A controller outside Thailand that is subject to the Act under section 5 paragraph two (offering goods or services to, or monitoring the behaviour of, data subjects in Thailand) must appoint in writing a representative in Thailand authorised to act for it without any limitation of liability for its processing. Under section 38 this does not apply to a controller that is a public authority prescribed by the Committee, or one whose business of processing personal data involves no section 26 data and no large amount of personal data as prescribed under section 41(2); the same duty and exemptions apply to such a foreign controller's processor.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.