NHSO English Website

Website Policy

This page sets out the National Health Security Office’s Personal Data Protection Policy and Guidelines B.E. 2565 (2022) — the principles and rules of practice the Office follows to protect personal data in its care.

Announcement of the National Health Security Office

Re: Personal Data Protection Policy and Guidelines of the Office, B.E. 2565 (2022)

Whereas it is deemed appropriate to establish a personal data protection policy and guidelines for the National Health Security Office in compliance with the Royal Decree Prescribing Rules and Procedures for Electronic Transactions of the Public Sector B.E. 2549 (2006), which requires government agencies to prepare personal data protection policies and guidelines, and with the law on personal data protection, which prescribes generally accepted principles, mechanisms and supervisory measures for the protection of personal data;

By virtue of Section 31, paragraph one, and Section 36 (2) of the National Health Security Act B.E. 2545 (2002), in conjunction with Sections 6 and 7 of the Royal Decree Prescribing Rules and Procedures for Electronic Transactions of the Public Sector B.E. 2549 (2006), the Secretary-General of the National Health Security Office hereby issues the following Announcement.

Clauses 1–3: Title, Effective Date and Definitions

Clause 1. This Announcement shall be called the "Announcement of the National Health Security Office Re: Personal Data Protection Policy and Guidelines of the Office, B.E. 2565 (2022)".

Clause 2. This Announcement shall come into force on 1 April B.E. 2565 (2022).

Clause 3. In this Announcement:

"Office" means the National Health Security Office, including its branch offices.

"Secretary-General" means the Secretary-General of the National Health Security Office.

"Personnel" means personnel under the Regulation of the National Health Security Board on Personnel Administration.

"Policy" means the principles on personal data protection established and promulgated by the Office.

"Guidelines" means the rules of practice on personal data protection established and promulgated by the Office, to be strictly complied with by users.

"Person" means a natural person.

"Personal Data" means any information relating to a person which enables the identification of that person, whether directly or indirectly, but does not include the information of deceased persons in particular, in accordance with the law on personal data protection.

"Data Subject" means the person who owns the personal data or a person lawfully entitled thereto.

"Data Controller" means the Office, which has the power and duty to make decisions regarding the collection, use or disclosure of personal data.

"Data Processor" means a person who carries out activities in accordance with the orders of, or on behalf of, the data controller in the form of "requesting consent from the data subject", and the collection, use, disclosure and security of data, in accordance with the appropriate procedures or measures prescribed by the data controller. Such person shall not be a data controller.

"Data Protection Officer" means personnel or an external person with knowledge of the law on personal data protection, an understanding of the organization's data processing activities and of information technology and security, knowledge of the organization, and the ability to build a culture of personal data protection within the organization.

"Anonymized Data" means data or a data set that has been rendered, by technical means, no longer capable of identifying a person.

Clauses 4–12: Components of the Policy and Guidelines

Clause 4. The Personal Data Protection Policy and Guidelines of the Office shall comprise:

  1. Identification and classification of personal data;

  2. Use or processing of personal data;

  3. Guidelines on the duties and responsibilities of the data controller, the data processor and the data protection officer;

  4. Guidelines on personal data protection impact assessment;

  5. Guidelines on the transfer of personal data to a foreign country or an international organization;

  6. Guidelines on data anonymization.

Clause 5. Where any law, rule, regulation, by-law or announcement on personal data protection or electronic transactions prescribes a personal data protection policy and guidelines otherwise, such law, rule, regulation, by-law or announcement shall prevail.

Clause 6. The identification and classification of personal data shall comprise:

  1. Definition and scope of personal data;

  2. Inspection of personal data;

  3. Sources, linkages and flows of personal data within the Office;

  4. Determination of personal data risks;

  5. Determination of personal data protection measures;

  6. Personal data of a particularly sensitive nature.

Clause 7. The use or processing of personal data shall require the consent of the data subject, subject to the following principles (lawful bases):

  1. Consent;

  2. Contract;

  3. Vital interest;

  4. Public task;

  5. Legitimate interest;

  6. Legal obligation;

  7. Historical documents, archives, and research or statistics.

Clause 8. There shall be guidelines on the duties and responsibilities of the data controller, the data processor and the data protection officer, as follows:

  1. Guidelines on the general rights and duties of the data controller;

  2. Guidelines on the general rights and duties of the data processor;

  3. Guidelines on the general rights and duties of the data protection officer;

  4. Guidelines on the preparation of agreements between the data controller and the data processor;

  5. Guidelines for the data controller on receiving requests from data subjects to exercise their rights;

  6. Guidelines on handling requests from data subjects to exercise their rights;

  7. Guidelines for the data processor upon a request by a data subject;

  8. Guidelines on handling requests from the State or government officials;

  9. Civil liability, criminal liability and administrative penalties.

Clause 9. A personal data protection impact assessment shall involve the following steps for consideration:

  1. Scope of the personal data protection impact assessment;

  2. Procedures for the personal data protection impact assessment.

Clause 10. The transfer of personal data to a foreign country or an international organization shall be subject to the rules and conditions as to whether the destination country or international organization has adequate personal data protection standards.

Clause 11. To prevent the loss of, and unauthorized or unlawful access to, use, alteration, modification or disclosure of personal data, measures or procedures to prevent personal data breaches shall be established by rendering the data anonymized.

Clause 12. To ensure that the Office's personal data protection is carried out effectively and can be implemented in practice, the Office's Personal Data Protection Guidelines shall be as detailed in the annex to this Announcement.

Clauses 13–16: Contact, Responsibilities, Review and Interpretation

Clause 13. Should a data subject have any questions, suggestions or comments regarding the Office's Personal Data Protection Policy and Guidelines, he or she may contact the Data Controller or the Data Protection Officer at the National Health Security Office, No. 120, 2nd–4th Floors, Moo 3, Ratthaprasasanabhakti Building, The Government Complex Commemorating His Majesty the King's 80th Birthday Anniversary, 5th December B.E. 2550 (2007), Chaeng Watthana Road, Thung Song Hong Sub-district, Lak Si District, Bangkok 10210. Telephone: 02 141 4000. Fax: 02 143 9730-1. Website: www.nhso.go.th

Clause 14. The internal units of the Office involved in the collection, storage, use, disclosure or any other operation relating to personal data shall be responsible for storing and protecting the personal data they hold, in strict compliance with this Announcement.

Clause 15. The Personal Data Protection Committee of the Office shall review the Office's Personal Data Protection Policy and Guidelines to keep them up to date at least once a year.

Clause 16. In the event of any problem concerning compliance with this Announcement, the Secretary-General shall have the authority to make a final decision, and may first assign the Personal Data Protection Committee of the Office to consider the matter and give its opinion.

Announced on 27 April B.E. 2565 (2022).