How is the PDPA related to our lives?

People have been talking non-stop about the Personal Data Protection Act ever since it came into force in Thailand on 1 June 2022. However, many may still not fully understand the concept behind the PDPA and its purpose.

The PDPA protects users, including you, from websites or organizations that might collect and use your data unlawfully. The types of data considered personal data under the PDPA include any information that can be used to identify you as a person. For instance, your name, date of birth, telephone number, home address, identification number, passport, profile photo, medical records, and much more.

In addition, there is another type of data called Sensitive Personal Data (SDP) which is further protected under the PDPA. Examples of SDP include but are not limited to, race, ethnic origin, religion, political opinions, gender, sexual orientation, and genetic data.

Under the PDPA, there are three particular parties involved in the process: Data Subjects, Data Controllers, and Data Processors. You and every other user are Data Subjects. As the owners of your data, you have the right to publish, edit, or remove your personal and sensitive data from any sites.

The Thailand PDPA applies to everyone, including both local and foreign businesses and websites that collect personal data from users based in Thailand.

So, how does the PDPA relate to you as an individual?

Knowing the PDPA allows you to protect your personal data from being used illegally and to protect yourself from unknowingly being the subject of unlawful acts. For example, photos taken in public. When you take photos in public, make sure to cover up other people’s faces in the photo. This is because using the photos for commercial purposes and/or if the photo somehow oversteps someone’s privacy could be considered violations of the PDPA.

Furthermore, there are penalties that will be applied to those failing to comply with the PDPA, which include fines of up to five million baht and/or imprisonment of up to one year. To sum up, if the action you are about to take concerns the personal data of others, always be sure to think carefully before acting.