The controversial Personal Data Protection Act (PDPA) due to come into force on 1 June 2021 has faced another postponement after the Cabinet approved deferral of the full enforcement of the Act until 31 May 2022. The Cabinet cited unresolved legislative processes, such as the appointment of the members of the Personal Data Protection Committee, as well as the country’s continuing struggle against the COVID-19 pandemic as its basis for postponement.
As the country’s first data protection legislation, the PDPA is expected to create big changes to the regulatory landscape of data protection in Thailand.
Associations including the Federation of Thai Industries and the Thai Chamber of Commerce continue to raise concerns about the new legislation placing heavy burdens on the private sector. With the legislation imposing harsh penalties for violation, including jail time, there is a worry the PDPA places disproportionate sanctions on businesses, particularly in comparison to its foreign counterparts.
The postponement comes as a welcome extension for most small and medium sized businesses who remain unprepared for full compliance with the obligations imposed on them under the PDPA. Many associations continue to hope for an amendment to some of the harsher provisions; however, there has been no word from the Cabinet to this effect.