Thailand

Section 37(4) requires controllers to notify the Office of a breach within 72 hours of becoming aware where feasible, and to notify affected data subjects without delay where the risk is high.

Section 22 requires customer identification records to be kept for five years after the account closes or the relationship ends, and transaction records for five years from the transaction or recording. Section 22/1 requires due diligence records to be kept for ten years, and lets the Secretary-General order a specific customer's records kept for up to five more years.

Section 20 requires customers to identify themselves before a transaction, and Section 20/1 requires customer due diligence at the first transaction and periodic review until the account is closed or the relationship ends. Section 21/2 requires an institution that cannot complete due diligence to report the case to AMLO immediately.

Section 7 allows life insurance to be undertaken only by a public limited company holding a licence from the Minister with Cabinet approval, and Section 18 bars anyone from acting as a life insurer without a licence.

Section 16(2) lists electronic money among designated payment services, and Sections 16 and 17 require a licence or registration to provide them. Section 19 requires providers that receive money in advance to hold it in separate accounts from their own property.