PDPA EXEMPTION FOR SMEs

Since the enforcement of Thailand’s Personal Data Protection Act B.E. 2562 (2019) (“PDPA”)from June 1^st, 2022, the Personal Data Privacy Commission (“PDPC”), under the Digital Economy and Society (“DES”), subsequently announced the four organic laws (“Notifications”) to clarify certain issues under the Personal Data Protection Act (“PDPA”). 

However, among the four Notifications, the one shall be highlighted out is the one that exempts the small business operators from the enforcement of the PDPA, namely PDPC Notification re; Exemption on Record-Keeping Duties of SMEs B.E. 2565 (“Exemption”), which became effective on June 21^st, 2022.

The Exemption excludes the following entities/organizations: 
SMEs under the Small and Medium Enterprises Promotion Act B.E. 2543:

Type Of Enterprise	Type Of Business Operation	Employment/Year	Annual Income
Small	Manufacturing business	No more than 50 employees	Not exceed THB 100 million
	Service providers, wholesalers, and retailers	No more than 30 employees	Not exceed THB 50 million
Medium	Manufacturing business	More than 50, but no more than 100 employees	More than 100 million, but does not exceed THB 150 million
	Service providers, wholesalers, and retailers	More than 30, but no more than 100 employees	More than 50 million, but does not exceed THB 300 million

(i) Community enterprises;
(ii) Social enterprises;
(iv) Cooperative or a farmer group;
(v) Foundation, association, non-profit organization; or
(vi) Household business.

wever, those exempted SMEs are still required to maintain data processing records in respect of the sensitive personal data.

The other Notifications imposed on the following highlighted matters:

• Duty of the Personal Data Processor to create and maintain the records of the data processing activities; and
• Security measures to be implemented by the Data Controller.

For further information, please contact [email protected] or [email protected]: