No. 136 Chapter 69 Gor Government Gazette 27 May 2019 The exceptions to apply all or parts of the provisions of this Act to any Data Controller in any manner, business or entity, in a similar manner to the Data Controller in paragraph one, or for any other public interest purpose, shall be promulgated in the form of the Royal Decree. The Data Controller under paragraph one (2) (3) (4) (5) and (6) and the Data Controller of the entities that are exempted under the Royal Decree in accordance with paragraph two shall also put in place a security protection of Personal Data in accordance with the standard. Section 5 This Act applies to the collection, use or disclosure of Personal Data by a Data Controller or a Data Processor that is in the Kingdom of Thailand, regardless of whether such collection, use or disclosure takes place in the Kingdom of Thailand or not. In the event that a Data Controller or a Data Processor is outside the Kingdom of Thailand, this Act shall apply to the collection, use or disclosure of Personal Data of data subjects who are in the Kingdom of Thailand, where the activities of such Data Controller or Data Processor are the following activities: (1) the offering of goods or services to the data subjects who are in the Kingdom of Thailand, irrespective of whether the payment is made by the data subject; or (2) the monitoring of the data subject’s behavior, where the behavior takes place in the Kingdom of Thailand. Section 6 In this Act, “Personal Data” means any information relating to a Person, which enables the identification of such Person, whether directly or indirectly, but not including the information of the deceased Persons in particular; “Data Controller ” means a P erson or a juristic person having the power and duties to make decisions regarding the collection, use, or disclosure of the Personal Data; “Data Processor ” means a Person or a juristic person who operates in relation to the collection, use or disclosure of the Personal Data pursuant to the orders given by or on behalf of a Data Controller, whereby such Person or juristic person is not the Data Controller. “Person” means a natural person; “Committee” means the Personal Data Protection Committee; “Competent Official” means any person appointed by the Minister to perform acts under this Act; “Office” means the Office of the Personal Data Protection Committee; “Secretary-General” means the Secretary-General of the Personal Data Protection Committee; “Minister” means the Minister who is in charge under this Act. Section 7 The Minister of Digital Economy and Society shall be in charge under this Act, and shall have the power to appoint the Competent Official to perform acts under this Act. 3