On 14 September 2023, the Notification of the Personal Data Protection Commission (“PDPC”) Re: the Appointment of Data Protection Officer (“DPO”) under Section 41(2)[1] of the Personal Data Protection Act B.E. 2562 (2019) (“PDPA”) B.E. 2566 (2023) (the “Notification”) was published in the Royal Gazette. This Notification sets out the key criteria for when a Data Controller or Data Processor needs to appoint a DPO. This Notification focuses only on cases where core activities consist of processing operations, which require regular or systematic monitoring of personal data on a large scale, similarly with Article 37 (1) (b) of the GDPR.
Regular or Systematic Monitoring of Personal Data
If any core activities of a Data Controller or Data Processor involve tracking, monitoring, analyzing, or profiling that generally processes personal data regularly or…
