Personal Data Protection Act

Thailand’s Personal Data Protection Act B.E. 2562 (2019) (“PDPA”) represents the country’s first comprehensive data protection regime. Modeled partly on international standards such as the EU’s GDPR, the PDPA establishes clear rules governing the collection, use, disclosure, and security of personal data. It applies broadly to businesses, employers, digital platforms, and organizations operating in or targeting Thailand, including foreign entities handling the personal data of individuals located in the country.

This article provides an in-depth analysis of the PDPA, focusing on its scope, core principles, lawful bases, rights of data subjects, compliance obligations, enforcement mechanisms, and practical considerations for organizations.

1. Purpose and legislative intent

The PDPA was enacted to:

• Protect individuals’ privacy and personal data

• Establish accountability for organizations handling personal data

• Promote trust in digital transactions and data-driven services

• Align Thailand with international data protection standards

Before the PDPA, Thailand relied on fragmented privacy provisions scattered across sector-specific laws. The PDPA unified these protections into a single legal framework.

2. Scope of application

The PDPA applies to:

• Data controllers and data processors located in Thailand

• Foreign entities that offer goods or services to individuals in Thailand

• Organizations that monitor the behavior of individuals in Thailand

The law applies regardless of whether the data processing occurs inside or outside Thailand, as long as the data subject is located in Thailand.

3. Key definitions under the PDPA

Understanding statutory definitions is essential for compliance:

• Personal data: Information that identifies or can identify an individual, directly or indirectly

• Sensitive personal data: Includes race, religion, health data, biometric data, criminal records, and sexual orientation

• Data controller: The entity determining the purposes and means of data processing

• Data processor: The entity processing data on behalf of the controller

Sensitive personal data receives heightened legal protection.

4. Core principles of personal data processing

The PDPA establishes foundational principles governing data processing:

• Lawfulness: Data must be processed on a lawful basis

• Purpose limitation: Data must be collected for specific, explicit purposes

• Data minimization: Only necessary data may be collected

• Accuracy: Data must be kept accurate and up to date

• Storage limitation: Data must not be retained longer than necessary

• Security: Appropriate safeguards must be implemented

These principles guide both compliance assessments and enforcement decisions.

5. Lawful bases for data processing

Organizations may process personal data only if at least one lawful basis applies, including:

• Consent of the data subject

• Performance of a contract

• Compliance with legal obligations

• Protection of vital interests

• Legitimate interests of the controller (subject to balancing tests)

• Public interest or official authority

For sensitive personal data, explicit consent is generally required unless specific statutory exemptions apply.

6. Consent requirements

Consent under the PDPA must be:

• Freely given

• Specific and informed

• Unambiguous

• Revocable at any time

Pre-ticked boxes, bundled consent, or unclear notices may invalidate consent. Controllers must also maintain records demonstrating that valid consent was obtained.

7. Rights of data subjects

The PDPA grants individuals enforceable rights, including:

• Right to access personal data

• Right to data portability

• Right to object to processing

• Right to rectification

• Right to erasure (right to be forgotten)

• Right to restrict processing

• Right to withdraw consent

Organizations must respond to data subject requests within prescribed timeframes and maintain procedures for handling such requests.

8. Duties of data controllers

Data controllers bear primary responsibility for compliance and must:

• Provide clear privacy notices

• Implement appropriate technical and organizational security measures

• Maintain records of processing activities

• Ensure lawful data transfers

• Appoint a Data Protection Officer (DPO) where required

Failure to fulfill these duties may result in civil, criminal, and administrative liability.

9. Obligations of data processors

Data processors must:

• Process data only under documented instructions

• Implement security measures

• Notify controllers of data breaches

• Refrain from subcontracting without authorization

Processors can be held directly liable under the PDPA in certain circumstances.

10. Data breach notification requirements

In the event of a personal data breach:

• Controllers must notify the PDPC without delay

• Affected individuals must be informed if the breach poses high risk

• Documentation of the breach and response measures must be maintained

Timely response and transparency reduce regulatory exposure.

11. Cross-border data transfers

Transfers of personal data outside Thailand are permitted only if:

• The destination country has adequate data protection standards

• Appropriate safeguards are in place

• Consent or statutory exceptions apply

These restrictions affect multinational businesses and cloud-based services.

12. Appointment of a Data Protection Officer (DPO)

Certain organizations must appoint a DPO, particularly when:

• Processing involves large-scale sensitive data

• Core activities involve regular monitoring

The DPO acts as an internal compliance advisor and liaison with regulators.

13. Enforcement and regulatory authority

The Personal Data Protection Committee (PDPC) oversees enforcement and issues subordinate regulations, guidelines, and interpretations. The PDPC has authority to:

• Investigate violations

• Issue corrective orders

• Impose administrative fines

14. Penalties and liabilities

The PDPA imposes three types of liability:

• Civil liability: Compensation for damages

• Administrative penalties: Fines imposed by the PDPC

• Criminal penalties: Applicable to serious violations involving misuse of sensitive data

Executives and directors may face personal liability in certain cases.

15. Employment and workplace considerations

Employers must comply with the PDPA when handling:

• Employee records

• Biometric access systems

• Health and disciplinary data

Privacy notices and internal policies are critical for lawful HR data processing.

16. Marketing and digital compliance

Marketing activities must comply with:

• Consent rules for direct marketing

• Opt-out mechanisms

• Transparency requirements

Unsolicited communications may violate PDPA obligations.

17. Relationship with other Thai laws

The PDPA interacts with:

• Cybersecurity laws

• Sector-specific regulations

• Consumer protection legislation

Organizations must assess overlapping compliance obligations.

18. Practical compliance strategy

Effective PDPA compliance involves:

• Data mapping and risk assessments

• Policy development and staff training

• Contractual reviews with vendors

• Ongoing monitoring and audits

Compliance is an ongoing process, not a one-time exercise.

Conclusion

Thailand’s Personal Data Protection Act establishes a robust legal framework that fundamentally changes how organizations collect, use, and protect personal data. By imposing clear obligations, empowering individuals, and introducing meaningful penalties, the PDPA promotes accountability and data protection culture across all sectors.

Organizations operating in Thailand or handling Thai personal data must adopt structured compliance strategies that align legal, technical, and operational practices. A proactive approach not only reduces regulatory risk but also strengthens trust and long-term business sustainability in Thailand’s increasingly data-driven economy.