Thailand's Personal Data Protection Act applies to far more businesses than most owners realise. If you run a hotel, a clinic, a restaurant with a booking system, a property agency, or any company with employees, you are processing personal data and the Act applies to you. It also reaches businesses located entirely outside Thailand that offer goods or services to people here. Administrative fines run to three million baht, and some breaches carry criminal liability. This guide explains what the law requires in practical terms, the obligations that catch businesses out most often, and what compliance actually looks like.