People – Process – Technology: Implementing PDPA in an organization

People – Process -Technology

People (finding the right people), Process (the procedures), and Technology (the necessary and required technologies)

The priorities are as follows: People are the main component, followed by processes, and then technology  

Working together requires people to have a shared goal and a common objective

Working with data is not a hobby; it's something you can do when you have free time from other tasks. It requires time to study and understand data, organizational processes, and the technologies used for data analysis

Today, organizational processes must adapt to external environments and constantly changing technology. Therefore, the people who are key components of the organization must also adapt. Furthermore, working with data is the responsibility of everyone in the organization, not just one person or department

A clear example of this today is the enactment of personal data protection laws

This law affects all organizations in Thailand, and all will have to adapt

The impact that will occur in the short term [1]

– Increased costs

– Increases the complexity of management

– Increases the risk

As for the long-term effects [1]

– It leads to increased efficiency in management

– Organizational credibility

The roles and responsibilities of each department in complying with the PDPA [1]

1. The Human Resources department, or personnel department, which manages employee or staff information

2. Marketing department, sales department, advertising department, public relations department, and customer relations department, which handle customer information or visitors

3. The Purchasing and Procurement Department, which manages supplier information

4. The Accounting and Finance department, which handles income and expenditure data for employees, customers, and business partners

5. Information Technology Department, responsible for the organization's website, databases, and various software programs

6. Data Protection Officer, or someone with knowledge of PDPA within the organization, or an outsourced personnel

Things to do in accordance with the PDPA [1]

1. Privacy Policy and Privacy Notice

2. Implement improvements regarding the processing of personal data (how it is obtained, what is collected, and how it is used)

   2.1 Contracts, Agreements, and Forms

   2.2 Business Processes (Business Flow / Business Activity)

   2.3 IT Systems and Software (Hardware / Software / Network / System)

3. Securing personal data

   3.1 Risk Assessment

   3.2 Measures for ensuring the security of personal data

4. Measures to support requests for the use of personal data (Data Subject Request)

5. Measures for reporting and notifying of personal data breaches (Data Breach Management)

Source: 

[1] Dr. Udomthip Phraikaset, E-learning “Project to promote management skills regarding PDPA practices for the business sector” (PDPA>SME), organized by the Digital Economy Promotion Agency (depa) in collaboration with the Thai SME Federation Association and partners

Thank you for the excellent project and the PDPA knowledge that will be put into practice within the organization

Ms. Nuchanat Rongrong

Managing Director, R&D BI Co., Ltd

Collection of Business Analytics