PDPA Thailand S42: Section 42 Duties and protection of the data protection officer

The DPO must (1) advise the controller or processor and their employees or contractors on compliance; (2) examine their processing for compliance; (3) coordinate and cooperate with the Office where problems arise; and (4) keep confidential personal data learned in the role. The controller or processor must support the DPO with adequate tools and equipment and access to personal data, may not dismiss or terminate the DPO for performing their duties, and must let the DPO report problems directly to the highest management. The DPO may hold other tasks only if the controller or processor assures the Office they do not conflict with the DPO duties.