Thailand’s Personal Data Protection Act BE 2562 (PDPA) will come into full effect on 1 June 2021 and will bring significant changes to the current data protection regulatory environment in Thailand. This creates challenges for organisations doing business in Thailand both before and after the deadline.

 

The PDPA’s scope and requirements are deep and complex, and it takes time for companies to become fully compliant. This means companies should act now, taking a programmatic risk-based approach to data protection so they’re able to demonstrate progress and accountability to the regulators and to society.

PwC Thailand launched its PDPA survey in August 2020 to explore how ready companies were for PDPA enforcement in June 2021, along with the key challenges companies face on their PDPA journey.

The 25-question survey was sent to organisations across different industries in Thailand and was available to respondents through September 2020.

Here are the highlights of our findings.

 

Personal data protection is a global hot topic, and it’s becoming an important issue on the agenda of Thailand’s leaders. They know there needs to be careful planning and well thought-out changes to their organisations’ processes. There’s no other way that personal data can be managed and protected to ensure compliance and demonstrate accountability.

Our survey results showed that despite there being some challenges to overcome, companies in Thailand have a good awareness of data privacy issues and requirements and have made some progress overall. We can see the start is there, but there’s still a lot to be done.

To fully prepare for June 2021 and beyond, companies must adopt an approach across all impacted areas and functions, with adequate resources and clear ownership and responsibilities.

To see data protection and privacy as simply a compliance exercise is missing an opportunity that the data can present. There’s opportunity to accelerate growth and solve business issues, as well as build trust with customers, business partners, employees and investors. It takes time to protect personal data, but it’s well worth the effort.