Thailand: Implemented PDPC order criteria and procedures for preparing and retaining records of personal data processing activities for personal data processors

On 17 December 2022, the Personal Data Protection Committee’s (PDPC) order on the criteria and procedures for preparing and retaining records of personal data processing activities entered into force. The order was issued under the Personal Data Protection Act B.E. 2562 (2019) and outlines the requirements for personal data processors in Thailand to maintain detailed records of their data processing activities. These records must include information on the data processor and controller, the types of personal data collected, used, or disclosed, the purposes of these activities, and the security measures implemented.