The PDPC Notification on Exemptions of Recording for Small and Medium-sized Business Data Controllers 26^th December 2024 (Notification for DC) and the PDPC Notification on Exemptions of Preparing and Maintaining Records of Personal Data Processing Activities for Small and Medium-sized Business Data Processors 26^th December 2024 (Notification for DP) were published in the Royal Gazette on 8^th January 2025.  The Notification for DC will come into force on 8^th April 2025.  The Notification for DP came into force on 9^th January 2025.  We summarized their key provisions as follows.

The Notification for DC exempts SME data controllers from the duty to record lists of processing activity under Section 39 paragraph one (1), (2), (3), (4), (5), (6), and (8) of the PDPA.

The Notification for DP exempts SME data processors from the duty to prepare and maintain ROPA under Section 40 paragraph one (3) of the PDPA.

SME data controllers and SME data processors who are exempt from the duties mentioned above are the following entities:

(1)   an SME under the law on promotion of small and medium-sized enterprises;

(2)   a community enterprise or a community enterprise network under the law on promotion of social enterprises;

(3)   a social enterprise or social enterprise group under the law on promotion of social enterprises;

(4)   a cooperative, cooperative union, or farmer group under the law on cooperatives;

(5)   a foundation, association, religious organization, or non-profit private organization;

(6)   a juristic person of a condominium under the Condominium Act or a juristic person of a housing estate under the Land Development Act;

(7)   a household business or other business of similar nature; or

(8)   a business operated by a data controller who is a natural person.

However, SME data controllers and SME data processors are not exempted from their respective duties under Sections 39 and 40 of the PDPA if their data processing: (1) creates risks that may affect rights and freedoms of the personal data subject; or (2) is not occasional; or (3) is of the sensitive personal data under Section 26 of the PDPA.

To see the archive of our past newsletters and articles please click here.