On 14 September 2023, the Notification of the Personal Data Protection Commission (“PDPC”) Re: the Appointment of Data Protection Officer (“DPO”) under Section 41(2)1  of the Personal Data Protection Act B.E. 2562 (2019) (“PDPA”) B.E. 2566 (2023) (the “Notification”) was published in the Royal Gazette. This Notification sets out the key criteria for when a Data Controller or Data Processor needs to appoint a DPO. This Notification focuses only on cases where core activities consist of processing operations, which require regular or systematic monitoring of personal data on a large scale, similarly with Article 37 (1) (b) of the GDPR.