The National Institute of Development Administration (hereinafter referred to as the “Institute”) recognizes and values the collection, use and/or disclosure of Your Personal Data (hereinafter referred to as the “Personal Data”) in accordance with the Personal Data Protection Act B.E. 2562 (2019) (hereinafter referred to as the “PDPA”). The Institute has, therefore, prepared this Personal Information Protection Policy to inform you of details about the collection, use and/or disclosure of Your Personal Data.
This Personal Information Protection Policy applies to:
- Students, participants in seminars, customers for academic services, others who are interested in the services of the Institute and persons associated with the aforementioned data subject (a family member, reference person or emergency contact)
- Respondent of the Institute’s questionnaires
- Alumni
- Personnel (including active and former personnel) and persons related to the personnel (a family member, guarantor, reference person or emergency contact) as well as those applying to work with the Institute
- Advisors, board of experts and thesis committee
- Speakers
- Advisors, research project executives and researchers
- Course assessors
- Representatives or contacts of companies, stores and business operators
- Donors and supporters of various aspects of the Institute
- Person entering the Institute’s area
- [Please identify more subjects of Personal Data mentioned in this Personal Information Protection Policy (if any)]
(collectively referred to as “You”, “Your” or “Data Subject” as the case may be
1. Personal Data that the Institute collects, uses and/or discloses
The Institute needs to collect, use and/or disclose Your Personal Data which is necessary to perform administrative activities or transactions of the Institute as described in the next section of the Personal Data Protection Policy. The Institute may obtain Your Personal Data directly and/or from other sources, for example, from a third-party or as it appears in the public media. The Institute has classified the categories of Personal Data with examples as follows:
| Category | Examples of Personal Data |
| Personal details | Name and surname, date of birth, id card number, passport number, identification number, gender, age, nationality, photograph, marital status, educational background, research works, academic works, careers, employer details, employment position, salary or income, work experience and signature |
| Contact details | Address, workplace, phone number, email and contact channels via various social media |
| Financial transaction | Bank account, credit card number, debit card number and payment information |
| Electronic transaction data | Log file, IP address, username and password and cookies |
| Employee information | Licenses, welfare and benefits, performance and disciplinary information, third-party information (relating to a family member, guarantor, reference person and emergency contact) and social security information |
| Sensitive personal data | Religion, race, criminal records, information relating to health information (blood type, health history, etc.), disability, biometric information (fingerprints, facial recognition, etc.) and political opinions |
| Others | Interests, opinions, services applicable to the Institute, Your status with the Institute, photos or videos from CCTV and requests to exercise rights under the PDPA |
The Institute would like to notify You of the impact in the event that You do not provide the aforementioned Personal Data to the Institute. In such event, the Institute may not be able to take relevant actions on Your Personal Data which may affect the quality of service or the execution of clerical activities or transactions for You. The Institute will ensure that our collection, processing and/or disclosure of Your Personal Data will be limited as necessary under a lawful purpose and basis and compliant with the PDPA and the relevant and applicable secondary laws.
2. The Institute’s activity, purpose and lawful basis of collection, use and/or disclosure of Your Personal Data
| Lawful bases | Activity/Purpose of collection, use and/or disclosure of Personal Data |
| Legal Obligation | 1. To operate the Institute to be consistent with the laws, rules and regulations that are relevant or applicable to the Institute, for example, the National Institute of Development Administration Act B.E. 2562 (2019), PDPA, Tax Law, Labor Law, Social Security Act, National Archives Act and Official Information Act including court orders or other government agencies. |
| Performance of Contract | 1. To register and verify Your identity for applying and/or service usage. 2. To enter into any agreement or contract related to the service or other relationships between You and the Institute, including the management and support of the conduct of transactions, clerical activities and other activities related to such relationship with You as well as the implementation of Your desires. 3. For employment purposes, to prove and verify the identity of working in and access to various systems and areas in the Institute; for payment of remuneration and providing benefits; for human resource management; and to apply for various training courses. 4. For the purpose of recording donation information or various support. |
| Legitimate Interest | 1. To analyze and measure results of usage of the Institute’s service to be supplementary information for the operation to increase the efficiency of service or performance in various fields of the Institute. 2. To maintain security and orderliness within the Institute. 3. To exercise the rights of the Institute and protect the interests of the Institute when necessary and lawful, for example, for investigating, preventing and responding to complaints. 4. To ensure compliance with the Institute’s requirements, regulations and policies. 5. To perform the administration, report preparation and internal policy of the Institute. 6. To manage the Institute’s website to facilitate its use and improve its layout and content. 7. For the use of emergency contacts. 8. For the purpose of recruiting, selecting, inspecting and hiring personnel including procurement. 9. For the benefits of studying, researching, making statistics, developing services or operating. 10. For the benefits of educational institutions, schools, agencies or organizations requesting to check on Your educational information |
| Archives/Research/ Statistics | 1. To study, conduct research or prepare statistics according to the Institute’s operational objectives. |
| Consent | 1. To collect, use and/or disclose Your sensitive personal data. 2. For the benefit of marketing or advertising relating to courses or activities of the Institute through various channels. 3. To introduce service or courses that may interest You. 4. Send or transfer your Personal Data overseas which may not have adequate standards of personal data protection, only if the law requires that the Institute needs Your consent |
3. Retention period of Personal Data
The Institute will collect Your Personal Data for as long as it is necessary to carry out the purposes of processing such Personal Data. The Institute will retain Your Personal Data throughout the period after your relationship with the Institute has ended in accordance with the National Archives Act and Official Information Act including various rules and regulations set forth. Then, the Institute will delete, destroy, pseudonymize, anonymize or make Personal Data non-personally identifiable information, unless there is a legal obligation or technical reasons whereby the Institute may keep Your Personal Data for a longer period of time.
4. Disclosure of Personal Data
The Institute may disclose, share or transfer Your Personal Data to third parties in order to process Your Personal Data, or to another data controller under the following privacy and confidentiality clause of personal data agreements:
4.1. Service Provider to the Institute – the Institute may use third-party services to provide services to the Institute to assist in the operations of the Institute, such as internet and software service providers, website developers, digital media, transportation services, payment and financial systems service providers, research and analysis service providers, auditors, marketing and event service providers, telecommunication service providers, data archiving and cloud service providers, printing service providers, lawyers, legal advisers, archiving and/or shredding service providers and/or other professional practitioners.
4.2. Third parties required by law – the Institute may be required to disclose Your Personal Data in order to comply with the law including orders issued in accordance with the laws of various government agencies.
4.3. Any other person in connection with any dispute arising, including any dispute related to a transaction.
4.4.Any person assigned to manage any interests, intermediaries, contact persons and Your representatives.
4.5. Institutional employers in research, data collection or providing educational services.
4.6. Institutional education, schools, agencies or organizations requesting Your educational information about Your education.
4.7. Any person for whom the Institute has been instructed by You to disclose Your Personal Data to such person.
5. International transfer of Personal Data
The nature of modern business practice is necessary for the Institute to transfer Your Personal Data internationally for storage and/or processing in relation to the mentioned purposes. The Institute will ensure to have Your Personal Data transferred with appropriate security measures in order to protect Your Personal Data transfer in accordance with the PDPA under the privacy and confidentiality of personal data agreements, which includes the following circumstances:
5.1. To comply with a legal obligation.
5.2. To obtain Your consent and inform You of inadequate Personal Data protection standards of the destination country or international organization which received Your Personal Data.
5.3. To perform the agreement made by You with us or at Your request before entering into an agreement.
5.4. To comply with an agreement between us and other parties for Your own interest.
5.5. To prevent or suppress a danger to Your or another person’s life, body or health and You are incapable of giving consent at such time.
5.6. To carry out activities relating to substantial public interest.
6. Use of Cookies on the website of the Institute
6.1. Cookies are text files placed on Your computer that are used to store details of Your internet usage log or Your visits to the website.
6.2. Types of cookies that the Institute uses on the website.
The Institute uses various types of cookies on its website as follows:
6.2.1. Cookies that are necessarily used for the website operation process (Strictly Necessary Cookies), in order for the website to function properly. To delete or prevent this cookie is not possible.
6.2.2. Cookies that are used to analyze and measure the performance of the Institute’s website (Analytical/Performance Cookies). These cookies allow us to recognize and count the number of visitors and to see how visitors move around and use our website. These cookies are used for web enhancement and optimization purposes and to aggregate statistics on how our visitors reach and browse our websites.
6.2.3. Cookies used to help remember settings information or the choices You have made on the Institute’s website (Functionality Cookies). These are used to enable us to personalize our content for You, tailor the website for Your needs and remember Your preferences, for example, Your choice of language or browsing font size.
6.2.4. Cookies for advertising (Advertising Cookies). These cookies will remember Your preferences that You used on the website, to tailor advertising to You that are relevant to You.
6.3. Cookies management
You can choose to turn off each type of cookie on the Institute’s website, except those used for the purposes of the website system’s operations
7. Security
The Institute implements a variety of security measures to maintain the safety and privacy of Your Personal Data to prevent the loss, access, use, alteration, amendment or disclosure of Personal Data without authority or abuse, for example, limiting access to Personal Data [Please specify the security measures that the Institute has used], etc., according to the Institute’s internal announcement.
8. Your rights
You have rights to Your Personal Data under the PDPA, and the Institute will respect Your rights by taking actions in accordance with any laws, rules or regulations relating to the processing of Your Personal Data. You may exercise the following rights of a Data Subject unless the Institute has grounds to lawfully reject Your request:
8.1.Right to withdraw consent – You have the right to withdraw Your consent. The withdrawal of consent will not affect the lawfulness of the collection, use and/or disclosure of Your Personal Data based on Your consent before it was withdrawn.
8.2.Right to access and obtain a copy – You have the right to access and obtain a copy of Your Personal Data that is retained by the Institute.
8.3.Right to data portability – You have the right to receive Your Personal Data where the Institute can arrange for such Personal Data to be in a readable or commonly used form, by way of automatic tools or equipment or format and can be used or disclosed by automated means. In addition, You have the right to request the Institute to send or transfer Your Personal Data to a third party, or to receive Your Personal Data which has been sent or transferred to a third party by the Institute.
8.4.Right to object – You have the right to object to the collection, use and/or disclosure of Your Personal Data where the Institute proceeds on a legitimate interest basis, or it is for a direct marketing purpose, or for scientific, historical or statistical research purposes.
8.5.Right to erasure – You have the right to request the Institute to delete, destroy or anonymize Your Personal Data in the event that the Institute does not need or has no legal right to keep such Personal Data.
8.6.Right to restrict – You have the right to request the Institute to restrict the use of Your Personal Data under certain circumstances when there is a pending examination process of the Institute in accordance with Your request to rectify Your Personal Data or object to the collection, use and/or disclosure of Your Personal Data, or Your request to restrict the use of Your Personal Data instead of the deletion or destruction of Your Personal Data.
8.7.Right to rectification – You have the right to rectify Your Personal Data that is inaccurate and to update Your Personal Data to not cause any misunderstandings.
8.8.Right to lodge a complaint – You have the right to make a complaint with the Personal Data Protection Committee or their office where the Institute does not comply with the PDPA.
9. How to contact us
If You have a privacy concern or question related to this Personal Information Protection Policy or would like to exercise Your rights, please contact [Please specify the Institute’s main contact channel, i.e., email address of the department which will be in charge of Data Protection matters]
Our address is:
The National Institute of Development Administration (NIDA)
148 Seri Thai Road, Klongchan Sub-District,
Bangkapi District, Bangkok 10240
Telephone: 0-2727-3203, 082 782 8931 (Mon – Fri 08.30-16.30)
Email: dpo-nida@nida.ac.th
10. Personal Protection Policy
This Privacy Notice will be used only for the operations or activities of the Institute and use of the Institute’s website. If You click on the link to another website (even through channels on the Institute’s website), You must study and follow the privacy policy displayed on that website separately from the Institute’s website.
11. Modification of the Privacy Notice
The Institute conducts a self-assessment at least every year in order to verify that this Privacy Notice is published and implemented within the Institute and that it conforms to the PDPA. If the Institute decides to change this Privacy Notice, the Institute will post the updated version on this page and/or update the modification date below.
This Privacy Notice was issued on 25th March 2022 (Version 1.0)