The "Offering Goods and Services to Data Subjects in Jurisdiction" factor is used to determine the applicability of Thailand's Personal Data Protection Act (PDPA) to data controllers and processors located outside of Thailand.

Text of Relevant Provision

Section 5, Paragraph 2 of the PDPA states:

"In the event that a Data Controller or a Data Processor is outside the Kingdom of Thailand, this Act shall apply to the collection, use, or disclosure of Personal Data of data subjects who are in the Kingdom of Thailand, where the activities of such Data Controller or Data Processor are the following activities:

(1) the offering of goods or services to the data subjects who are in the Kingdom of Thailand, irrespective of whether the payment is made by the data subject;"

Analysis of Provision

The provision extends the territorial scope of the PDPA to entities outside Thailand when they offer goods or services to data subjects within Thailand. This extraterritorial application is significant for several reasons:

1. Intent to target Thai market: The phrase "offering of goods or services" suggests that the law applies when there is a clear intention to target the Thai market, rather than incidental access by Thai users.
2. Location of data subjects: The provision specifically mentions "data subjects who are in the Kingdom of Thailand", emphasizing the physical location of individuals at the time of data processing.
3. Irrelevance of payment: The clause "irrespective of whether the payment is made by the data subject" clarifies that the applicability is not contingent on financial transactions. This broadens the scope to include free services or goods.

Implications

This provision has significant implications for businesses operating outside of Thailand:

1. Global reach: Companies worldwide must consider PDPA compliance if they offer goods or services to Thai residents, even if they have no physical presence in Thailand.
2. Online businesses: E-commerce platforms, digital service providers, and online content creators targeting Thai users are likely to fall under PDPA jurisdiction.
3. Language and currency considerations: Offering a Thai language option or pricing in Thai Baht could be indicators of targeting the Thai market, potentially triggering PDPA applicability.
4. Marketing strategies: Companies must be cautious when directing marketing efforts towards Thai consumers, as this could be seen as "offering" goods or services.
5. Data protection measures: Non-Thai entities processing personal data of Thai residents may need to implement PDPA-compliant data protection measures, potentially including appointing a local representative.
6. Compliance challenges: Companies may face challenges in determining whether their activities constitute "offering" goods or services to Thai data subjects, requiring careful assessment of their business practices.