The Problems of Data Security Measures under The Framework of the Personal Data Protection Act

Abstract

In the digital age, personal data is regarded as a valuable asset at both individual and organizational levels. This data is collected, processed, and utilized in various forms, including personal information, contact information, financial details, and health records, all of which play a critical role in business activities and public service delivery. However, breaches of personal data have emerged as significant threats in the digital era. Cybercriminals may employ tactics such as malware, phishing, and data theft to gain unauthorized access to confidential information, causing substantial harm to individuals and organizations alike. This often results in financial losses, reputational damage, and heightened security risks. While Thailand’s Personal Data Protection Act B.E. 2562 (PDPA) was enacted to protect the rights of data owners and promote the management of personal data in alignment with international standards, challenges remain. When compared to the European Union’s General Data Protection Regulation (GDPR), limitations in the enforcement of the PDPA in Thailand become evident, particularly regarding the clarity of its application and the absence of modern security measures capable of responding to rapidly evolving threats.

This study aims to analyze and compare the enforcement of Thailand's Personal Data Protection Act (PDPA) with the European Union’s General Data Protection Regulation (GDPR) and Singapore’s personal data protection laws. Using a qualitative research methodology, including in-depth interviews and secondary data analysis, the findings suggest that aligning PDPA implementation with international standards—such as intensifying personnel training, developing clear and accessible guidelines, and strengthening security measures in accordance with ISO 27001—would enhance PDPA compliance in Thailand. This research recommends that Thailand improve its enforcement mechanisms and augment its capacity to protect personal data, thereby addressing current cyber threats and fostering trust in data security within the digital age.