Privacy Notice
The Office of the Securities and Exchange Commission, Thailand
(SEC Privacy Notice)
This SEC Privacy Notice sets out how the Office of the Securities and Exchange Commission, Thailand (the “SEC Office") handles and processes personal data received from you, including the purposes of collecting, using, disclosing, and processing such personal data, as well as the retention period for such personal data and your rights as a data subject.
1. Collection of personal data from data subjects
This SEC Privacy Notice applies to the following categories of data subjects:
1.1 Business operators and personnel under the SEC Office's supervision, such as securities and derivatives business operators, trustee business operators, professionals, fundraisers/securities-issuing companies/listed companies, crowdfunding portals/initial coin offering (ICO) portals/digital asset business operators, securities exchanges/securities depository center/clearing house, and personnel (individuals) approved by the SEC Office, etc.
1.2 Persons involved in the operations of the SEC Office other than those under item 1.1, such as complainants, whistleblowers/persons providing tip-offs, inquirers, persons wishing to receive information, persons suspected of wrongdoing, persons appearing for inquiry, accused persons, offenders under the Acts/Emergency Decrees within the SEC Office's statutory authority and duties, relevant associations, external agencies from which the SEC Office requests cooperation in law enforcement, persons providing comments on the issuance of notifications/regulations of the SEC Office, job applicants, seminar participants, meeting participants, activity participants, speakers, moderators, coordinators, investors, mass media, foreign agencies, other governmental agencies, contractors/service providers, employees of contractors/service providers, users of the SEC Office's services, persons entering and exiting the SEC Office building, creditors, etc.
1.3 Personnel of the SEC Office, such as natural persons who are employees, workers, interns, consultants, experts, employees of companies engaged by the SEC Office, the SEC Board, the Capital Market Supervisory Board, the Secretary-General, as well as families of employees, workers, and the Secretary-General, etc.
2. Personal data collected by the SEC Office
The SEC Office will collect personal data only to the extent necessary for the performance of its duties, such as:
Personal information | For example, national ID card number/passport number, title, full name (Thai/English), date of birth, nationality, gender, marital status, taxpayer identification number, age, weight, height, place of birth, nickname, photograph, father's/mother's full name, former title, former full name, spouse's full name, children's full names, vehicle registration, trader ID, employee ID, etc. |
Contact information | For example, mobile phone number, email, address as shown on the national identification card, address as shown in the house registration, current address, home telephone number, office telephone number, fax number, position, location, etc. |
Sensitive information | For example, special categories of personal data under Section 26 of the Personal Data Protection Act, including race, religion, criminal record data, etc., and other sensitive information, including records of regulatory breaches/violations. |
Qualification/ education/ training/ experience information | For example, education, employment information/affiliation, position, work history, testing/training history, registration number for approval of domestic auditors/foreign auditors, prohibited characteristics, qualifications used for registration, authority/lack of authority, English /psychological test results, various assessment results/probation evaluation forms from the affiliation, KYC/CDD information, customer profile, suitability test, information under FATCA requirements, etc. |
Financial information | For example, securities holding information, trading account number, salary, other income, real estate holding information, etc. |
Other information | For example, website browsing behavior on the SEC Office's website, photographs from closed-circuit television cameras, video and audio recordings, voice recordings of conversations, computer IP address, etc. |
3. Methods for collecting and receiving personal data
The SEC Office collects and receives your personal data through the following channels:
3.1 Personal data received directly from you when you contact the SEC Office to make inquiries, complete forms, apply for services, or participate in activities.
3.2 Personal data received from your authorization for a company or representative to carry out actions through the online systems provided by the SEC Office for digital services, or for a company or representative to prepare and submit information to the SEC Office.
3.3 Personal data received from the performance of the SEC Office's duties, the performance of contracts, information for supporting actions pursuant to the SEC Office's missions, and the submission of participant names through coordinators for meetings, training sessions, seminars, or other activities.
3.4 Personal data received through data cooperation with government agencies, such as financial regulatory agencies, the Legal Execution Department, the Anti-Money Laundering Office (AMLO), the Department of Special Investigation (DSI), the Office of the Narcotics Control Board (ONCB), the National Anti-Corruption Commission (NACC), the Department of Provincial Administration, and the Department of Business Development.
3.5 Information received from agencies related to the SEC Office, such as audit firms, the Federation of Accounting Professions, the Thai Bond Market Association, and the Stock Exchange of Thailand.
4. Purposes of data processing
The SEC Office collects your personal data for the purposes of supervising and developing the capital market in accordance with the SEC Office's missions. The activities, purposes, and processing bases are classified by work group as follows:
4.1 Work group: Intermediaries, professionals, licensed/registered persons, supervision and inspection of business operators, including related personnel
The processing basis used is Public Tasks, divided into the following activity groups:
Activity group | Purpose |
Licensing of business operators | To grant licenses/register business operators |
Approval of personnel
| To grant approval to personnel |
Receipt of reports from business operators | To supervise and inspect risks related to business operations
|
Review and examination of reports from business operators |
Supervision and inspection of business operators' operations |
Supervision and inspection of IT-related risks of business operators |
Supervision of business operations of juristic persons established under foreign law |
4.2 Work group: Fundraising, securities-issuing companies, ICO issuers, and mergers and acquisitions
The processing basis used is Public Tasks, divided into the following activity groups:
Activity group | Purpose |
Approval of issuers and offerors, including the reporting of sale results | To approve offerings, filings, and reports on the sale results of instruments |
Examination of information concerning tender offers and takeovers | To ensure compliance with laws, rules and regulatory requirements |
Receipt of reports from fundraisers | To ensure compliance with laws, rules and regulatory requirements |
4.3 Work group: Investment management
The processing basis used is Public Tasks, divided into the following activity groups:
Activity group | Purpose |
Approval for the establishment and management of funds (provident funds) | To ensure compliance with laws, rules and regulatory requirements |
Receipt of reports from investment management business operators | To supervise and inspect risks related to business operations |
Review and examination of reports from investment management business operators |
Monitoring information on investors' investment unit holdings | To analyze and examine/study investment behavior |
Examination of foreign investment by private funds/asset management company portfolios | To analyze and review foreign investment by country/instrument |
4.4 Work group: Secondary market trading
The processing basis used is Public Tasks, divided into the following activity groups:
Activity group | Purpose |
Supervision of ThaiBMA | |
Supervision of the SET group (SET/TFEX/ TCH/TSD) |
Research/analysis/risk monitoring/market surveillance using trading data from the secondary market and trading center |
Research/analysis/risk monitoring/market surveillance using trading data from exchanges, brokers, and dealers, and data on deposits/withdrawals/transfers of digital assets and funds in customers' accounts (digital assets) |
4.5 Work group: Law enforcement
The processing basis used is Public Tasks, divided into the following activity groups:
Activity group | Purpose |
Receipt and consideration of complaints and receipt of whistleblowing reports/tip-offs | To receive information that may be used in considering potential violations of law |
Inspection, inquiry, investigation, and actions under relevant laws and regulations | To pursue enforcement actions (settlements/ criminal complaints/administrative sanctions/ administrative orders/civil sanctions) |
Criminal actions, imposition of sanctions, civil sanctions, administrative actions (administrative orders and administrative sanctions), provision of opinions/legal consultations, consideration of appeal cases, administrative cases, and arbitration | To pursue enforcement actions (settlements/ criminal complaints/administrative sanctions/ administrative orders/civil sanctions) |
4.6 Work group: General administration, divided into the following activity groups:
Activity group | Purpose | Processing basis |
Human resource management, such as recruitment, performance evaluation, remuneration, welfare benefits, personnel development, seminars and various activities | To provide remuneration and welfare benefits to personnel, plan for succession, develop personnel, and organize activities in accordance with the missions | Contract* Legitimate Interest Consent Legal Obligation*
|
Secretarial work for the SEC Board, the Capital Market Supervisory Board (CMSB), and subcommittees appointed by the SEC Board and the CMSB | To facilitate internal administration | |
Information system management | To administer user accounts for work systems | |
Internal security management | To administer internal security | Consent Legitimate Interest
|
Procurement | To administer procurement | |
Expense reimbursements/ receipt of fee payments from external parties | To facilitate coordination where clarification or additional information is required | Contract Public Tasks Legal Obligation
|
ITA project work | To ensure compliance with laws, rules and regulatory requirements | Public Tasks Legal Obligation
|
Corporate governance and enterprise risk | To facilitate internal administration | |
Transparency and anti-corruption | To ensure compliance with laws, rules and regulatory requirements | Public Tasks Legitimate Interest
|
4.7 Work group: Others, divided into the following activity groups:
Activity group | Purpose | Processing basis |
Seminars, training and other activities | To promote knowledge, exchange knowledge, and foster cooperation among agencies | Public Tasks Contract* Legitimate Interest Consent
|
Knowledge promotion, information notification and public hearing | To promote knowledge, provide information, and obtain feedback | |
Media registration | To promote knowledge, exchange knowledge, and foster cooperation among agencies | |
* Where the SEC Office needs to collect your personal data for the performance of a contract, compliance with a legal obligation, or where necessary to enter into a contract, if you refuse to provide such personal data or object to its processing for the purposes of the relevant activity, this may result in the SEC Office being unable to take the requested action or provide all or part of the services you request.
5. Disclosure of personal data
The Office shall disclose personal data as follows:
5.1 Disclosure pursuant to the SEC Office's authority and duties to disclose information to the public for the benefit of investors, business operators and related persons through various channels, such as the SEC Office's website and applications.
5.2 Disclosure or transmission of personal data to related agencies for use in personal data processing activities in accordance with the missions of the SEC Office and the related agencies, as follows:
Financial regulatory agencies, including the Stock Exchange of Thailand;
Foreign regulatory agencies that have authority or cooperation in exchanging or requesting information;
Agencies related to the SEC Office's internal operations, such as health insurance service providers, payroll service providers, the Revenue Department, and the Bank of Thailand Employees' Thrift and Credit Co-operative Limited;
Other agencies related to the SEC Office's operations, such as the Ministry of Finance, the Office of the Permanent Secretary, the Prime Minister's Office (OPM), the Office of the Ombudsman, audit firms, the Federation of Accounting Professions, the Thai Bond Market Association, the Department of Business Development, courts, the Office of the Attorney General, the Royal Thai Police, the Legal Execution Department, the Anti-Money Laundering Office (AMLO), the Department of Special Investigation (DSI), the Office of the Narcotics Control Board (ONCB), the National Anti-Corruption Commission (NACC), the Economic Crime Suppression Division (ECD), the Digital Government Development Agency (Public Organization) (DGA), Damrongdhama Center, the National Archives of Thailand, the National Cyber Security Agency (NCSA), and the Office of the Consumer Protection Board (OCPB).
The disclosure of your personal data to other persons will be carried out only under the specified purposes or other purposes permitted by law. If the law requires your consent, the SEC Office will obtain your explicit consent prior to such disclosure.
The SEC Office will comply with appropriate security standards, such as ISO 27001, ISO 27701, or NIST. In the event that the SEC Office sends or transfers data to a destination country, an international organization, or a data recipient overseas, the SEC Office must ensure that the recipient has adequate standards for personal data protection.
Retention and retention period of personal data
The Office has implemented security measures for personal data in accordance with the Notification of the Personal Data Protection Committee Re: Security Measures of the Data Controller B.E. 2565 (2022) and other relevant standards. Further details are available at Security standards.
6. Personal data of minorsThe SEC Office does not have a specific purpose and mission to process personal data of minors. However, where necessary in connection with the SEC Office's missions, the SEC Office may collect and process personal data of minors. In any activity involving the SEC Office, it shall be presumed that the matter is not one that a minor may carry out independently, and the SEC Office will ensure that acknowledgment or consent has been obtained from the legal representative or person exercising parental power, as the case may be, in accordance with the law on personal data protection.
7. Rights of data subjects
You have the following rights:
7.1 Right to withdraw consent: You have the right to withdraw your consent to the processing of personal data for which you have given consent to the SEC Office throughout the period during which your personal data is held by the SEC Office
7.2 Right to be informed: You have the right to be informed of the personal data that the SEC Office will process before or at the time of collection.
7.3 Right of access: You have the right to access your personal data and request the SEC Office to provide a copy of such personal data to you, as well as request the SEC Office to disclose how it obtained such personal data for which you have not given consent to the SEC Office.
7.4 Right to rectification: You have the right to request the SEC Office to correct inaccurate data or complete any incomplete data.
7.5 Right to erasure: You have the right to request the SEC Office to erase your data on certain grounds.
7.6 Right to restriction of processing: You have the right to restrict the use of your personal data on certain grounds.
7.7 Right to data portability: You have the right to transfer your personal data provided to the SEC Office to another data controller or to yourself on certain grounds. However, the SEC Office does not yet have an automated data portability system in place.
Note: In the event of a transfer of personal data overseas, the SEC Office will proceed under the mutual agreement between Thailand and the destination country. The rights may be restricted under the specified cooperation framework.
7.8 Right to object: You have the right to object to the processing of data on certain grounds.
You may contact the Data Protection Officer (DPO) of the SEC Office to submit a request to exercise the above rights (contact details are provided in the “Contact channels" section below). You may also review the conditions and exceptions for exercising these rights at www.pdpc.or.th.
You are not required to pay any fees for exercising the above rights. The SEC Office will consider your request and notify you of the result within 30 days from the date on which the SEC Office receives such request.
If your request is denied, the SEC Office will notify you of the result together with the reasons through the contact channel you have specified. If you find that the SEC Office has not complied with the law on personal data protection, you have the right to file a complaint with the Personal Data Protection Committee or the competent supervisory authority appointed by the Personal Data Protection Committee or under the law. Prior to filing such complaint, however, please contact the Data Protection Officer (DPO) of the SEC Office so that the SEC Office may have the opportunity to be informed of the facts, provide clarification on the relevant issues, and address your concerns at the earliest opportunity.
8. Changes to the SEC Privacy Notice
The SEC Office will regularly review the SEC Privacy Notice to ensure consistency with relevant guidelines, laws and regulations. If there is any change to this SEC Privacy Notice, the SEC Office will notify you by updating the information on the SEC Office's website as soon as possible. This SEC Privacy Notice was most recently reviewed on 25 July 2024.
9. Contact channels
Details of the data controller