PDPA Compliance

1. Thailand Personal Data Protection Act B.E. 2562 (PDPA) Compliance

Thai Education Foundation adheres fully to the Personal Data Protection Act B.E. 2562 (2019) (PDPA) of Thailand. This compliance notice details the legal grounds for processing personal data, your statutory data subject rights, our data breach incident response procedures, and how you may lodge official requests with our Data Protection Officer (DPO).

2. Lawful Bases for Processing Personal Data

We process personal data strictly under recognized lawful bases defined in Section 24 and Section 26 of the PDPA:

• Consent (มาตรา 19): When you voluntarily submit inquiry forms, donate materials, subscribe to publications, or volunteer for our initiatives.
• Legitimate Interests (มาตรา 24(5)): For maintaining IT security, preventing fraudulent activity or spam, and managing foundation administrative affairs without overriding your fundamental rights.
• Legal Obligations (มาตรา 24(6)): For non-profit foundation reporting, accounting verification, and compliance with Ministry of Interior foundation regulations.

3. Statutory Data Subject Rights Under PDPA

As a data subject under Thailand's PDPA, you possess the following enforceable statutory rights:

• Right of Access (มาตรา 30): Request confirmation and obtain certified copies of your personal data held by TEF.
• Right to Rectification (มาตรา 35): Request corrections to ensure your data is kept accurate, complete, and up to date.
• Right to Erasure / Deletion (มาตรา 33): Request deletion or de-identification of your personal information when retention is no longer necessary.
• Right to Restriction of Processing (มาตรา 34): Request restriction of the use of your personal data under legal conditions.
• Right to Data Portability (มาตรา 31): Request your data in a commonly used, machine-readable format.
• Right to Object (มาตรา 32): Object at any time to the processing of your data for communication or statistical research.
• Right to Withdraw Consent (มาตรา 19 วรรคห้า): Revoke consent previously given at any time without negative consequence.

4. Consent Withdrawal & Request Submission Protocol

You may exercise any of your data subject rights without fee by submitting a written request to our DPO. TEF will verify your identity, process the request, and notify you of the outcome within 30 days as required by statutory standards.

5. 72-Hour Data Breach Incident Notification

In the unlikely event of a verified personal data breach presenting risks to individuals, TEF maintains an emergency protocol to report the incident to the Office of the Personal Data Protection Committee (PDPC) without undue delay and, where feasible, within 72 hours. If the breach poses a high risk to rights and freedoms, affected data subjects will be notified immediately alongside remedial guidance.

6. Data Protection Officer (DPO) Contact Information

For all matters regarding formal PDPA compliance, statutory rights, or regulatory oversight, please direct communications to: