Since the enforcement of Thailand’s Personal Data Protection Act B.E. 2562 (2019) (“PDPA”)from June 1st, 2022, the Personal Data Privacy Commission (“PDPC”), under the Digital Economy and Society (“DES”), subsequently announced the four organic laws (“Notifications”) to clarify certain issues under the Personal Data Protection Act (“PDPA”). 

However, among the four Notifications, the one shall be highlighted out is the one that exempts the small business operators from the enforcement of the PDPA, namely PDPC Notification re; Exemption on Record-Keeping Duties of SMEs B.E. 2565 (“Exemption”), which became effective on June 21st, 2022.

The Exemption excludes the following entities/organizations: 
SMEs under the Small and Medium Enterprises Promotion Act B.E. 2543:

Type Of EnterpriseType Of Business OperationEmployment/YearAnnual Income
SmallManufacturing businessNo more than 50 employeesNot exceed THB 100 million
Service providers, wholesalers, and retailersNo more than 30 employeesNot exceed THB 50 million
MediumManufacturing businessMore than 50, but no more than 100 employeesMore than 100 million, but does not exceed THB 150 million
Service providers, wholesalers, and retailersMore than 30, but no more than 100 employeesMore than 50 million, but does not exceed THB 300 million

(i) Community enterprises;
(ii) Social enterprises;
(iv) Cooperative or a farmer group;
(v) Foundation, association, non-profit organization; or
(vi) Household business.

wever, those exempted SMEs are still required to maintain data processing records in respect of the sensitive personal data.

The other Notifications imposed on the following highlighted matters:

For further information, please contact [email protected] or [email protected]:  

Bunnasomboon (Aaron) Chaiparinya
[email protected]