Take up a ‘blue-ocean’ career as a DPO in Thailand

A career as a data protection officer, or DPO, will soon be highly sought-after in Thailand, says a data privacy consultant and academic. 

Dr Natharika Chan, Dean of the School of Law at the University of the Thai Chamber of Commerce (UTCC), made these remarks as she reflected on the Thai Personal Data Protection Act (PDPA) coming fully into force in June last year.

Since then, she and her fellow professors at the UTCC law school have started conducting data protection courses for the Thai market, to help operationalise the data protection law and establish high standards for data protection careers in the country.

To catch up on the background and development of the Thai PDPA, check out our earlier two-part Q&A or our Thai PDPA video series.

Thai personal data has been leaked

Watch the interview video with Kevin Shepherdson & Dr Natharika Chan here.

In recent years, awareness of data protection principles and data breaches has grown in Thailand.

The latest in a number of publicised data leaks was a hack that has compromised the personal data of 55 million Thais. This data has been claimed to include names, surnames, dates of birth, identity card information and telephone numbers.

With the creation of the Office of the Personal Data Protection Committee (PDPC) and the passage of the Thai PDPA law, the appointment of data protection officers is mandatory under certain conditions.

Dr Natharika, who was one of the instructors of the first run of a Data Protection Officer - Hands-on Workshop in Bangkok last year, believes that the role of the DPO is already beginning to be in great demand.

“It’s like a blue ocean. It’s a new job title that people here will want to try to work on [getting],” she said, adding that the School of Law has recently focused on teaching about the Thai PDPA “because of our background in research, short courses and consulting, for both public and private sectors.”

“With all the knowledge and experience that we have in this area, we decided that we wanted to share this with other [organisations] in Thailand,” she said.

Taking the first ‘baby steps’

“We just launched a new ‘baby’ last year,” said Dr Natharika, referring to the Thai PDPA. “So compared to other countries, we still have a lot of room to grow, about awareness. Big companies, especially, they see the importance of data protection. They are ready [to start complying with] the PDPA.”

However, Thailand’s economy, she pointed out, is largely driven by small and medium businesses, which will be of her team’s biggest concern to begin with, in terms of catering to their needs.

As for the appointment of DPOs, Dr Natharika noted that so far, based on guidelines that have been published, there are no rules or required qualifications for the training and certification of such officers.

“So for those who want to become a DPO, I think [now] it’s a good opportunity and there’s going to be high demand,” she said.

Dr Natharika added her observation that current or new DPOs tend to be appointed in-house, a person selected who may not have the knowledge, skills or experience to handle the operational aspects of data protection.

Learn more about the Data Protection Officer - Hands-on Workshop for Thailand, held in partnership with the UTCC.

Do DPOs have to be legal or technical professionals?

One of the misconceptions the professor has encountered is that people perceive that for one to become a DPO, one has to have a legal or informational technology background.

“Actually, it is a misunderstanding, because sometimes PDPA compliance can relate to human resource or IT processes and policies, and may not require a purely legal perspective,” she said.

Liked this story? Sign up for a FREE membership at the Data Protection Excellence (DPEX) Network and get regular data protection and data governance news, industry updates, and resources.