By Nat Boonjunwetvat, Punnapa Vorapanyasakul

Following the approval of the Cabinet on 5 May 2021, the Royal Decree on Entities and Businesses of Data Controllers that are Exempted from the Personal Data Protection Act B.E. 2562 (2019) (No. 2) B.E. 2564 (2021) was published in the Royal Gazette on 8 May 2021 to defer the full enforcement of the Personal Data Protection Act B.E. 2562 (A.D. 2019) (the “PDPA”) for another year. Accordingly, the date of full implementation of the PDPA has been delayed for a second time to 1 June 2022. 

Whilst data controllers remain obliged to observe certain interim security measures in accordance with the relevant Notification of Ministry of Digital Economy and Society, the postponement presents the opportunity for business operators to further brace for the PDPA impact as well as review their data processing activities to ensure compliance before the PDPA finally comes into full force.
 

^{This document is solely intended to provide an update on recent development in Thailand legislation and is not purported to provide a legal opinion, nor a legal advice to any person.}