PDPA Compliance in Thailand: What Every Business Must Do
194 Views
Who the Act Applies To
The Act applies to the collection, use, or disclosure of personal data by a data controller or data processor located in Thailand, whether the processing itself happens inside or outside the country.
It also has extraterritorial reach. Where the controller or processor is outside Thailand, the Act still applies to processing of data belonging to people in Thailand, where the activity involves offering goods or services to them, whether or not payment is required, or monitoring their behaviour in Thailand.
For an overseas company selling to Thai customers or tracking Thai website visitors, that is a direct compliance obligation, not a theoretical one.
Consent, and Why It Is Not the Answer to Everything
A data controller may not collect, use, or disclose personal data without the data subject's prior consent, unless the Act or another law permits it.
Where consent is used, the requirements are strict. It must be given expressly, in writing or through an electronic system, unless that is not possible by nature. The purpose must be disclosed when consent is requested. The request must be clearly separated from other content, in a form that is easy to access and understand, in plain language, and it must not be deceptive or misleading.
There is also an anti-bundling rule. In entering a contract, including the provision of any service, consent must not be made a condition where the data is not necessary or related to that contract or service. A business cannot require customers to accept marketing as the price of buying something.
Consent may be withdrawn at any time, and withdrawal must be as easy as giving it. Where withdrawal affects the data subject, the controller must inform them of the consequences. Consent obtained in breach of these rules does not bind the data subject and does not entitle the controller to process the data.
The practical implication is that consent is often the weakest basis to rely on, because it can be withdrawn. Where processing is genuinely necessary, for example to perform a contract, comply with a legal obligation, or pursue a legitimate interest, the Act's other lawful bases are usually more stable, and using them correctly is a large part of good compliance design.
The Purpose Limitation Rule
A controller must collect, use, or disclose personal data only for the purposes notified to the data subject before or at the time of collection. Processing for a different purpose is prohibited unless the new purpose has been notified and consent obtained beforehand, or another law permits it.
This is where many businesses fail. Data collected for one purpose, such as fulfilling a booking, is later used for another, such as a marketing campaign, without any further notification. That is a breach even though the data was lawfully collected in the first place.
Collecting Data from Third Parties
Collecting personal data from a source other than the data subject is prohibited, subject to exceptions. The main route is to notify the data subject of the collection without delay, and in any event within thirty days, and to obtain consent, unless the processing falls within an exemption from consent under the Act.
Where the notification route applies, the controller must inform the data subject within thirty days of collection. If the data is to be used to contact the data subject, notification must be given at the first contact, and if it is to be disclosed, notification must be given before the first disclosure.
This provision applies squarely to purchased marketing lists, data received from business partners, and background information gathered on customers or candidates.
Sensitive Data Requires Explicit Consent
A separate and stricter regime governs sensitive personal data. The Act prohibits collecting personal data concerning racial or ethnic origin, political opinions, cult, religious or philosophical beliefs, sexual behaviour, criminal records, health data, disability, trade union information, genetic data, biometric data, or other similar data as the Committee may prescribe, without the explicit consent of the data subject.
Biometric data is expressly defined to include facial recognition data, iris recognition data, and fingerprint recognition data. Any business using fingerprint or facial recognition for staff attendance or building access is processing sensitive data and needs explicit consent or another applicable exemption.
There are limited exceptions, including preventing danger to life where consent cannot be given, data made public with explicit consent, necessity for legal claims, and various obligations relating to healthcare, employment protection, social security, scientific or statistical research, and substantial public interest, each subject to appropriate safeguards. Criminal record data may only be collected under the control of a competent authority or with prescribed safeguards.
The Controller's Core Duties
The Act imposes four practical duties that define what compliance looks like day to day.
The first is security. A controller must implement appropriate security measures to prevent loss, unauthorised or unlawful access, use, alteration, correction, or disclosure, and must review those measures when necessary or when technology changes, meeting the minimum standards prescribed by the Committee.
The second concerns third parties. Where personal data must be provided to any person or entity other than the controller, the controller must take steps to prevent that recipient from using or disclosing the data unlawfully or without authority. In practice this means written data processing agreements with vendors, cloud providers, payroll firms, and agencies.
The third is deletion. A controller must maintain a review system for deleting or destroying personal data when the retention period expires, when the data is irrelevant or beyond the purpose of collection, when the data subject requests it, or when consent is withdrawn, subject to specific exemptions such as freedom of expression and the establishment or defence of legal claims. A retention schedule is not optional.
The fourth is breach notification, and it carries the tightest deadline in the Act.
The Seventy-Two Hour Breach Rule
A controller must notify the Office of a personal data breach without delay and, where feasible, within seventy-two hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals.
Where the breach involves a high risk to those rights and freedoms, the controller must also notify the affected data subjects without delay, together with the remedial measures.
Seventy-two hours is short, and it runs from awareness, not from the completion of an internal investigation. Businesses that have not decided in advance who assesses a suspected breach, and who signs off the notification, do not meet this deadline. A written incident response procedure is the single most valuable document a business can prepare here.
One further duty applies to foreign businesses. A controller falling under the extraterritorial provision must appoint a representative in writing, and that representative must be in Thailand and authorised to act on the controller's behalf without any limitation of liability relating to the processing.
Penalties
The Act provides for administrative fines, civil liability, and in some cases criminal penalties.
Administrative fines of up to three million baht apply to a range of controller breaches, including processing outside the notified purpose, failures relating to collection from third parties, non-compliance with the core duties including security and breach notification, obtaining consent by deception or in a way that misleads the data subject as to the purpose, and unlawful cross-border transfers.
There is also a criminal offence for a person who learns personal data of another through performing duties under the Act and discloses it to another person, punishable by imprisonment of up to six months, a fine of up to five hundred thousand baht, or both, subject to defined exceptions including disclosure under a duty, for investigation or court proceedings, to authorised state agencies, with the data subject's specific written consent, or where the data relates to litigation already disclosed publicly.
Data subjects may also pursue compensation for damage suffered, so the exposure is not limited to regulatory fines.
What Practical Compliance Looks Like
Start by mapping what personal data you actually hold, where it came from, why you have it, who you share it with, and how long you keep it. Most businesses discover they hold considerably more than they thought.
Then identify a lawful basis for each processing activity rather than defaulting to consent for everything. Publish a privacy notice that reflects reality rather than a template. Put written agreements in place with every vendor that touches personal data. Set retention periods and build a mechanism that actually deletes data when they expire. Prepare a procedure for handling data subject requests and a separate one for breaches, with named responsible people and the seventy-two hour clock built in. Train the staff who handle customer and employee data, since most breaches are operational rather than technical. And review consent forms for the separation, plain language, and anti-bundling requirements.
Frequently Asked Questions
Does the PDPA apply to my small business?
Almost certainly. If you hold customer or employee personal data, you are a data controller. The Act does not exempt businesses by size.
My company is registered overseas. Am I covered?
You may well be. The Act applies to controllers and processors outside Thailand who offer goods or services to people in Thailand or monitor their behaviour here, and such controllers must appoint a representative in Thailand.
Do I need consent for everything?
No, and relying on consent for everything is usually a mistake because it can be withdrawn. The Act provides other lawful bases, and the correct approach is to identify the right basis for each activity.
We use fingerprint scanners for staff attendance. Is that a problem?
Biometric data is sensitive personal data, which requires explicit consent unless a specific exemption applies, so this needs to be documented properly.
How quickly must we report a data breach?
Notify the Office without delay and where feasible within seventy-two hours of becoming aware, and notify affected individuals as well where the breach carries a high risk to their rights and freedoms.
Speak to a Thai Data Protection Lawyer
PDPA compliance is not a document exercise. It is a set of operational commitments with short deadlines and real financial exposure. Our bilingual lawyers conduct data audits, draft privacy notices, consent forms, and data processing agreements, prepare breach response procedures, advise on cross-border transfers, and act for businesses facing complaints or investigations. Contact us before a breach, not after one.
Disclaimer
This article provides general legal information only and does not constitute legal advice. Obligations under the Personal Data Protection Act depend on the nature of the data and the activities of each business. Please consult a licensed Thai attorney before acting.
The Act applies to the collection, use, or disclosure of personal data by a data controller or data processor located in Thailand, whether the processing itself happens inside or outside the country.
It also has extraterritorial reach. Where the controller or processor is outside Thailand, the Act still applies to processing of data belonging to people in Thailand, where the activity involves offering goods or services to them, whether or not payment is required, or monitoring their behaviour in Thailand.
For an overseas company selling to Thai customers or tracking Thai website visitors, that is a direct compliance obligation, not a theoretical one.
Consent, and Why It Is Not the Answer to Everything
A data controller may not collect, use, or disclose personal data without the data subject's prior consent, unless the Act or another law permits it.
Where consent is used, the requirements are strict. It must be given expressly, in writing or through an electronic system, unless that is not possible by nature. The purpose must be disclosed when consent is requested. The request must be clearly separated from other content, in a form that is easy to access and understand, in plain language, and it must not be deceptive or misleading.
There is also an anti-bundling rule. In entering a contract, including the provision of any service, consent must not be made a condition where the data is not necessary or related to that contract or service. A business cannot require customers to accept marketing as the price of buying something.
Consent may be withdrawn at any time, and withdrawal must be as easy as giving it. Where withdrawal affects the data subject, the controller must inform them of the consequences. Consent obtained in breach of these rules does not bind the data subject and does not entitle the controller to process the data.
The practical implication is that consent is often the weakest basis to rely on, because it can be withdrawn. Where processing is genuinely necessary, for example to perform a contract, comply with a legal obligation, or pursue a legitimate interest, the Act's other lawful bases are usually more stable, and using them correctly is a large part of good compliance design.
The Purpose Limitation Rule
A controller must collect, use, or disclose personal data only for the purposes notified to the data subject before or at the time of collection. Processing for a different purpose is prohibited unless the new purpose has been notified and consent obtained beforehand, or another law permits it.
This is where many businesses fail. Data collected for one purpose, such as fulfilling a booking, is later used for another, such as a marketing campaign, without any further notification. That is a breach even though the data was lawfully collected in the first place.
Collecting Data from Third Parties
Collecting personal data from a source other than the data subject is prohibited, subject to exceptions. The main route is to notify the data subject of the collection without delay, and in any event within thirty days, and to obtain consent, unless the processing falls within an exemption from consent under the Act.
Where the notification route applies, the controller must inform the data subject within thirty days of collection. If the data is to be used to contact the data subject, notification must be given at the first contact, and if it is to be disclosed, notification must be given before the first disclosure.
This provision applies squarely to purchased marketing lists, data received from business partners, and background information gathered on customers or candidates.
Sensitive Data Requires Explicit Consent
A separate and stricter regime governs sensitive personal data. The Act prohibits collecting personal data concerning racial or ethnic origin, political opinions, cult, religious or philosophical beliefs, sexual behaviour, criminal records, health data, disability, trade union information, genetic data, biometric data, or other similar data as the Committee may prescribe, without the explicit consent of the data subject.
Biometric data is expressly defined to include facial recognition data, iris recognition data, and fingerprint recognition data. Any business using fingerprint or facial recognition for staff attendance or building access is processing sensitive data and needs explicit consent or another applicable exemption.
There are limited exceptions, including preventing danger to life where consent cannot be given, data made public with explicit consent, necessity for legal claims, and various obligations relating to healthcare, employment protection, social security, scientific or statistical research, and substantial public interest, each subject to appropriate safeguards. Criminal record data may only be collected under the control of a competent authority or with prescribed safeguards.
The Controller's Core Duties
The Act imposes four practical duties that define what compliance looks like day to day.
The first is security. A controller must implement appropriate security measures to prevent loss, unauthorised or unlawful access, use, alteration, correction, or disclosure, and must review those measures when necessary or when technology changes, meeting the minimum standards prescribed by the Committee.
The second concerns third parties. Where personal data must be provided to any person or entity other than the controller, the controller must take steps to prevent that recipient from using or disclosing the data unlawfully or without authority. In practice this means written data processing agreements with vendors, cloud providers, payroll firms, and agencies.
The third is deletion. A controller must maintain a review system for deleting or destroying personal data when the retention period expires, when the data is irrelevant or beyond the purpose of collection, when the data subject requests it, or when consent is withdrawn, subject to specific exemptions such as freedom of expression and the establishment or defence of legal claims. A retention schedule is not optional.
The fourth is breach notification, and it carries the tightest deadline in the Act.
The Seventy-Two Hour Breach Rule
A controller must notify the Office of a personal data breach without delay and, where feasible, within seventy-two hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals.
Where the breach involves a high risk to those rights and freedoms, the controller must also notify the affected data subjects without delay, together with the remedial measures.
Seventy-two hours is short, and it runs from awareness, not from the completion of an internal investigation. Businesses that have not decided in advance who assesses a suspected breach, and who signs off the notification, do not meet this deadline. A written incident response procedure is the single most valuable document a business can prepare here.
One further duty applies to foreign businesses. A controller falling under the extraterritorial provision must appoint a representative in writing, and that representative must be in Thailand and authorised to act on the controller's behalf without any limitation of liability relating to the processing.
Penalties
The Act provides for administrative fines, civil liability, and in some cases criminal penalties.
Administrative fines of up to three million baht apply to a range of controller breaches, including processing outside the notified purpose, failures relating to collection from third parties, non-compliance with the core duties including security and breach notification, obtaining consent by deception or in a way that misleads the data subject as to the purpose, and unlawful cross-border transfers.
There is also a criminal offence for a person who learns personal data of another through performing duties under the Act and discloses it to another person, punishable by imprisonment of up to six months, a fine of up to five hundred thousand baht, or both, subject to defined exceptions including disclosure under a duty, for investigation or court proceedings, to authorised state agencies, with the data subject's specific written consent, or where the data relates to litigation already disclosed publicly.
Data subjects may also pursue compensation for damage suffered, so the exposure is not limited to regulatory fines.
What Practical Compliance Looks Like
Start by mapping what personal data you actually hold, where it came from, why you have it, who you share it with, and how long you keep it. Most businesses discover they hold considerably more than they thought.
Then identify a lawful basis for each processing activity rather than defaulting to consent for everything. Publish a privacy notice that reflects reality rather than a template. Put written agreements in place with every vendor that touches personal data. Set retention periods and build a mechanism that actually deletes data when they expire. Prepare a procedure for handling data subject requests and a separate one for breaches, with named responsible people and the seventy-two hour clock built in. Train the staff who handle customer and employee data, since most breaches are operational rather than technical. And review consent forms for the separation, plain language, and anti-bundling requirements.
Frequently Asked Questions
Does the PDPA apply to my small business?
Almost certainly. If you hold customer or employee personal data, you are a data controller. The Act does not exempt businesses by size.
My company is registered overseas. Am I covered?
You may well be. The Act applies to controllers and processors outside Thailand who offer goods or services to people in Thailand or monitor their behaviour here, and such controllers must appoint a representative in Thailand.
Do I need consent for everything?
No, and relying on consent for everything is usually a mistake because it can be withdrawn. The Act provides other lawful bases, and the correct approach is to identify the right basis for each activity.
We use fingerprint scanners for staff attendance. Is that a problem?
Biometric data is sensitive personal data, which requires explicit consent unless a specific exemption applies, so this needs to be documented properly.
How quickly must we report a data breach?
Notify the Office without delay and where feasible within seventy-two hours of becoming aware, and notify affected individuals as well where the breach carries a high risk to their rights and freedoms.
Speak to a Thai Data Protection Lawyer
PDPA compliance is not a document exercise. It is a set of operational commitments with short deadlines and real financial exposure. Our bilingual lawyers conduct data audits, draft privacy notices, consent forms, and data processing agreements, prepare breach response procedures, advise on cross-border transfers, and act for businesses facing complaints or investigations. Contact us before a breach, not after one.
Disclaimer
This article provides general legal information only and does not constitute legal advice. Obligations under the Personal Data Protection Act depend on the nature of the data and the activities of each business. Please consult a licensed Thai attorney before acting.
Related Content
Any foreigner who wishes to enter Thailand is required to obtain a visa from a Royal Thai Embassy or Royal Thai Consulate-General
30 ม.ค. 2024
To set up a company limited in Thailand is not as hard as you might think.
30 ม.ค. 2024
A supplier fails to deliver. A builder abandons a half-finished villa. A business partner simply stops paying. Contracts are broken in Thailand every day, and when it happens the injured party usually has a stronger legal position than they realise, provided they act correctly and quickly. Thai law gives you the right to demand performance, to terminate, and to claim damages, but each remedy has conditions, and some of the most valuable rights are lost by simply waiting. This guide explains what counts as a breach of contract in Thailand, the remedies available to you, how Thai courts calculate damages, why penalty clauses are not always enforced as written, and the time limits that decide whether you can sue at all.
22 ก.ค. 2026
