His Majesty King Maha Vajiralongkorn Bodindradebayavarangkun Granted On 24 May 2019, the 4th year of the present reign, His Majesty King Maha Vajiralongkorn Bodindradebayavarangkun has graciously proclaimed that

Whereas it is appropriate to have a law on the protection of personal data, This Act contains certain provisions on the restriction of the rights and freedoms of individuals,

which Section 26, together with Section 32, Section 33 and Section 37 of the Constitution of the Kingdom of Thailand, stipulates that it can be done by virtue of the powers under the provisions of law.

The reasons and necessity for the restriction of the rights and freedoms of individuals under this Act are to effectively protect personal data and to provide effective measures to remedy personal data owners from violations of their rights in personal data. The enactment of this Act is in accordance with the conditions stipulated in Section 26 of the Constitution of the Kingdom of Thailand.

Her Majesty therefore graciously proclaims Enacted by the advice and consent of the National Legislative Assembly acting as the Parliament as follows:

Section 1 This Act shall be called the “Personal Data Protection Act B.E. 2562”

Section 2 This Act shall come into force from the day following the date of its publication in the Government Gazette onwards, except for the provisions in Chapter 2, Chapter 3, Chapter 5, Chapter 6, Chapter 7 and the contents of Section 95 and Section 96 which shall come into force after the expiration of one year from the date of its publication in the Government Gazette onwards.

Section 3 In the event that there is a law that specifically provides for the protection of personal data in any manner, business or agency, the provisions of that law shall apply, except

(1) provisions regarding the collection, use or disclosure of personal data and provisions on the rights of personal data owners, including related penalties, shall apply in accordance with the provisions of this Act as an additional provision Whether or not it is the same as the provisions of the law on that matter

(2) The provisions on complaints, the provisions that empower the expert committee to issue orders to protect the owner of personal data and the provisions on the powers and duties of officials including the related penalty provisions shall be enforced in accordance with the provisions of this Act in the following cases: (a) In the case where the law on that matter does not contain provisions on complaints (b) In the case where the law on that matter contains provisions that empower officials with the authority to consider complaints under that law to issue orders to protect the owner of personal data but are not as sufficient as the power of the expert committee under this Act and the authorized officials under that law to request the expert committee or the owner of the damaged personal data to file a complaint with the expert committee under this Act, as the case may be.

Section 4 This Act shall not apply to:

(1) Collection, use or disclosure of personal data of a person who has collected personal data for personal benefit or for the activities of that person's family only.

(2) Actions of government agencies whose duties include maintaining national security, including fiscal security of the state or maintaining public security, including duties related to anti-money laundering, forensic science or maintaining cyber security.

(3) Persons or juristic persons who use or disclose personal data collected only for media activities, artistic works or literary works in accordance with professional ethics or for public benefit only.

(4) The House of Representatives, the Senate and the National Assembly, including committees appointed by such houses, which collect, use or disclose personal data in the consideration of the duties and powers of the House of Representatives, the Senate, the National Assembly or the committees, as the case may be.

(5) Court consideration and judgment of cases and actions of officials in the trial process, enforcement and placement of assets, including operations under the criminal justice process.

(6) Actions with data of credit information companies and members under the law on

Credit Information Business

Exemption from the application of all or some provisions of this Act to personal data controllers of any type, any business or any agency similar to the personal data controller under paragraph one or for any other public benefit shall be issued by Royal Decree.

Personal data controllers under paragraph one (2), (3), (4), (5) and (6) and personal data controllers of agencies exempted as specified in the Royal Decree under paragraph two must arrange for the maintenance of personal data security in accordance with the standards.

Section 5 This Act shall apply to the collection, use or disclosure of personal data by personal data controllers or personal data processors located in the Kingdom, regardless of whether the collection, use or disclosure is made within or outside the Kingdom.