Thailand: Adopted PDPC guidelines for notifying the purpose and details of collecting personal data from data subjects based on Personal Data Protection Act B.E. 2562

On 7 September 2022, the Personal Data Protection Committee (PDPC) adopted guidelines for notifying the purpose and details of collecting personal data from data subjects according to the Personal Data Protection Act B.E. 2562. The guidelines specify that data controllers must clearly inform data subjects about the purposes, methods, and retention periods for collecting personal data, as well as their rights regarding consent, access, and correction. Notifications should be presented in an easily understandable format and provided at the time of data collection or within 30 days if data is obtained from other sources. Exceptions to these rules apply in specific cases, such as when data subjects are already aware of the details or when notifying them would hinder important functions like scientific research. Data controllers must also implement safeguards such as Data Protection Impact Assessments and privacy policies to protect data subjects' rights and comply with legal obligations.