The 2023 royal decree exempting certain activities from parts of the PDPA is a regulation made under Section 4 paragraph two that lifts Chapters 2 and 3 of the Act in defined cases. The PDPC Office told Bank Y it applies when a state agency requests data under legal authority, not to every tax or fraud matter. This article is for compliance teams, DPOs and international payments staff.
- The tax exemption in Section 7 of the decree starts only when the Revenue, Customs or Excise Department requests data under legal authority.
- A customer correcting data at the bank, with no state request, is not a Section 7 case, but PDPA Section 35 still requires accurate data.
- If the bank refuses a correction, Section 36 requires the request and reasons to be logged in the Section 39 record.
- Section 11 of the decree can apply to private controllers, but only for work done under state power or a specific legal duty.
- Exchanges with a foreign correspondent bank about suspected fraud are not exempt; the bank needs a PDPA basis such as Section 24(3).
In 2023 Thailand issued a royal decree setting out the characteristics, activities and agencies exempted from parts of the Personal Data Protection Act B.E. 2562 (2019) (PDPA). Many organisations read the title and assumed it offered a way out of PDPA duties, particularly for tax matters and for fighting transnational crime.
Bank Y asked before relying on it. It sent three questions to the Office of the Personal Data Protection Committee (PDPC Office), and the Committee's advisory sub-committee answered each one. The reasoning applies well beyond banking: to any business that hands data to state agencies or to counterparties abroad.
The opinion is listed on the PDPC Office's page of PDPA advisory opinions, and the original Thai text is in the Bank Y opinion file. The decree itself is published on the PDPC Office's royal decree page.
Where does the PDPA exemption decree come from, and what does it lift?
The decree was made under Section 4 paragraph two of the PDPA, which allows all or part of the Act to be disapplied for certain controllers, activities or agencies, but only by royal decree.
The exceptions to apply all or parts of the provisions of this Act to any Data Controller in any manner, business or entity, in a similar manner to the Data Controller in paragraph one, or for any other public interest purpose, shall be promulgated in the form of the Royal Decree.
In the Bank Y opinion, the PDPC Office explains that a controller meeting the conditions is exempt from Chapters 2 and 3 of the PDPA. Chapter 2 is the protection of personal data, which covers collection, use and disclosure. Chapter 3 is the rights of data subjects.
Even an exempt controller is not outside the Act altogether. Section 4 paragraph three still requires entities exempted by royal decree to keep personal data secure in line with the standard.
The Data Controller under paragraph one (2), (3), (4), (5), and (6) and the Data Controller of the entities that are exempted under the Royal Decree in accordance with paragraph two shall also put in place a security protection of Personal Data in accordance with the standard.
The PDPC Office has applied this rule in practice. Advising the Internal Security Operations Command (ISOC), whose security work falls under the Section 4(2) exemption rather than the decree, the advisory sub-committee said that ISOC must still keep personal data secure to the standard under Section 4 paragraph three. The book of opinions has no English version, so the Thai text is quoted below.
กอ.รมน. ในฐานะหน่วยงานในสังกัด ต้องจัดให้มีการรักษาความมั่นคงปลอดภัยของข้อมูลส่วนบุคคลให้เป็นไปตามมาตรฐานด้วย ทั้งนี้ ตามนัยมาตรา ๔ วรรคสาม แห่งพระราชบัญญัติคุ้มครองข้อมูลส่วนบุคคล พ.ศ. ๒๕๖๒| Question | Provisions | Exempt? | What the bank must do |
|---|---|---|---|
| A customer updates their details directly with the bank. Must the bank resend them to the Revenue Department, which has not asked? | Decree Section 7; PDPA Sections 35 and 36 | Not a Section 7 case | Correct the data under Section 35; if it refuses, log the request and reasons under Section 36 |
| A foreign correspondent bank flags an incoming transfer as possible fraud; the bank replies with the customer's name and account number | Decree Sections 3 and 11 | No, if neither bank uses state power or performs a specific legal duty | Find a PDPA basis, for example necessity for a contract to which the customer is a party |
| A customer's email is hacked and money is sent abroad; the bank messages the correspondent bank to recall it | Decree Section 11 | No, on the same reasoning | Comply with PDPA Chapters 2 and 3 as usual |
Must a bank resend corrected data to the Revenue Department?
Not if the department has not asked and the customer has not said the correction is meant for data the bank previously gave a state agency. The PDPC Office held that this is not a case under Section 7 of the decree.
How Section 7 of the decree works
As the PDPC Office describes it, Section 7 paragraph one has a single trigger. The Revenue Department, the Customs Department or the Excise Department must request personal data from the bank under its legal powers, for tax collection, the enforcement of fees or duties, or international obligations and cooperation on those matters. Only then is the bank's disclosure exempt from Chapters 2 and 3.
Section 7 paragraph two comes later. If the bank has already disclosed data to the department and the data subject then asks for it to be corrected and brought up to date, and the agency received that data from the bank, the bank must correct it and send the corrected data to the agency.
Bank Y's scenario lacked both elements. No department had asked for the corrected data, and the customer had not said the request was about data disclosed to a state agency. There was therefore no duty under Section 7 paragraph two.
The PDPA duty that remains
Falling outside Section 7 does not mean doing nothing. The PDPC Office stressed that the bank still has its duty under PDPA Section 35 to keep customer data accurate. If the data is wrong or out of date, the bank must correct it as the customer asks.
The Data Controller shall ensure that the Personal Data remains accurate, up-to-date, complete, and not misleading.
If the bank decides not to make the correction, Section 36 paragraph one requires it to log the request and its reasons in the Section 39 record, which the opinion calls the Records of Processing Activities (ROPA).
In the case where the data subject requests the Data Controller to act in compliance with section 35, if the Data Controller does not take action regarding the request of the data subject, the Data Controller shall record such request of the data subject together with reasons, in the record as prescribed in section 39.
The opinion adds that the data subject may complain to the Expert Committee, which can order the controller to act, under Section 36 paragraph two read with Section 73. Complaints are filed through the PDPC Office's complaint system.
Does Section 11 of the decree cover private banks?
It can. The PDPC Office noted that Section 3 of the decree defines a data controller as covering both the public and the private sector, so Section 11 is not limited to state agencies.
Being covered is not the same as being exempt. Whether a particular controller is exempt depends on the conditions in Section 11 read with the other laws governing that matter. The opinion gives the law on preventing and suppressing participation in transnational organised crime as an example.
What kind of work Section 11 protects
According to the opinion, Section 11 deals with collection, use and disclosure in six areas: deportation, extradition, international cooperation in criminal justice, preventing and suppressing participation in transnational organised crime, other judicial cooperation, and international justice processes.
The PDPC Office's key observation is that such work generally relies on state power or a legal process, including international law and international agreements. The word "fraud" in a message from abroad does not, by itself, turn the work into a Section 11 activity.
Is replying to a foreign correspondent bank about a suspicious transfer exempt?
No, if neither bank is using state power or carrying out a duty specifically imposed by law for a Section 11 purpose. The PDPC Office treated the Thai bank and the correspondent bank abroad as two data controllers. Exchanging a customer's name and account number between them is subject to Chapters 2 and 3 of the PDPA.
The same answer applies to the third question. When a customer's email is hacked, money is sent abroad, and the bank messages the correspondent bank asking for it back, the PDPC Office saw no exemption either: it is a transaction between banks that involves no state power.
Not exempt: which basis should the bank use instead?
The PDPC Office did not stop the bank from replying or seeking a recall. It said the bank should act within the PDPA, and gave an example basis: where the joint handling with the correspondent bank is necessary to perform a contract to which the data subject is a party.
(3) it is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract;
Our reading: the contract basis fits a recall for a customer whose email was hacked, since the bank sent the money on that customer's own instruction. For an inbound transfer queried from abroad, the bank should record which customer is party to the transaction and how far the data sent out is necessary for it. Where the contract basis does not fit, other Section 24 bases must be assessed case by case. See the lawful basis guide.
How should an organisation read the exemptions in the decree?
As a series of questions, one at a time. The sequence below is our summary of the PDPC Office's reasoning in the Bank Y opinion, not a form the Office has prescribed.
- Who is asking? If it is a state agency, ask which law gives it the power. If it is another bank or a private company, the exemption usually does not apply.
- Does the work match a purpose the decree names, such as taxation under Section 7 or international criminal cooperation under Section 11?
- Is there a specific law or international agreement behind the work? Section 11 must always be read with the other laws on the matter.
- If exempt, the controller must still keep the data secure under PDPA Section 4 paragraph three.
- If not exempt, find a Section 24 basis and record the activity in the Section 39 record.
This matches the Section 7 paragraph one condition the PDPC Office described. If the customer later corrects that data, the bank must send the corrected data to the department under Section 7 paragraph two.
The bank corrects the data under PDPA Section 35, with no duty under the decree to resend it to a tax department.
Neither bank uses state power or a specific legal duty for a Section 11 purpose; a PDPA basis is needed.
The PDPC Office answered in the same way; the bank may consider the contract basis with the customer.
Lessons beyond banking
Insurers, securities firms, payment providers and exporters regularly receive data requests both from state agencies and from overseas counterparties. This opinion separates the two cleanly. A request backed by legal power may fall within the exemption; a request from a counterparty, even one citing fraud, remains ordinary PDPA processing.
The same logic applies when police or investigators ask for customer data: start with the requester's legal authority. See When the police ask for customer data.
Scope of this article
This article describes the decree only as far as the Bank Y opinion explains it. The full text of the decree is not yet in the AIPDPA law library, so open it on the PDPC Office website before applying it to a live matter. An advisory opinion responds to the facts the requester supplied; it is not a court ruling.
Frequently asked questions
Does the PDPA exemption decree apply to private companies?
In some cases. The PDPC Office told Bank Y that Section 3 of the decree defines a controller as covering both the public and private sectors, but whether a controller is exempt depends on the conditions of each section read with the other relevant laws.
Once exempt under the decree, does a controller still owe anything under the PDPA?
Yes. PDPA Section 4 paragraph three requires controllers of entities exempted by royal decree to keep personal data secure in line with the standard, and the exemption discussed in this opinion covers Chapters 2 and 3 only.
A customer asks for a correction, but the bank thinks its records are right. What then?
If the bank does not act on the request, PDPA Section 36 paragraph one requires it to log the request and its reasons in the Section 39 record. The Bank Y opinion notes that the customer may complain to the Expert Committee under Section 36 paragraph two read with Section 73.
Is consent needed to send a customer's name and account number to a foreign bank for a fraud check?
Not necessarily. The PDPC Office found no Section 11 exemption, but the bank may rely on a PDPA basis such as Section 24(3), where it is necessary to perform a contract to which the customer is a party. The basis depends on the facts of each transaction, and the cross-border transfer conditions should also be checked.
A state agency asks for customer data by phone. Can the bank rely on the decree?
The opinion does not address the form of the request, but it stresses that the Section 7 exemption requires a state agency to make the request under its legal powers. Our suggestion: ask the agency to state the empowering law in writing and keep it as evidence for the disclosure.
You have read it. Now get it done
Open the demo account to see the real AIPDPA system with a sample company: RoPA, the 72-hour breach clock, data subject requests, cookie consent and ready-to-use documents, all in one place.
From 2,900 THB/year (11 modules) · all 24 modules from ENTERPRISE at 19,900 THB/year · demo account, no sign-up
No time? Have our lawyers handle it →Kooru's lawyers set it up and act as your DPO
Law and sources
- Personal Data Protection Act B.E. 2562 (2019) — Section 4, para. 2 · 24 (3) · 35 · 36 · 39 · 73
- Summaries of PDPC advisory opinions under the Personal Data Protection Act B.E. 2562 (Office of the Personal Data Protection Committee)
Text in the "The text" boxes is copied word for word from AIPDPA's legal knowledge base, transcribed from the Royal Gazette and official documents; every edit is checked by the system against that base, character by character. English wording is an unofficial translation; the Thai text prevails. This article is general information, not legal advice for a particular case.
Do it in the system
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)