute an administrative order, or there is such officer but such order cannot be executed
otherwise, the expert committee shall be entitled to file a lawsuit with the Administrative
Court in order to demand payment of such fine. In such event, if the Administrative Court isof the opinion that the order that imposes an administrative fine is lawful, the Administrative
Court may render judgment and order seizure or attachment of assets for sale by auctions, topay such fine.
The order to impose the administrative fine and the administrative execution
shall apply mutatis mutandis according to Section 74 paragraph six, and the administrative
execution per paragraph three shall apply mutatis mutandis according to Section 74 paragraphfour.

Transitional Provisions----------------

Section 91 At the early stage, the Committee shall consist of committee
members under Section 8(2) and (3), and the Secretary-General shall be the committee
member and secretary, who shall perform duties as necessary for the time being, but for not
more than 90 days from the effective date of this Act. A Vice-Chairperson shall temporarily
act as a Chairperson.
The Office shall manage to appoint a Chairperson under Section 8(1), andthe honorary director under Section 8(4), within 90 days from the effective date of this Act.
Section 92 A commission supervising the Office of the Personal Data
Protection Committee shall be set up within 90 days from the date when the Chairperson andthe honorary director are appointed in accordance with Section 91.
The Secretary-General shall be appointed within 90 days from the date when
the Office has been set up in accordance with Section 93.
Section 93 The Office shall be set up in order to operate in accordance withthis Act within one year from the effective date of this Act.
During the period when the Office has not yet been duly set up, the Office of
the Permanent Secretary of the Ministry of Digital Economy and Society shall perform theduties in accordance with this Act, and the Minister shall appoint a Deputy Permanent
Secretary of the Ministry of Digital Economy and Society to perform the Secretary-General'sduties until there is an appointment of the Secretary-General in accordance with Section 92
paragraph two.

37

No. 136 Chapter 69 Gor

Government Gazette

27 May 2019

Section 94 At the early stages, the Cabinet shall allocate the initial budget
for the Office as necessary.
The Ministry shall propose to the Cabinet to consider procuring a civil official,
official, staff, or any other operating officer in other government organizations to temporarily
act as an official of the Office within the period specified by the Cabinet.
It shall be deemed that the civil official, official, staff, or any other operating
officer in other government organizations who temporarily act as an official of the Office inaccordance with paragraph two remains in his or her own position, and still receive salary or
wages (as the case may be) from his or her original department. The Committee may also
determine a special remuneration for the civil official, staff, official, or any other operating
officer in other government organizations in accordance with paragraph two during his or her
operation in the Office.
Within 180 days from the date when the Office has been set up, the Officeshall proceed to recruit the civil official, official, staff, or any other operating officer in othergovernment organizations in accordance with paragraph two to be a permanent official of the
Office afterwards.
Any civil official, official, staff, or any other operating officer in othergovernment organizations who has been recruited and seated in accordance with paragraph fourshall have his or her working period for his or her previous department continued and counted
together with his or her working period for the operation in the Office under this Act.
Section 95 For Personal Data that has previously been collected by a Data
Controller before the e f f e c t i v e date o f this Act, the Data Controller shall be entitled tocontinue to collect and use such Personal Data for the original purposes. However, the Data
Controller shall prepare and publicize a consent withdrawal method to facilitate the Data
subject, who does not wish the Data Controller to continue collecting and using his or her
Personal Data, to notify his or her withdrawal of consent easily.
The disclosure and other acts other than the collection and use of Personal
Data under paragraph one, shall be in accordance with the provisions hereunder.
Section 96 The issuance of regulations and notifications under this Act
shall be carried out within one year from the effective date of this Act. If such action cannot
be carried out, the Minister shall report to the Cabinet the reasons thereof.
Countersigned byGeneral Prayut Chan-o-cha
Prime Minister38

No. 136 Chapter 69 Gor

Government Gazette

27 May 2019

Remarks :- The reason for the enactment of this Act is that nowadays there are and have been
many cases of violations of the right to the privacy protection of personal data resulting in thenuisance to or damages to the data subject. In addition, the technological developments has
increased the ease, convenience and swiftness of the collection, use and disclosure of personal
data that are done in a manner constituting such violations, which also causes the damages tothe economy in overall. Therefore, it is appropriate to have the law governing the personal
data protection in general in order to prescribe the rules, mechanism, or measures regulating
personal data protection as a matter of general principles, and thus the Act is necessary to beenacted.

39