{
  "code": "PDPA-TH",
  "name": "Personal Data Protection Act B.E. 2562 (Thailand)",
  "version": "2019",
  "issuing_body": "Personal Data Protection Committee, Thailand",
  "description": "Thailand's Personal Data Protection Act establishing rights for data subjects and obligations for data controllers and processors",
  "regions": ["th"],
  "industries": ["all"],
  "effective_date": "2022-06-01",
  "is_global": false,
  "requirements": [
    { "reference_code": "S6", "title": "General Principles for Personal Data Processing", "requirement_type": "mandatory", "category": "Principles", "description": "Personal data shall be collected, used, or disclosed under lawful basis and with consideration to purpose limitation, data minimization, accuracy and security." },
    { "reference_code": "S19", "title": "Lawful Basis for Collection", "requirement_type": "mandatory", "category": "Legal Basis",
      "children": [
        { "reference_code": "S19.1", "title": "Explicit consent", "description": "Obtain explicit consent from the data subject prior to collection.", "requirement_type": "mandatory" },
        { "reference_code": "S19.5", "title": "Contract performance", "description": "Processing necessary for performance of a contract to which data subject is party.", "requirement_type": "mandatory" },
        { "reference_code": "S19.7", "title": "Legitimate interest", "description": "Processing necessary for legitimate interests of the controller or third party.", "requirement_type": "mandatory" }
      ]
    },
    { "reference_code": "S23", "title": "Privacy Notice", "requirement_type": "mandatory", "category": "Transparency", "description": "Inform data subjects about the collection, use, or disclosure of personal data before or at the time of collection." },
    { "reference_code": "S27", "title": "Consent Requirements", "requirement_type": "mandatory", "category": "Consent Management", "description": "Consent must be freely given, specific, informed and unambiguous. Consent requests must be clearly distinguishable." },
    { "reference_code": "S30", "title": "Right to withdraw consent", "requirement_type": "mandatory", "category": "Data Subject Rights", "description": "Data subject may withdraw consent at any time; withdrawal shall not affect the lawfulness of processing based on consent before its withdrawal." },
    { "reference_code": "S32", "title": "Right of access", "requirement_type": "mandatory", "category": "Data Subject Rights", "description": "Data subject has right to access and obtain copies of their personal data." },
    { "reference_code": "S33", "title": "Right to data portability", "requirement_type": "mandatory", "category": "Data Subject Rights", "description": "Data subject has right to receive personal data in a commonly used and machine-readable format." },
    { "reference_code": "S36", "title": "Right to erasure", "requirement_type": "mandatory", "category": "Data Subject Rights", "description": "Data subject has right to request deletion of personal data." },
    { "reference_code": "S37", "title": "Right to restriction", "requirement_type": "mandatory", "category": "Data Subject Rights", "description": "Data subject has right to request restriction of processing of personal data." },
    { "reference_code": "S40", "title": "Security Measures", "requirement_type": "mandatory", "category": "Security",
      "children": [
        { "reference_code": "S40.1", "title": "Appropriate technical and organisational measures", "description": "Implement appropriate technical and organisational measures to prevent unauthorized or unlawful processing, accidental loss, destruction or damage.", "requirement_type": "mandatory" },
        { "reference_code": "S40.3", "title": "Data breach notification", "description": "Notify the PDPC of a personal data breach without delay, and not later than 72 hours after becoming aware.", "requirement_type": "mandatory" }
      ]
    },
    { "reference_code": "S44", "title": "Data Processor Requirements", "requirement_type": "mandatory", "category": "Vendor Management", "description": "Processing by a processor shall be governed by a binding contract ensuring that the processor processes personal data only on instructions from the controller." },
    { "reference_code": "S46", "title": "Cross-border transfer restrictions", "requirement_type": "mandatory", "category": "Data Transfers", "description": "Transfer of personal data to a foreign country shall only occur if such country has adequate data protection standards." }
  ]
}