Theory: PDPA & GDPR
Classification and safeguards (7.2) are good practice. In Thailand, much of this practice is also a legal obligation under the Personal Data Protection Act (PDPA). Because MediCare Plus may also have foreign patients, partners or a foreign cloud vendor, we then compare PDPA with the law it was largely modelled on, the EU’s General Data Protection Regulation (GDPR).
PDPA Overview
Personal Data Protection Act B.E. 2562 (2019) is Thailand’s data protection law. It was enacted in 2019, and full enforcement began in 2022.
Scope. PDPA applies to any organization that collects, uses or discloses personal data of people in Thailand, regardless of where the organization is based. This is called extraterritorial scope, similar to GDPR.
MediCare Plus is high-exposure: health data is sensitive personal data under PDPA, and is held to a higher protection standard than ordinary personal data (such as a name or phone number). Other categories of sensitive data include biometric and genetic data, religious beliefs and criminal records.
Location, not nationality (PDPA Section 5)
PDPA protects personal data of data subjects who are in Thailand, whatever their nationality. A Japanese engineer treated at MediCare Plus while working in Bangkok is protected exactly like a Thai patient. Section 5 covers:
- controllers and processors in Thailand, whether or not the processing itself takes place in Thailand; and
- controllers and processors outside Thailand that offer goods or services to data subjects in Thailand or monitor their behaviour in Thailand.
Common mistake: “PDPA protects Thai citizens.” It does not depend on citizenship. What matters is where the data subject is and where the controller/processor operates or targets, not the passport.
Three Core Principles
| Principle | Meaning | MediCare Plus example |
|---|
| Consent | Clear, informed consent is required before collecting or using data (with limited legal exceptions, e.g. saving a life) | An unconscious emergency patient can be treated and their records used without consent, because a life is at stake |
| Purpose limitation | Data may be used only for the purpose stated when consent was obtained | Phone numbers collected for appointment booking must not be used for promotion SMS (Situation 4, see 7.1) |
| Data minimization | Collect only what is necessary for the stated purpose, not “just in case” | The booking form should not require a national ID number |
Data Subject Rights
The data subject is the person the data is about (the patient). Under PDPA they have the right to:
| Right | What it lets the person do |
|---|
| Access | Get a copy of their personal data and know how it is used |
| Rectify | Have inaccurate or incomplete data corrected |
| Erase / restrict | Have data deleted, or its use limited, when there is no longer a lawful reason to keep or use it |
| Object | Object to certain uses, especially direct marketing |
| Data portability | Receive their data in a usable format, or have it sent to another organization |
Rights come with legal conditions attached. A patient may ask to be removed from marketing lists, and the hospital must comply. But they cannot demand deletion of the medical record itself, because the law requires the hospital to retain it.
Controller vs. Processor
| Role | Who | Responsibility |
|---|
| Data Controller | MediCare Plus | Decides how and why data is collected and used. Primary responsibility. |
| Data Processor | e.g. a cloud storage vendor | Processes data on the controller’s instructions |
The controller cannot hand off its responsibility simply by outsourcing. If MediCare Plus gives patient data to a vendor, it must make sure the vendor protects it (contracts, instructions, security requirements). The processor in turn must follow those instructions and keep the data secure.
Exam tip: ask “who decides why this data is processed?” That party is the controller. A party that only carries out someone else’s instructions (storing, printing, mailing) is a processor.
Penalties & Real Cases
PDPA has three types of penalty:
| Type | What it means |
|---|
| Civil | Compensation for damages to the affected people (courts may add punitive damages of up to twice the actual damages) |
| Administrative | Fines imposed by the regulator, up to several million baht (maximum THB 5 million per violation) |
| Criminal | Imprisonment and/or fines for serious, intentional disclosure of sensitive data |
Example enforcement cases from Thailand’s regulator (PDPC):
- An online retailer was fined THB 7,000,000: no Data Protection Officer (DPO), inadequate security, and a leak that reached call-center scammers. (Several violations were fined together, which is how the total exceeds the per-violation maximum.)
- A private hospital was fined THB 1,210,000 after over 1,000 patient records leaked through improper disposal by a vendor. The hospital (controller) was still held responsible for its processor’s failure.
The Data Lifecycle: Finding the Gaps
To comply, an organization maps every stage personal data passes through, then compares existing practice with what PDPA requires (a gap analysis).
Diagram loads as you scroll.
| Stage | PDPA question to ask (MediCare Plus) |
|---|
| Collection | Do we have consent and a stated purpose? Are we collecting only what is needed? |
| Store | Is it stored securely, matched to its classification? |
| Use | Is every use within the stated purpose? |
| Transfer | Do vendors (processors) have proper instructions and protection? Is the channel secure? |
| Archive | Is retained data still needed, reviewed and protected? |
| Destruction | Is data securely destroyed when no longer needed (including by vendors)? |
Steps: (1) identify the data in each existing process, (2) find the gap between existing practice and PDPA, (3) close it.
GDPR: The Global Reference Point
General Data Protection Regulation (GDPR), EU, in force since 2018. Much of PDPA’s structure is based on it: consent, data subject rights, controller/processor.
GDPR is also extraterritorial: an organization outside the EU can still be required to comply. Like PDPA, GDPR turns on location, not nationality. It applies to organizations established in the EU, and to organizations outside the EU that offer goods or services to people who are in the EU or monitor their behaviour in the EU. An EU citizen living and being treated in Thailand does not bring GDPR with them; an EU resident targeted by a Thai hospital’s online marketing in Europe might.
GDPR vs. PDPA Side by Side
| GDPR (EU) | PDPA (Thailand) |
|---|
| In force since | 2018 | 2022 (full enforcement) |
| Scope | Data of people in the EU | Data of people in Thailand |
| Maximum penalty | Up to 4% of global annual revenue or €20 million, whichever is higher | Administrative fines in the millions of baht, plus civil and criminal penalties |
| Sensitive data | Special category data (health, biometric, …) | Sensitive personal data (similar) |
| Shared structure | Consent, data subject rights, controller/processor | Same core structure |
Worked Examples
Exercise 1
MediCare Plus collects patients’ LINE IDs at registration, then adds them as friends to send promotional messages. Which PDPA principle(s) does this violate?
Show solution ↓Hide solution ↑
Solution
Step 1: What was the stated purpose of collection? Registration, i.e. contacting the patient about care (appointments and results).
Step 2: Check each principle.
- Purpose limitation: promotions are a new purpose the patient was never told about. Violated.
- Consent: patients consented (at most) to contact about care, not to marketing. No separate, informed consent for promotions. Violated.
- Data minimization: if the hospital already has a phone number for contact, collecting a LINE ID mainly to enable marketing is collecting more than the care purpose needs. Likely violated.
Answer: purpose limitation and consent are violated (data collected for care was reused for marketing without consent), and data minimization is likely violated too (collecting LINE IDs beyond what the care purpose requires).
Exercise 2
A former patient sends MediCare Plus three requests: (a) “Remove me from your marketing lists.” (b) “Delete my entire medical record.” (c) “Correct my date of birth; it is wrong.” Which data subject rights are involved, and must the hospital comply with each?
Show solution ↓Hide solution ↑
Solution
Remember: rights come with legal conditions attached.
- (a) This is the right to object (to direct marketing) and to have that use stopped. Marketing is not needed for care and has no overriding legal basis. Must comply.
- (b) This is the right to erasure. But the law requires the hospital to retain medical records, and that legal obligation overrides the erasure request. Does not have to delete the medical record (it should explain why, and may restrict non-essential uses).
- (c) This is the right to rectification. Inaccurate data, especially in a medical record, must be corrected. Must comply.
Answer: (a) right to object, comply; (b) right to erasure, refused for the medical record because the law requires retention; (c) right to rectification, comply.
Exercise 3
Identify the data controller and the data processor in each arrangement, and say who carries primary responsibility:
- MediCare Plus stores its patient database with a cloud storage vendor.
- MediCare Plus hires a shredding company to destroy old paper records.
Show solution ↓Hide solution ↑
Solution
Ask: who decides why and how the data is processed?
- MediCare Plus decides what patient data is collected and why; the cloud vendor only stores it as instructed. Controller = MediCare Plus, processor = cloud vendor.
- MediCare Plus decides which records must be destroyed; the shredding company only carries out that instruction. Controller = MediCare Plus, processor = shredding company.
In both cases the controller, MediCare Plus, has primary responsibility. The real THB 1,210,000 fine against a private hospital, after a vendor’s improper disposal leaked over 1,000 patient records, shows that a controller is penalized for its processor’s failure.
Answer: in both, MediCare Plus is the controller (primary responsibility) and the vendor is the processor acting on its instructions.
Exercise 4
Match each consequence to the PDPA penalty type (civil, administrative, criminal):
- The regulator fines an online retailer THB 7,000,000 for lacking a DPO and inadequate security.
- Leaked patients sue the hospital for the financial losses and distress the leak caused them.
- A staff member who intentionally sold patients’ HIV test results for profit faces prosecution.
Show solution ↓Hide solution ↑
Solution
- Administrative penalties are fines imposed by the regulator for failing obligations. Item 1. Administrative.
- Civil penalties are compensation for damages paid to the people harmed. Item 2. Civil.
- Criminal penalties apply to serious, intentional disclosure of sensitive data. HIV status is health data (sensitive), disclosed deliberately for gain. Item 3. Criminal.
Answer: 1 = administrative, 2 = civil, 3 = criminal.
Exercise 5
Apply the location, not nationality principle. Does PDPA and/or GDPR apply?
- A French tourist is treated at MediCare Plus in Bangkok.
- A Thai citizen living in Germany has her data processed by a German online pharmacy.
- MediCare Plus runs targeted online ads and an English booking site aimed at residents of Germany, offering health-checkup packages, and collects their booking details.
Show solution ↓Hide solution ↑
Solution
The test is where the data subject is and where the organization is established or whom it targets, never citizenship.
- The patient is in Thailand and MediCare Plus is a Thai controller, so PDPA applies. GDPR does not follow her French citizenship: the hospital has no EU establishment and is not targeting people in the EU. PDPA only.
- The pharmacy is established in the EU, so GDPR applies. Her Thai nationality does not bring PDPA with her; she is not in Thailand and the pharmacy is not targeting people in Thailand. GDPR only.
- MediCare Plus is outside the EU but is offering services to people in the EU, so GDPR’s extraterritorial scope is triggered for that data. PDPA also applies to MediCare Plus as a Thai controller. Both.
Answer: 1 = PDPA only, 2 = GDPR only, 3 = both PDPA and GDPR.
Exercise 6
Using the data lifecycle (collection, store, use, transfer, archive, destruction), perform a quick PDPA gap analysis for MediCare Plus’s online appointment booking process, given: the form requires a national ID number; bookings are stored in a spreadsheet on a shared drive open to all staff; old bookings are never deleted.
Show solution ↓Hide solution ↑
Solution
Go stage by stage, comparing existing practice to PDPA.
| Stage | Existing practice | Gap | Fix |
|---|
| Collection | National ID required | Data minimization: not needed to book | Remove the field; collect name, contact, preferred time |
| Store | Spreadsheet open to all staff | Security not matched to classification | Restrict access to the booking team (RBAC, least privilege) |
| Use | Used for appointments | No gap stated (watch for purpose creep) | Keep use limited to booking |
| Transfer | Not described | Check any vendor sharing | Processor instructions if a vendor is used |
| Archive / Destruction | Never deleted | Data kept longer than the purpose needs | Set a retention period and securely destroy old bookings |
Answer: the main gaps are over-collection at collection (national ID), weak access control at storage (shared drive open to all), and no retention/destruction rule; fix by minimizing fields, restricting access, and setting retention with secure destruction.