Category: Legal Updates

on by

When Health Data Moves Beyond Its Original Purpose

Large-scale health screening programs can generate datasets of exceptional value. Information initially collected to assess an individual’s health may later be useful for population-health planning, epidemiological studies, academic research, development of healthcare technologies, or collaboration among public authorities, hospitals and research institutions. At the same time, such projects illustrate one of the more difficult questions under the Personal Data Protection Act (PDPA): when may health data collected for one purpose subsequently be used or disclosed for another?

A recent consultation submitted to the data protection regulator in connection with health information collected through a large-scale screening program brings several of these issues into focus. Rather than discussing the regulator’s conclusions in that particular matter, this article examines the compliance questions the scenario raises for organizations handling health and data collection.

Health information requires a two-layer legal analysis:

The starting point is that health information is expressly classified as sensitive personal data under Section 26 of the PDPA. As a general rule, collecting such information without the data subject’s explicit consent is prohibited unless one of the statutory exceptions applies.

This is important because organizations sometimes begin their analysis with Section 24, particularly Section 24(1), which permits the collection of personal data without consent for historical or archival purposes in the public interest, or for research or statistical purposes, provided appropriate safeguards are implemented.  For ordinary personal data that may be the principal legal-basis analysis. For health data, however, satisfying Section 24 does not by itself resolve the issue. The processing must also be capable of being justified under the special rules applicable to sensitive personal data in Section 26.

Section 26 contains several potentially relevant exceptions, including processing necessary for certain health-related purposes where the statutory requirements are satisfied. The applicable exception will depend on the nature of the project, the statutory functions of the organizations concerned, who performs the processing, and the purpose for which the health information is being used.  Consequently, describing a project simply as “research” or “public health” should not be treated as a substitute for identifying the precise statutory basis supporting each processing operation.

Secondary use is a separate question:

A second issue is purpose limitation. Section 21 requires a controller to collect, use or disclose personal data in accordance with the purpose communicated to the data subject. Using the information for a different purpose generally requires notification of the new purpose and consent, unless the PDPA or another law permits the new processing.

This distinction becomes particularly important where information was originally collected to provide an individual health screening service but is later proposed to be used for research, analytics, public-health planning or development of new systems. The question is not merely whether research can, in the abstract, be conducted without consent. The organization should identify what the original purpose was, what the subsequent purpose is, and what provision of law permits the transition from one to the other.

The PDPA recognizes research and statistical activities in a number of places and also contemplates situations in which providing an individual notice may be impossible or seriously obstruct the achievement of scientific, historical or statistical research. In such circumstances, however, appropriate safeguards for the rights, freedoms and interests of data subjects remain important.  This makes research governance more than an exercise in selecting a lawful basis: data minimization, access restrictions, security controls, retention limits and the manner in which research results are disclosed all become part of the compliance analysis.

Removing names may not end the PDPA analysis:

Another recurring issue is whether health data can simply be “de-identified” before being transferred or used for research.

The distinction between genuinely anonymous information and information from which direct identifiers have merely been removed is critical. Removing a person’s name, identification number or telephone number does not necessarily mean that the person can no longer be identified. Health datasets frequently contain combinations of age, location, diagnosis, treatment history, dates and other variables that may permit identification when combined with other information.

The PDPA itself distinguishes between personal data and information that has been made incapable of identifying the data subject. For example, it expressly recognizes anonymization as one possible means of dealing with data in connection with a deletion request.  Organizations should therefore avoid treating “de-identification”, “pseudonymization” and “anonymization” as interchangeable concepts.

As a practical matter, data linked to a code while a corresponding key remains available should normally be treated cautiously as personal data. Whether a dataset has become genuinely anonymous should be assessed against the realistic possibility of re-identification, including identification through combination with information held separately. For valuable health datasets, this may require both technical controls and organizational restrictions rather than simply deleting direct identifiers.

Who is the controller when several organizations participate?

Large-scale health projects commonly involve several participants: a government agency may establish the program, hospitals may collect samples and examination results, a university may analyze the information, an IT provider may host the database and separate researchers may later obtain datasets.

The labels used in the collaboration agreement are not necessarily decisive. The relevant question is who determines the purposes and essential means of each particular processing activity. A participant acting solely on documented instructions may have a processor role, whereas an institution that determines its own research question and decides how information will be analyzed may itself exercise controller functions.

The same institution may therefore occupy different roles at different stages of a project. That distinction matters because the PDPA imposes different obligations on controllers and processors, and because disclosure from one independent controller to another requires its own legal justification rather than merely a data processing agreement.

Organizations managing collaborative health projects should consequently map the data flow and the decision-making structure, rather than assigning a single PDPA label to each institution for the project as a whole.

Data sharing is itself a processing activity:

Where health information is disclosed to another organization, it is not enough that the recipient intends to conduct worthwhile research. Section 27 restricts the use and disclosure of personal data unless consent has been obtained or the information was collected under an applicable statutory exception. It also restricts a recipient from subsequently using the information for purposes beyond those communicated when obtaining the data.

This means that data-sharing arrangements should identify, among other matters, the purpose of disclosure, categories of information involved, respective legal bases, permitted uses, security measures, retention and deletion arrangements, onward disclosure restrictions, handling of data-subject rights, breach responsibilities and the respective controller or processor status of the parties.

The existence of a data-sharing agreement is valuable evidence of governance, but the agreement does not itself create a lawful basis that does not otherwise exist under the PDPA.

International research creates an additional layer:

Where research collaborators, cloud providers or analytical systems are located outside Thailand, the international-transfer provisions must also be considered independently of the lawful basis for the underlying research.

Section 28 establishes the principle that transfers should be made to destinations having an adequate standard of personal data protection, subject to specified statutory exceptions.  Section 29 provides mechanisms concerning transfers within groups and permits other safeguards in circumstances prescribed under the statutory framework.

Accordingly, an organization may have a valid domestic basis to process health information for a particular purpose but still need to address a separate transfer question before making the information accessible overseas. This is especially relevant where data is stored on international cloud infrastructure or foreign researchers are given remote access to a Thai database; an organization should not assume that the absence of a physical file transfer necessarily removes the cross-border issue.

Why these issues extend beyond healthcare:

Although health screening provides a particularly clear example because Section 26 applies, the underlying questions are much broader. Businesses increasingly seek to reuse datasets originally collected for operational purposes to train algorithms, develop AI systems, perform behavioral analytics or create new products. The same sequence of questions frequently arises: What was the original purpose? What is the proposed secondary purpose? Does the new processing have an independent legal basis? Are sensitive data involved? Can the information genuinely be anonymized? Who determines the new purpose? Will another organization receive the data? Will it become accessible outside Thailand?

The regulatory risk often arises not because the organization lacks a legitimate business or public-interest objective, but because these questions are addressed only after a valuable dataset has already been created. Building secondary-use governance into the data lifecycle from the beginning is therefore considerably safer than attempting to reconstruct the legal basis when a research or AI opportunity later emerges.

Key Takeaways:

  • Health data requires special treatment: An organization relying on a research basis under Section 24 must still address the sensitive-data requirements of Section 26.
  • Secondary use should be analyzed separately from original collection: A lawful basis for collecting health information does not automatically authorize every later research, analytics or development purpose.
  • Removing names is not necessarily anonymization: The ability to identify an individual through remaining data or other available information remains relevant.
  • Roles should be determined activity by activity: A university, hospital, government agency or technology provider may have different controller or processor roles at different stages of the same project.
  • A contract does not replace a lawful basis: Data-sharing agreements and processing agreements are governance tools; they do not themselves legalize a disclosure.
  • Cross-border access adds another compliance layer: International transfer requirements must be considered separately from the legal basis for the underlying research.
  • Research and AI projects benefit from governance by design. Organizations should determine secondary-use rules, access controls, anonymization standards and data-sharing procedures before datasets are repurposed.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

on by

Criteria and Conditions for Allowing Foreign Nationals to Use Automated Passport Control Channels

Background

The Immigration Bureau introduced Automated Passport Control Channels under the Order No. 322/2566 (the “Previous Order”), effective 15 December 2023, to support tourism and improve immigration processing efficiency.

However, the original framework was relatively narrow in scope, covering only a limited group of foreign nationals and restricting outbound automated processing to Suvarnabhumi Airport. To enhance accessibility and accommodate a wider range of travelers, the Immigration Bureau subsequently issued the Order No. 196/2569 (the “Current Order”), which substantially expands the scope of the Automated Passport Control System.

Immigration Bureau Order No. 196/2569

To further facilitate immigration clearance for foreign travelers, the Immigration Bureau issued the Current Order, effective on 24 August 2026. The Current Order significantly expands access to Automated Passport Control Channels by broadening eligible nationalities, visa categories, and airport checkpoints. Here is what has been changed compared to the previous order.

  1. Expanded Eligible Nationalities

The most significant change is the expansion of eligible nationalities from only Singapore and Hong Kong under the Previous Order to 33 countries and territories under the Current Order.

The expanded list now includes major business and tourism markets such as the United Kingdom, Japan, South Korea, Australia, New Zealand, Germany, France, Switzerland, Italy, the Netherlands, Sweden, Norway, Denmark, Finland, Belgium, Austria, Canada, and Singapore.

As a result, a substantially larger number of foreign travelers are now eligible to use Automated Passport Control Channels when entering and departing Thailand.

  • Expanded Visa Eligibility

The Previous Order primarily limited access to permanent residents, diplomats, government representatives, and certain designated individuals.

Under the Current Order, eligibility has been extended to holders of specified Non-Immigrant Visas as listed in its Appendix, covering a wider range of foreign nationals residing, working, studying, investing, or living with family members in Thailand.

  • Expanded Airport Access

Under the Previous Order:

  • Inbound automated channels were available only to a limited group of foreign nationals and specific type of passport holders.
  • Outbound automated channels were available only at Suvarnabhumi Airport.

Under the Current Order:

  • Eligible foreign nationals as listed in its Appendix can use automated channels for both inbound and outbound travel.
  • Access is available at any international airport equipped with the Automated Passport Control System.
  • Operational Improvements

The Current Order also introduces procedures enabling immigration officers to promptly correct minor system errors, including issues related to visa classification, period-of-stay records, and automated overstay alerts, thereby helping to reduce delays and unnecessary processing.

  • Broader Coverage of Eligible Travelers

The Current Order also broadens eligibility to include:

  • Business: employees, executives, assignees, and investors;
  • Education: teachers, researchers, and students;
  • Family: spouses, parents, children, and other qualifying family members of Thai nationals, permanent residents, and eligible foreign residents.  

It is crucial to note that each criterion is evaluated independently. Therefore, if a foreigner fits into one of the eligible groups (such as holding a qualifying visa or belonging to an eligible nationality), they will be allowed to use the automated channels

Practical Examples

  1. Long-Term Business Professionals and Expatriates Holding Non-Immigrant “B” Visas

Under the Previous Order:

  • Inbound: No access to the Automated Passport Control System was allowed; even senior executives of multinational companies and citizens of major economies such as the United States, the United Kingdom, Japan, and China. They  were required to use manual immigration counters.
  • Outbound: The Automated Passport Control System is available only at Suvarnabhumi Airport.

Under the Current Order:

  • Inbound and Outbound: It is accessible at any international airport equipped with the Automated Passport Control Channels, provided the traveler qualifies under the Appendix of the Current Order and holds a valid re-entry permit where required.
  • Short-Term Business Travelers and Tourists

Under the Previous Order:

  • Inbound: No access to the Automated Passport Control System was allowed, except for Singaporean and Hong Kong passport holders.
  • Outbound: The Automated Passport Control System is available only at Suvarnabhumi Airport.

Under the Current Order:

  • Inbound and Outbound: Eligible travelers from countries listed in the Appendix to the Current Order, including the United States, Japan, China, and the United Kingdom, can use Automated Passport Control Channels at any international airport equipped with the Automated Passport Control System.

Key Takeaways

  • Significant Expansion: Eligibility has increased from only two nationalities to 33 countries and territories under the Current Order.
  • Broader Access: Business travelers, expatriates, investors, academics, students, and family-based visa holders can now benefit from automated immigration processing.
  • Nationwide Availability: Automated outbound processing is no longer limited to Suvarnabhumi Airport, and it is now being used at any international airport equipped with the system.
  • Improved Efficiency: Immigration officers are now authorized to resolve minor system errors immediately, helping to reduce delays and unnecessary procedures.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

on by

Substantive Agreement Reached on the Thailand–United States Agreement on Reciprocal Trade (ART)

Introduction

On 1 September 2026, Thailand and the United States reached agreement on the substance of an Agreement on Reciprocal Trade (the “ART”) in Washington, D.C. Technical details remain outstanding, and the ART has not been signed.

The tariff rate applicable to Thai goods is likewise unsettled. A Section 301 investigation into structural excess capacity remains before the United States Trade Representative (“USTR”), and the final rate will depend on its outcome.

The 12.5 percent rate now in force did not simply replace an earlier rate. It is the latest in a sequence of four measures, each resting on a different legal footing, and in each case the preceding measure ceased to apply because its statutory basis lapsed, was struck down, or was superseded by negotiation.

How One Measure Replaced Another

  • Reciprocal tariffs under IEEPA: Thailand was subject to a reciprocal tariff of 36 percent imposed under the International Emergency Economic Powers Act (“IEEPA”). Following a joint statement with the United States, that rate was reduced to 19 percent, announced on 1 August 2025, which in turn led to the announcement of the ART framework on 26 October 2025.
  • The Supreme Court ruling: On 20 February 2026, the United States Supreme Court held, by six votes to three, that IEEPA does not confer authority on the President to impose tariffs. The reciprocal tariff regime fell away, including the 19 percent rate applied to Thailand.
  • Section 122: The United States then imposed a temporary tariff of 10 percent on all countries under Section 122 of the Trade Act of 1974. That authority carries a statutory limit of 150 days, and the measure expired on 24 July 2026.
  • Section 301: On the same day, the USTR announced tariffs under Section 301 covering 60 trading partners. Thailand was placed in the 12.5 percent band under the forced labor case. Cambodia, Indonesia and Malaysia were placed at 10 percent, leaving Thai exporters with a cost disadvantage of approximately 2.5 percentage points against those regional competitors.

Each step rests on a different statute. A rate imposed under one authority is not comparable with a rate imposed under another, even where the percentage is identical.

Where the Rate Stands Now

Section 301 does not produce a single rate. It proceeds case by case, and the resulting rates accumulate.

  • Case 1 — Forced labor: Determined, producing the 12.5 percent rate now in force.
  • Case 2 — Structural excess capacity: Pending, no determination has been issued.

The Department of Foreign Trade (“DFT”) expects the two cases together to result in a combined rate of no more than 19 to 20 percent. With Case 1 at 12.5 percent, this implies approximately 6.5 percent from Case 2.

It is at this point that the two figures of 19 percent must be kept distinct. The 19 percent applied before February 2026 was a single reciprocal tariff imposed under IEEPA and no longer exists. A figure of 19 percent today refers to the two Section 301 cases taken together, under an entirely different statute. The same number denotes a different measure.

What Was Agreed on 1 September

The Deputy Prime Minister and Minister of Commerce met the USTR and the Deputy USTR in Washington, D.C. on 1 September 2026, following four days of technical negotiation conducted by Thailand’s representatives.

The parties agreed on the substance of the ART, and the negotiating teams on both sides were directed to finalize the remaining technical details. The ART addresses non-tariff barriers, digital trade, and commercial opportunities. The United States indicated that the rate arising from the pending Section 301 excess capacity investigation would be set at a fair and competitive level.

Why the ART Does Not Settle the Rate

The Ministry of Commerce (“MOC”) confirmed on 7 September 2026 that agreement on the substance of the ART does not fix the final tariff rate, because the Section 301 excess capacity investigation remains under consideration.

Two distinct instruments are involved:

  • The ART is a bilateral agreement between Thailand and the United States.
  • A Section 301 determination is a unilateral United States administrative process.

Concluding the former does not conclude the latter.

The two meet at a single point. The USTR set the Case 1 rate at 10 percent for economies that already prohibit imports of goods made with forced labor, that operate a partial regime having that effect, or that have committed through an ART to impose and enforce such a prohibition. Thailand satisfies none of these conditions and therefore remains at 12.5 percent.

What lowers the rate is the forced labor commitment that an ART carries, not the ART itself. An agreement without such a commitment would not qualify, and an agreement containing one would still leave Case 2 open.

What Remains Outstanding

Three matters remain unresolved.

  • The Case 2 determination has not been issued, and no date has been announced. Until it is, the rate applicable to Thai goods is not fixed.
  • The technical annexes to the ART have not been finalized, and the agreement has not been signed.
  • The commercial terms of the ART have not been published. Commitments on imports of United States goods will bear on Thailand’s trade and current account balances.

Key Takeaways

  • The tariff applicable to Thai goods has been replaced three times since 2025, moving from 36 percent and then 19 percent under IEEPA, to 10 percent under Section 122, to 12.5 percent under Section 301 to date.
  • Rates imposed under different statutes are not comparable, even where the percentage is identical.
  • Section 301 rates accumulate across cases. Case 1 (forced labor) produced the current 12.5 percent. Case 2 (excess capacity) is pending.
  • A combined figure of 19 to 20 percent refers to both Section 301 cases together, and not to the former IEEPA rate of 19 percent.
  • Agreement on the substance of the ART was reached on 1 September 2026. Technical details remain outstanding and the ART is not signed.
  • An ART containing a forced labor undertaking would move Case 1 from 12.5 percent to 10 percent, but would not determine Case 2. Thailand remains at 12.5 percent, and the MOC confirmed on 7 September 2026 that the final rate awaits that determination.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

on by

Social Media Advertising: New Advertiser Verification Requirements Take Effect Soon

A significant compliance deadline is approaching for businesses involved in social media advertising. From 1 November 2026, social media service providers offering paid advertising will be required to verify the identity of advertisers before advertisements are published in Thailand under the Notification of the Electronic Transactions Commission on Measures for the Prevention of Technology Crime for Social Media Service Providers (No. 2) (the Notification). With the effective date approaching, platforms should now move beyond legal assessment and ensure that their advertiser onboarding, identity verification, payment, and record-retention systems are operationally ready.

Advertiser Verification and Record Retention:

Where an advertisement is published in Thailand through social media and the social media service provider receives payment for the advertising service, whether from the advertiser or another person, the provider must verify the identity of the advertiser before publication. Verification may be conducted using government-issued identification that can be checked against a reliable source, together with a method of establishing the connection between the advertiser and the identification evidence, or through a Digital ID verification and authentication system meeting the applicable standards of the Electronic Transactions Commission. The requirement should therefore not be understood simply as a mandatory “face scan” rule. Importantly, verification generally does not need to be repeated where the advertiser has already been verified within the preceding one year, allowing platforms to maintain verified-advertiser systems rather than conducting a completely new verification exercise for every advertisement.

The Notification also requires platforms to retain prescribed information identifying the advertiser, including relevant identification, corporate and contact information. Where advertising charges are paid by a person other than the advertiser, information concerning the payer must also be retained. This is particularly relevant to advertising agencies, media buyers, corporate groups, and centralized advertising arrangements where the entity funding an advertising campaign may differ from the advertiser or the person operating the advertising account. The required information must generally be retained for at least 90 days after the advertising service ends.

Why the New Requirements Matter:

The Notification should be considered within the broader shared-responsibility framework under the Emergency Decree on Measures for the Prevention and Suppression of Technological Crimes. Under that framework, social media service providers may be required to participate in responsibility for losses resulting from technology crime unless they can demonstrate compliance with the applicable preventive standards or measures prescribed by the relevant regulator. Advertiser verification is therefore more than an administrative KYC exercise. Platforms should maintain systems and evidence capable of demonstrating that the required verification, information collection, and related preventive measures were properly carried out if fraudulent advertising subsequently results in losses.

Although the principal regulatory obligations fall on social media service providers, the practical impact will extend throughout the advertising ecosystem. Advertising agencies operating accounts for clients may be asked to establish the identity of the underlying advertiser, the legal entity represented, and the person funding the campaign. Foreign advertisers may face additional onboarding requirements involving passports, foreign corporate documents, authorized representatives, and cross-border payment arrangements. Businesses using agencies or regional media-buying structures should therefore review whether their documentation and authorization arrangements will allow platforms to identify the relevant parties without delaying campaigns.

Data Protection and Implementation:

The new regime also has an important PDPA dimension. Identity verification may involve national identification documents, passports, corporate representatives’ information, contact details, and potentially facial images used for verification. Platforms should therefore ensure that the collection and retention of this information complies not only with the Notification but also with the Personal Data Protection Act, including requirements concerning lawful processing, privacy information, security, access controls, and appropriate retention and deletion. A regulatory requirement to collect or retain particular information does not displace the broader obligations applicable to the processing of personal data.

Before the effective date, social media platforms should test the complete advertising workflow rather than simply adding a KYC step. This includes determining when advertising falls within the Notification, establishing appropriate verification methods for individuals and legal entities, recording when an advertiser was last verified, identifying third-party payers, maintaining the required information for the applicable period, and addressing situations involving agencies, foreign advertisers, corporate accounts, authorized representatives, and regional advertising arrangements. Advertisers and agencies should likewise review who is identified as the advertiser for each account, who actually pays the advertising charges, and whether the necessary identification, corporate, and authorization documents will be readily available. The practical deadline is therefore not simply 1 November 2026: businesses should have the necessary systems, procedures, and documentation in place before that date to avoid disruption when the requirements become mandatory.

Key Takeaways:

From 1 November 2026, paid social media advertising published in Thailand will be subject to stronger advertiser-identification requirements. Social media service providers must verify advertisers before publication, subject to the exception for advertisers verified within the preceding year, and retain prescribed identifying information for at least 90 days after the advertising service ends. Information concerning a third-party payer must also be retained where someone other than the advertiser pays for the advertising.

Although the legal obligations principally apply to social media service providers, their operational effects will extend to advertisers, agencies, media buyers, foreign businesses, and businesses using centralized payment arrangements. Most importantly, the requirements should not be treated merely as another KYC exercise: within the broader technology-crime liability framework, platforms should be able to demonstrate compliance with the required verification and preventive measures. Businesses participating in the social media advertising ecosystem should therefore review their verification, payment, record-retention, and data-protection processes now rather than waiting until the requirements become mandatory.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

on by

Thailand Revises Visa Exemption Scheme: 30-Day Stay and Revised List of Eligible Countries

1. Introduction

The Ministry of Interior has issued notification revising Thailand’s visa exemption arrangements for foreign nationals. The revised measures repeal the special 60-day visa exemption scheme introduced in July 2024 and establish an updated list of countries and territories whose passport or travel-document holders may enter the Kingdom without a visa for tourism purposes, for a period not exceeding 30 days.

The notifications were signed on 26 August 2026 and published in the Royal Gazette on 31 August 2026, and will take effect on 15 September 2026, being 15 days after publication.

2. Background: The Previous 60-Day Visa Exemption Scheme

Under the Ministry of Interior notification dated 15 July 2024, nationals of 93 countries and territories entering Thailand for tourism, work, or short-term business purposes were exempt from visa requirements and permitted to stay for up to 60 days.

3. The Revised 30-Day Visa Exemption Scheme

3.1 Scope

  • The revised notification sets out an updated list of countries and territories eligible for visa-free entry for tourism purposes with the permitted period of stay reduced from 60 days to 30 days.
  • The revised scheme covers 60 countries and territories in total: 59 retained from the previous list, plus the Kyrgyz Republic, which has been newly added.

3.2 Retained Countries and Territories (59)

  • Asia: Bahrain, Bhutan, Brunei Darussalam, Georgia, India, Indonesia, Israel, Japan, Jordan, Kuwait, Malaysia, Maldives, Oman, Philippines, Qatar, Saudi Arabia, Singapore, Taiwan, Türkiye, and the United Arab Emirates.
  • Europe: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Liechtenstein, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland, Ukraine, and the United Kingdom.
  • Africa: South Africa.
  • North America: Canada and the United States.
  • Oceania: Australia, Fiji, and New Zealand.

3.3 Amended Countries and Territories Covered by the Revised 15-Day Scheme (2)

  • Africa: Seychelles and Mauritius 

Seychelles is not counted as retained Country and Territory as it never been in the Scheme while the Mauritius was in 30 – Day Scheme.

In addition, the Kyrgyz Republic has been newly added to the revised list as well as Seychelles on the Revised 15 – Day Scheme. 

3.4 Countries and Territories No Longer Covered by the Revised 30-Day Scheme (34)

  • Asia: Cambodia, China, Hong Kong, Kazakhstan, Korea (ROK), Laos, Macao, Mongolia, Sri Lanka, Uzbekistan, and Vietnam.
  • Europe: Albania, Andorra, Kosovo, Monaco, Russia, and San Marino.
  • Africa:  Mauritius and Morocco.
  • North, Central America and the Caribbean: Cuba, Dominica, the Dominican Republic, Guatemala, Jamaica, Mexico, Panama,Trinidad and Tobago.
  • South America: Brazil, Colombia, Ecuador, Peru, and Uruguay.
  • Oceania: Papua New Guinea and Tonga.

These countries and territories are no longer covered by the revised 30-day visa exemption scheme. Certain nationals among them are eligible for visa-free entry under separate arrangements.

4. Key Operational Requirements Under the Revised Scheme

4.1 Purpose of Entry

Whereas the previous notification permitted eligible nationals from a broader list of countries to enter Thailand for tourism purposes for up to 60 days, the revised notification limits the privilege to a reduced number of eligible countries and shortens the permitted stay to 30 days.

4.2 Land-Border Entry Limitations

  • Visa-exempt entry through land-border immigration checkpoints for the nationals listed in Item 3.2 is limited to no more than two entries per calendar year, except for nationals of Malaysia, Brunei Darussalam, Indonesia, and Singapore, and any other countries as may be further designated by the Ministry of Interior.

5. Effect on Nationals Removed From the Previous Scheme

Once the revised measures take effect, nationals of countries and territories removed from the previous list will no longer be entitled to the former 60-day exemption and also this 30-day exemption. However, some may nonetheless remain eligible for visa-free entry under separate bilateral arrangements. The applicable entry requirements and permitted period of stay therefore depend on the specific legal basis applicable to each foreign national.

  • Required to obtain a visa prior to entry (21 from 34 countries): Albania, Andorra, Colombia, Cuba, Dominica, the Dominican Republic, Ecuador, Guatemala, Jamaica, Kosovo, Mexico, Monaco, Morocco, Panama, Papua New Guinea, San Marino, Sri Lanka, Tonga, Trinidad and Tobago, Uruguay, and Uzbekistan.
  • Covered under separate bilateral arrangements (11 countries and territories): Cambodia, China, Hong Kong, Kazakhstan, Korea (ROK), Laos, Macao, Mongolia, Russia, Vietnam, and Mauritius continue to be governed by their respective bilateral frameworks. For example, Chinese nationals continue to be eligible for visa-exempt entry under the agreement between Thailand and the People’s Republic of China on mutual visa exemption, allowing a stay of up to 30 days per entry, subject to the terms and conditions of the agreement.

6. Key Takeaways

  • The permitted period of visa-exempt stay under the general scheme has been reduced from 60 days to 30 days.
  • The number of countries and territories eligible under the general visa exemption has decreased from 93 to 60.
  • Nationals of countries removed from the list will no longer benefit from the former 60-day exemption, however, subject to any separate bilateral or country-specific arrangements.
  • The revised measures take effect on 15 September 2026. Travellers admitted before that date retain the period of stay granted under the rules in force on their date of arrival.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

on by

PDPA: When CCTV Becomes Biometric Processing

CCTV vs. Biometric Data:

The increasing use of facial recognition systems in office buildings, condominiums, hospitals, retail premises and other facilities raises an important question under the Personal Data Protection Act B.E. 2562 (2019) (PDPA): when does ordinary CCTV become processing of sensitive personal data? An identifiable image recorded by conventional CCTV will generally constitute personal data, but it should not automatically be regarded as sensitive biometric data merely because a person’s face is visible. The position changes where technology is applied to facial characteristics for the purpose of uniquely identifying or authenticating an individual. The PDPA treats biometric data resulting from such processing as sensitive personal data under section 26, with facial templates, iris templates and fingerprint templates being recognized examples.

Legal Basis for CCTV and Facial Recognition:

For ordinary CCTV, an organization must identify an appropriate legal basis and comply with requirements concerning transparency, purpose limitation, security, retention and data subject rights. For private organizations, CCTV installed for genuine security purposes may potentially rely on legitimate interests under section 24(5), subject to balancing those interests against the rights and freedoms of the individuals being recorded. Other grounds may apply depending on the circumstances, including compliance with a legal obligation under section 24(6), while public authorities may in appropriate cases rely on processing necessary for a task carried out in the public interest or exercise of official authority under section 24(4). Importantly, however, a legal basis that supports conventional CCTV does not automatically authorize facial recognition. Once facial images are processed as biometric data for unique identification, the organization must separately satisfy the requirements applicable to sensitive personal data under section 26.

Consent and Alternative Access:

This distinction is particularly important for facial recognition used to control access to condominiums, offices and other premises. A business may have a legitimate interest in protecting its premises, residents, employees and property, but the existence of a legitimate security objective does not necessarily establish that biometric identification is necessary to achieve it. Where no section 26 exception applies and explicit consent is relied upon, the organization should consider whether that consent is genuinely voluntary. If a resident, employee or tenant who refuses facial recognition cannot reasonably access the premises, the validity of that consent may be questionable. Providing a workable non-biometric alternative, such as an access card, physical key, PIN or mobile credential, can therefore be an important compliance measure. This should not be treated as an absolute rule requiring an alternative in every biometric deployment; the assessment depends on the applicable legal basis, necessity of the processing and circumstances in which consent is obtained.

Public Authorities and Large-Scale Processing:

Public authorities require a different analysis. They may have statutory functions or public-interest grounds supporting particular processing activities, but the existence of a public function does not itself provide unlimited authority to process biometric information. The authority should identify the specific statutory function and applicable section 26 exception and assess whether biometric processing is necessary and proportionate to that function. This is particularly important for large-scale identity verification systems involving transportation, border control, healthcare and public digital services. Similarly, organizations carrying out large-scale biometric identification or systematic monitoring should consider whether the nature, scale and risks of the processing require or justify a data protection impact assessment before implementation.

Transparency and Retention:

Transparency and retention also require particular attention. CCTV notices should be displayed appropriately before individuals enter monitored areas and should provide, or direct individuals to, information concerning the controller, purposes, legal basis, retention, disclosures, data subject rights and relevant contact channels. Where facial recognition is used, a generic notice stating merely that “CCTV is in operation” may not adequately describe the biometric processing taking place. Retention should likewise be determined by necessity and purpose rather than an assumed universal period such as 30 days. Particular footage may be preserved for longer where reasonably required for investigation, litigation or other legitimate purposes, while biometric templates warrant greater caution because biometric characteristics cannot readily be replaced if compromised.

What Businesses Should Review:

Businesses already using facial recognition should therefore reassess their systems rather than treating them merely as enhanced CCTV. The review should determine what information the technology actually generates, whether facial templates or other biometric identifiers are created, the section 26 basis relied upon, whether consent is genuinely voluntary where consent is used, and whether less intrusive technology could reasonably achieve the same purpose. Vendor arrangements should also be examined to determine where biometric data is stored and processed, who can access it, whether vendors retain or reuse the information, whether overseas transfers occur, and whether the data is used to develop or train the vendor’s technology. The critical compliance question is therefore no longer simply whether an organization may install CCTV, but what the system does with the images after they are captured.

Key Takeaways:

  • Ordinary CCTV images are personal data but are not automatically sensitive biometric data.
  • Facial recognition used for unique identification or authentication may constitute biometric processing under section 26.
  • A legal basis for conventional CCTV does not automatically authorize facial recognition.
  • Where biometric processing relies on consent, organizations should assess whether consent is genuinely voluntary and whether a practical non-biometric alternative should be available.
  • Public authorities must still identify an applicable legal basis for sensitive biometric processing and consider necessity and proportionality.
  • Retention periods should reflect necessity and purpose rather than an assumed fixed period.
  • Introducing facial recognition or AI analytics into an existing CCTV system should trigger a fresh PDPA compliance assessment.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

on by

PDPA: Cross-Border Data Transfer Compliance for Bank Z Under Thailand’s Data Protection Law – Key Takeaways

Thailand’s Personal Data Protection Act B.E. 2562 (PDPA) regulates the transfer of personal data abroad, imposing conditions to ensure adequate protection under Section 28. The Ad Hoc Subcommittee under the Personal Data Protection Committee has addressed Bank Z’s obligations when submitting directors’ personal data to comply with the Accounting and Corporate Regulatory Authority (ACRA) of Singapore and other foreign regulations. This analysis details the facts, the subcommittee’s rulings, and the resulting compliance framework.

Factual Background:

Bank Z must transmit directors’ personal data to meet ACRA requirements in Singapore and potentially other foreign laws. Under PDPA Section 28, cross-border data transfers require the recipient country or international organization to have adequate data protection standards, as determined by the Personal Data Protection Committee per Section 16(5), unless an exception applies. Bank Z faces uncertainty about whether “compliance with the law” under Section 28(1) includes foreign laws and, if not, how to proceed absent adequacy decisions for destination countries.

Subcommittee Decisions:

The subcommittee clarified Bank Z’s PDPA obligations as follows:

  1. Scope of “Compliance with the Law” Under Section 28(1)
    • Cross-border data transfers are permissible only if the destination has adequate protection standards, per Section 28 and criteria set under Section 16(5). Exceptions under Section 28(1)–(6) or Section 29 may apply. For Section 28(1)—compliance with the law—the law must be Thai and legally binding on the data controller. Foreign laws, such as ACRA regulations, do not qualify as a basis under this provision. Thus, Bank Z cannot rely on Section 28(1) to justify transfers based on Singaporean or other foreign legal obligations.
  2. Absence of Adequacy Decisions and Next Steps
    • No adequacy decisions exist under Section 16(5) and Section 28, as the committee has not yet designated any country or organization (e.g., Singapore) as having sufficient data protection standards. Without such designation, Bank Z must assess exceptions under Section 28(1)–(6). For instance, transferring directors’ data could fall under Section 28(3)—necessary to perform a contract where the director (data subject) is a party, such as employment or governance agreements—or pre-contractual steps requested by the director. If no exception applies (e.g., Sections 28(1), (3)–(6)), Bank Z must obtain explicit consent from directors per Section 28(2), informing them of the potentially inadequate protection standards in the destination country (e.g., Singapore) beforehand.

Implications for Compliance:

The subcommittee’s rulings restrict “compliance with the law” to Thai jurisdiction, excluding foreign mandates like ACRA’s as a direct basis. Absent adequacy decisions, Bank Z must either find a contractual or similar exception or secure directors’ informed consent, highlighting risks in destination countries. This dual approach balances legal obligations with data subject rights, pending future committee guidance on adequacy.

Key Takeaways:

  • Section 28(1) Is Thai-Law Specific: “Compliance with the law” applies only to Thai statutes, not foreign regulations like ACRA’s.
  • No Adequacy, No Free Pass: Without designated adequate destinations, transfers hinge on exceptions (e.g., Section 28(3)) or consent under Section 28(2).
  • Consent Requires Transparency: If consent is the basis, directors must be notified of inadequate protections in recipient jurisdictions.
  • Contractual Basis Offers Flexibility: Section 28(3) may cover director data transfers tied to governance duties, bypassing consent if applicable.

Bank Z’s scenario underscores PDPA’s stringent cross-border framework, prioritizing Thai legal authority and data subject awareness until adequacy standards are clarified. Compliance demands the strategic use of exceptions or proactive consent processes to align with international obligations.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

on by

PDPA: Does Removing a Name Make Data Anonymous?

Organizations increasingly remove names and other obvious identifiers from datasets before using the data for analytics, research, artificial intelligence development, or sharing it with third parties. A common assumption is that once names and identification numbers have been removed, the information is no longer personal data and therefore falls outside the Personal Data Protection Act B.E. 2562 (2019) (PDPA).

That assumption can be dangerous. Recent guidance from the Personal Data Protection Committee (PDPC) provides an important reminder: removing a person’s name does not, by itself, make data anonymous.

When does data become anonymous?

The key question is not simply whether direct identifiers have been deleted, but whether an individual can still be identified from the remaining information.

The PDPC’s approach indicates that data may be treated as anonymized where the data subject cannot be identified without additional information and appropriate technical and organizational measures have been implemented to ensure that identification is not reasonably possible in practice.

This distinction is particularly important where a dataset contains multiple indirect identifiers. Removing a person’s name while retaining information such as age, date of birth, location, gender, occupation, accident location, medical information, or other characteristics may still allow that person to be identified when those data points are considered together or combined with information from other sources.

Accordingly, de-identification is a question of substance, not merely the removal of specified fields.

Pseudonymization is not anonymization:

Organizations should also distinguish anonymization from pseudonymization.

If a person’s name is replaced with a code but the organization retains a separate table linking that code to the individual’s identity, the information remains capable of being attributed to that person. The dataset is therefore pseudonymized rather than truly anonymized.

Pseudonymization can be an important security and privacy measure, but it does not automatically take the data outside the PDPA. By contrast, properly anonymized information that can no longer reasonably be linked to an identifiable individual is no longer personal data for PDPA purposes.

This distinction has significant practical consequences. An organization cannot simply label a dataset “anonymous” or remove names and assume that the PDPA no longer applies.

Research provides a useful illustration:

The issue arose in the context of research into the causes of motorcycle accidents. Such research may involve ordinary personal data as well as sensitive personal data, particularly health information concerning injured persons.

The PDPA expressly recognizes research and statistical purposes as circumstances in which personal data may be processed without relying exclusively on consent. Section 24(1) provides a basis relating to research or statistical purposes, subject to appropriate safeguards protecting the rights and freedoms of data subjects. For sensitive personal data, Section 26(5)(d) similarly permits processing where necessary for scientific, historical or statistical research, or other public-interest purposes, subject to necessity and appropriate safeguards.

The PDPC has also prescribed specific safeguards for processing personal data for research and statistical purposes.

The practical significance is that organizations should not assume that anonymization is the only way to conduct research lawfully. Personal data may remain subject to the PDPA and nevertheless be processed for legitimate research purposes where the applicable statutory requirements and safeguards are satisfied.

What should organizations do in practice?

For organizations seeking to take datasets outside the scope of the PDPA, anonymization should be treated as a risk-based technical and governance process, rather than a simple data-cleaning exercise.

Direct identifiers should be removed, but organizations should also assess combinations of indirect identifiers and consider whether information could be matched against other reasonably available datasets. Where coded identifiers have been used, organizations should consider whether any linkage mechanism remains available. If a mapping table between codes and identities continues to exist, the resulting dataset is likely to remain pseudonymized rather than anonymous.

Depending on the nature of the dataset, additional techniques may be necessary, including aggregation, generalization, suppression, masking, reducing geographic or temporal precision, and other techniques designed to reduce re-identification risk.

Organizations should also document the anonymization process, the methodology used, the potential sources of re-identification, and the conclusion reached regarding residual risk. Technical measures should be accompanied by organizational controls restricting access and preventing attempts to re-identify individuals.

Why this matters for AI, analytics and data sharing:

The distinction has implications well beyond academic research.

Businesses increasingly want to use existing customer, employee, patient, transaction, location, behavioral, and operational datasets for AI development and training, statistical analysis, product improvement, or collaboration with external service providers and research institutions.

Where the information remains identifiable, the organization must continue to consider the PDPA requirements applicable to its collection, use, disclosure, retention, security, and other processing activities.

Where information has been effectively and irreversibly anonymized so that individuals are no longer reasonably identifiable in practice, however, the resulting dataset may fall outside the scope of the PDPA.

This makes anonymization potentially valuable for data-driven businesses, but it also means that organizations should be cautious about treating anonymization as a shortcut around data protection obligations. A dataset that can realistically be reconstructed, linked, or matched back to individuals remains exposed to PDPA risk regardless of what the organization calls it.

Key Takeaways:

  • Deleting names does not automatically anonymize personal data.
  • Organizations must consider whether individuals remain identifiable from other information or combinations of information in the dataset.
  • Pseudonymized data remains personal data where a person can be re-identified using additional information.
  • Proper anonymization requires technical and organizational measures designed to make re-identification impracticable.
  • Research and statistical processing may have specific legal bases under Sections 24(1) and 26(5)(d), subject to appropriate safeguards.
  • Organizations using data for AI, analytics, research or external data sharing should conduct and document a re-identification risk assessment before treating a dataset as outside the PDPA.
  • Anonymization should be viewed as an ongoing risk-management and governance exercise, not simply the deletion of names or identification numbers.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

on by

PDPA: Disclosure of Personal Data to Third Parties for Legal Proceedings

A recurring practical question under the Personal Data Protection Act B.E. 2562 (2019) (“PDPA”) is whether an organization may disclose personal data to a third party who needs the information to pursue a legal claim. Organizations often take a conservative position that personal data cannot be disclosed without the data subject’s consent. However, consent is only one of the legal bases under the PDPA, and the fact that information constitutes personal data does not, by itself, prohibit its disclosure. A recent opinion issued in response to a consultation by the Department of Land Transport (“DLT Opinion”) provides useful guidance on this issue and is particularly relevant to requests for personal data made for the purpose of exercising legal rights or pursuing legal proceedings.

Disclosure Does Not Necessarily Require Consent:

The DLT Opinion illustrates an important distinction between two questions: whether the information constitutes personal data and, if so, whether there is a lawful basis for its disclosure. Once information falls within the definition of personal data, its collection, use, or disclosure must comply with the PDPA, but this does not mean that disclosure is prohibited unless the data subject has given consent. Section 24 recognizes several legal bases for processing personal data without consent. Depending on the circumstances, disclosure to a third party may therefore be permissible where an appropriate legal basis exists. This is particularly important where the requesting party requires information to establish or exercise a legal right, claim damages, identify a responsible party, or commence legal proceedings. For example, a person who suffers damage involving a vehicle may know the vehicle registration number but may not know the identity of the person against whom a claim should be made. Similarly, a person injured in an incident recorded by CCTV may need the footage to establish the circumstances of the incident and pursue a claim. Treating the PDPA as an absolute prohibition against disclosure in such circumstances could prevent a person from effectively exercising legitimate legal rights.

Legitimate Interests and Legal Claims:

One potentially relevant legal basis is legitimate interests under Section 24(5) of the PDPA. This provision permits processing where it is necessary for the legitimate interests of the controller or another person, except where those interests are overridden by the fundamental rights of the data subject. A genuine need to obtain information for the establishment, exercise, or defense of a legal claim may constitute a significant legitimate interest. However, merely stating that information will be used in litigation should not automatically entitle a requester to obtain another person’s personal data. The controller should consider whether the claimed legal interest is genuine, whether disclosure of the requested information is necessary to pursue that interest, and whether the interests of the requester outweigh the privacy interests and fundamental rights of the data subject. In practical terms, this can be approached through a purpose–necessity–balancing analysis. The controller should first identify the legal purpose for which the information is requested; determine whether disclosure is reasonably necessary to achieve that purpose; and then balance that interest against the potential impact on the data subject. Supporting documents, such as a police report, evidence of damage, a demand letter, court documents, or other evidence demonstrating an actual or reasonably contemplated legal claim, may assist the controller in making and documenting this assessment.

The same reasoning has broader significance beyond vehicle-registration information. Government guidance discussing requests for CCTV footage has referred to the DLT Opinion by analogy when considering whether personal data may be disclosed to enable an injured person to exercise legal rights. This suggests that the Opinion may become an important reference point for third-party disclosure requests generally. Comparable issues arise frequently in the private sector: condominium juristic persons receive requests for CCTV footage following accidents or disputes; employers receive requests concerning former employees; insurers may hold information concerning parties to an accident; property owners may receive requests concerning tenants; and online service providers may receive requests for information identifying persons alleged to have committed a civil wrong. In each case, the correct question should not simply be whether the requested information is personal data, but whether the proposed disclosure has an appropriate legal basis and satisfies the requirements of necessity and proportionality.

Disclosure Should Be Limited to What Is Necessary:

Even where a lawful basis exists, the controller should not assume that all information in its possession may be disclosed. The scope of disclosure should be limited to information reasonably necessary for the stated legal purpose. If a requester needs information to identify a person against whom proceedings may be commenced, disclosure of the person’s name and information necessary for the relevant legal process may potentially be justified, while disclosure of unrelated information—such as identification numbers, telephone numbers, dates of birth, historical records, or other data not required for the claim—may not be. Redaction, partial disclosure, controlled access, or other safeguards should therefore be considered where appropriate. This distinction can be expressed simply as two separate questions: “Can the information lawfully be disclosed?” and “How much information is necessary to disclose?” Establishing a legal basis answers only the first question; the principles of necessity, proportionality, purpose limitation, and data minimization remain relevant to the second.

Organizations should also distinguish ordinary personal data under Section 24 from sensitive personal data under Section 26. Section 26 contains specific exceptions relating to processing necessary for the establishment, compliance, exercise, or defense of legal claims. Where sensitive personal data is involved, the requirements of Section 26 should therefore be considered separately rather than assuming that the legal basis applicable to ordinary personal data automatically applies. In all cases, organizations should consider implementing a documented Third-Party Personal Data Disclosure Request Procedure requiring verification of the requester’s identity, the purpose of the request, evidence supporting the claimed legal interest, the categories of information genuinely required, possible effects on the data subject, appropriate redaction or other safeguards, and a record of the reasons for approving or rejecting the request. Such documentation can be particularly important where the controller relies on legitimate interests and must subsequently demonstrate how the competing interests were assessed.

Key Takeaways:

The DLT Opinion is significant because it reinforces that the PDPA should not be treated as an automatic barrier to disclosure whenever personal data is involved. Consent is not the only legal basis for disclosure, and a genuine need to obtain information for the establishment, exercise, or defense of legal rights may support disclosure where the applicable requirements of the PDPA are satisfied. At the same time, an assertion that information is required for litigation does not create an unrestricted right of access to another person’s personal data. Controllers should assess the purpose, necessity, and balancing of interests, require appropriate evidence where necessary, limit disclosure to the minimum information reasonably required, and document the decision-making process. The broader lesson is that the PDPA is not intended to make personal data permanently inaccessible; rather, it establishes a framework for determining when disclosure is lawful, why it is necessary, and how much information may appropriately be disclosed.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

on by

PDPA: Applicability to a Facebook User’s Posting of Personal Data – Key Takeaways

Thailand’s Personal Data Protection Act B.E. 2562 (PDPA) regulates systematic personal data handling, with exemptions for personal or familial use. The Ad Hoc Subcommittee under the Personal Data Protection Committee has evaluated whether a Facebook user’s posting of an allegedly defamatory image and text qualifies them as a data controller under PDPA, as raised by Police Station F in a criminal investigation. This analysis outlines the facts, the subcommittee’s rulings, and the compliance implications.

Factual Background:

Police Station F received a complaint alleging that a Facebook user posted an image of the complainant with text causing insult or hatred, prompting a criminal case. The prosecutor’s office (C) requested the station to investigate: (1) whether the post’s visibility settings (public symbols like a globe or people) made it accessible to the general public or a specific group, and (2) whether the suspect qualifies as a data controller under PDPA Section 6 for posting the complainant’s image and text.

Subcommittee Decisions:

The subcommittee addressed the issues as follows:

  1. Post Visibility (Issue 1)
    • The question of whether the suspect’s Facebook post—with a globe or people symbol—was visible to the public or a limited group falls outside PDPA’s direct scope. PDPA defines “personal data” under Section 6 as information identifying a living individual, directly or indirectly (e.g., the complainant’s image). However, visibility settings pertain to evidence in a criminal investigation, not PDPA enforcement. The subcommittee deemed this a factual matter for the police to assess independently, unrelated to PDPA compliance.
  2. Data Controller Status (Issue 2)
    • Under PDPA Section 6, a “data controller” is a person or entity with authority to decide on the collection, use, or disclosure of personal data, subject to duties like lawful bases (Sections 24, 26), notification (Section 23), security (Section 37), and rights responses (Sections 30–36). The law targets systematic or regular data processing, not isolated acts, per its intent and Section 4(1) exemption for personal or family use. The suspect, a natural person posting on Facebook, isn’t a data controller if the act was for personal purposes (e.g., expression) without systematic intent. Absent evidence of regular, organized data handling, PDPA doesn’t apply, per Section 4(1). However, the act may violate other laws (e.g., Computer Crime Act B.E. 2550, Penal Code defamation, or Civil Code torts under Section 420), which the police should pursue separately.

Implications for Compliance:

The suspect’s posting likely falls outside PDPA’s ambit as a one-off personal act, not subjecting them to data controller obligations (e.g., consent, security measures). Police Station F must focus on criminal or tort laws for liability, using post visibility as evidence, not a PDPA issue. PDPA applies to entities with structured data practices, not casual social media use.

Key Takeaways:

  • PDPA Targets Systematic Use: The suspect isn’t a data controller under Section 6 unless their posting reflects regular, purposeful data management, per Section 4(1) exemption.
  • Personal Acts Are Exempt: One-time social media posts for personal ends fall outside PDPA, per Section 4(1), unlike organizational data handling.
  • Other Laws Apply: Privacy breaches or defamation may trigger liability under the Computer Crime Act, Penal Code, or Civil Code, not PDPA.
  • Visibility Is Investigative: Post accessibility (public vs. private) is a factual issue for criminal evidence, not a PDPA concern.

This ruling clarifies PDPA’s scope, excluding personal social media acts from its framework, directing Police Station F to pursue alternative legal avenues for the complainant’s grievance.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles