Since the enforcement of Thailand’s Personal Data Protection Act B.E. 2562 (2019) (“PDPA”)from June 1st, 2022, the Personal Data Privacy Commission (“PDPC”), under the Digital Economy and Society (“DES”), subsequently announced the four organic laws (“Notifications”) to clarify certain issues under the Personal Data Protection Act (“PDPA”).
However, among the four Notifications, the one shall be highlighted out is the one that exempts the small business operators from the enforcement of the PDPA, namely PDPC Notification re; Exemption on Record-Keeping Duties of SMEs B.E. 2565 (“Exemption”), which became effective on June 21st, 2022.
The Exemption excludes the following entities/organizations:
SMEs under the Small and Medium Enterprises Promotion Act B.E. 2543:
|Type Of Enterprise||Type Of Business Operation||Employment/Year||Annual Income|
|Small||Manufacturing business||No more than 50 employees||Not exceed THB 100 million|
|Service providers, wholesalers, and retailers||No more than 30 employees||Not exceed THB 50 million|
|Medium||Manufacturing business||More than 50, but no more than 100 employees||More than 100 million, but does not exceed THB 150 million|
|Service providers, wholesalers, and retailers||More than 30, but no more than 100 employees||More than 50 million, but does not exceed THB 300 million|
(i) Community enterprises;
(ii) Social enterprises;
(iv) Cooperative or a farmer group;
(v) Foundation, association, non-profit organization; or
(vi) Household business.
wever, those exempted SMEs are still required to maintain data processing records in respect of the sensitive personal data.
The other Notifications imposed on the following highlighted matters: