shall be requested from the data subject for the collection, use, or disclosure of personal data
Collection of personal data may be made to the extent necessary under the lawful objective of personal data controller
shall be submitted to the Expert committee
Entry into force
Coming into force 1 year after its publication except Committee and Office shall affect next day publication
Data obtained before the date of coming into force
Data controller can use personal data in accordance with the objectives already notified to the data subject prior to the enforcement of this Act, and must be defined method for cancel consent.
The PDPA does not cover
Any individual acting in a personal use or for his family activities
Limiting Collection, Use, Disclosure
– shall not collect personal data without the consent of the data subject
– provides exceptions for some cases where personal data can be collected without the consent of data subject
– shall inform the data subject of the period of retention of personal data
– shall not collect sensitive personal data or any other data as prescribed by the committee
prescribes the rules on sending or transfer of personal data abroad
Data subject right
To rectify: can request their data be updated or made complete.
To forgot: right to withdraw his or her consent or delete or destroy the data when Data controller fails to comply with the rules under this Act.
To data portability: can request a copy of their data in digital format.