Last review date: January 2025
Yes.
The following are potential legal bases for processing personal data:
☒ the data subject has provided consent to the processing for the identified purposes
☒ the personal data is necessary to perform a contract with the data subject
☒ the personal data is necessary to comply with a legal obligation
☒ the personal data is necessary to protect the vital interests of a natural person
☒ the personal data is necessary for a public interest
☒ the personal data is necessary to fulfil a legitimate interest of the controller or third party (provided that the interest is not overridden by the data subject's privacy interests and the data subject has not made use of his/her right to object)
☒ other
Personal data is necessary for preparing historical documents or archives of public interest, for research, or for statistical purposes. Suitable measures to safeguard the data subject's rights and freedoms should be implemented in accordance with the notification prescribed by the Personal Data Protection Committee.
Last review date: January 2025
Yes
The following are potential legal bases for processing sensitive personal data:
☒ the data subject has given explicit consent to the processing
☒ processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent
☒ processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and further conditions
☒ processing relates to personal data which are manifestly made public by the data subject
☒ processing is necessary for the establishment, exercise or defense of legal claims
☒ other
The PDPA provides certain additional legal bases for processing sensitive data similar to the above non-ticked boxes, but subject to criteria.
Last review date: January 2025
Yes.
A minor within the meaning of data privacy laws is a person below the age of 20.
- A person below the age of 10
- A person who is over 10 years of age (but younger than 20 years of age), but who is not yet sui juris by marriage or has no capacity as a sui juris person under section 27 of the Thai Civil And Commercial Code; unless certain exceptions apply (e.g., the act is a juristic act suitable to the minor's condition in life and actually required for the minor's reasonable needs).