PDPA Thailand: The Complete Guide
Thailand's Personal Data Protection Act, enacted in 2019 and fully enforceable since June 1, 2022, is the country's first comprehensive data protection law. Heavily influenced by the GDPR, the PDPA establishes a framework for protecting personal data collected, used, or disclosed by organizations operating in Thailand or targeting Thai residents.
What the PDPA Covers
The PDPA recognizes six lawful bases for processing personal data: consent, contract performance, vital interests, legal obligation, public interest, and legitimate interests. Consent must be freely given, specific, informed, and may be withdrawn at any time.
Sensitive personal data — including racial or ethnic origin, political opinions, religious beliefs, health data, biometric data, genetic data, and sexual orientation — requires explicit consent for processing, except in limited circumstances such as legal claims or vital interests.
Data subjects are granted comprehensive rights including the right to access, rectification, erasure, restriction, data portability, and the right to object. Controllers must respond to requests within 30 days. The law also requires notification of data breaches to the PDPC within 72 hours of discovery.
Who Needs to Comply
The PDPA applies to data controllers and processors that collect, use, or disclose personal data in Thailand, regardless of whether the processing occurs within the country. It also applies extraterritorially to organizations outside Thailand that offer goods or services to individuals in Thailand or monitor their behavior.
Certain sectors including government agencies acting within their statutory authority and media organizations may have modified obligations under the law.
Enforcement and Penalties
The PDPA establishes both administrative and criminal penalties. Administrative fines reach up to 5 million Thai Baht (approximately $140,000). Criminal penalties include imprisonment of up to one year and fines up to 1 million Baht for certain offenses. The Expert Committee may also award compensation to data subjects.
Practical Compliance Steps
- Lawful basis assessment — Identify and document the legal basis for each processing activity
- Consent management — Implement mechanisms for obtaining, recording, and withdrawing consent
- Data subject rights — Build intake and response workflows within 30-day deadlines
- DPO appointment — Designate a Data Protection Officer if required based on processing activities
- Cross-border transfers — Implement adequate safeguards for international data transfers
- Records of processing — Maintain written records of all processing activities as required