The Office of the Insurance Commission (OIC) is working closely with insurance associations and related organisations to prepare for new legislation overseeing personal data protection.
Secretary-general Suthipon Thaveechaiyagarn said the OIC is closely monitoring the details of the Personal Data Protection Act, part of which requires businesses to receive customers' consent before disclosing personal information.
"We have about one year to prepare before the law becomes effective," Mr Suthipon said.
After numerous attempts over nearly two decades, Thailand's Personal Data Protection Act was finally approved and endorsed by the National Legislative Assembly on Feb 28.
Drafted to resemble the EU's General Data Protection Regulation, the act will be submitted for royal endorsement and subsequent publication in the Royal Gazette.
When the act goes into effect, businesses will need to notify the data subjects of certain details, such as the purpose of collection, the data retention period and the rights of the data subject, as well as obtain consent from the data subject unless exceptions under the act are applied.
There is a one-year grace period after publication in the Royal Gazette before the law is enforced.
The OIC previously offered its comments and concerns about business practices related to the law to the affected agencies.
Mr Suthipon said many issues remain for the OIC and related associations to work on for further clarification.
The definition of personal information, rejection of providing personal information in the aftermath and insurance bureau database related to insurance fraud are among the unclear details, he said.
"Under the law, unprotected personal information will be protected," Mr Suthipon said. "However, there are some concerning points, especially about the definition of coverage.
"The OIC will ask the committee overseeing personal data protection about how to proceed [with insurance practices once the law takes effect], what can't be done and which issues are exempted."
Another concern is that people can withdraw their consent at any time, he said, making this a sensitive issue, as it could be a means for people who commit fraud to withdraw their consent once an insurance policy is approved.
Knowing personal information can help businesses customise products in line with customer needs and risk profiles, Mr Suthipon said.
"Insurance companies are aware of the importance of safekeeping personal information to prevent information leakage," he said.