Personal Data Protection Act (PDPA)

· About Personal Data Protection Act (PDPA)

Key Takeaways

  • Thailand’s Personal Data Protection Act, B.E. 2562 (2019) is the country’s general privacy law for processing personal data, and it is enforced by the Personal Data Protection Committee (PDPC) under the Ministry of Digital Economy and Society.[7]
  • The PDPA has been fully in force since 1 June 2022, but Thailand is still considering 2026 draft amendments that could change lawful bases and public-sector exemptions; those amendments were only in public consultation as of mid-2026 and are not yet law.[1][3][14]
  • Controllers and processors that operate in Thailand, or target data subjects in Thailand under the law’s extraterritorial reach, must adopt a lawful basis, publish notices, secure data, and respect rights requests, or face administrative fines, civil damages, and in some cases criminal penalties.[7][11]
  • Administrative fines under the PDPA can reach THB 5 million per violation, while certain offences can also bring imprisonment of up to one year and fines of up to THB 1 million.[11][7]
  • Breach notification to the PDPC is required within 72 hours in most cases, and failure to notify can itself trigger a separate administrative fine.[2][11]
  • Thailand’s 2026 public-consultation draft would broaden government exemptions and restructure the lawful-basis framework to align more closely with GDPR-style multiple lawful bases, but companies should still comply to the current PDPA until any amendment is enacted.[1][3][14]

What It Is

Thailand’s PDPA is the country’s comprehensive personal data protection statute, covering the collection, use, disclosure, transfer, and security of personal data in both private and public sectors, subject to statutory exemptions.[7] The law is enforced by the PDPC, which issues implementing notifications, investigates complaints, and can impose administrative sanctions through the competent process.[7][11]

The law was enacted as Personal Data Protection Act B.E. 2562 (2019), was published in 2019, and then brought into force in phases. The main operative date for the substantive obligations was 1 June 2022, after delays from the original transition timetable.[11] In 2026, Thailand opened a public consultation on a draft amendment on 16 July 2026, with comments accepted until 15 August 2026; as of 6 November 2026, that draft remains proposed and does not replace the current PDPA.[1][3][14]

Who Must Comply

The PDPA applies to data controllers and data processors that collect, use, or disclose personal data in Thailand, including private businesses, employers, service providers, and many public-sector bodies, unless an exemption applies.[7][11] It also has extraterritorial reach where a foreign entity offers goods or services to, or monitors the behaviour of, persons in Thailand, which means offshore SaaS, adtech, e-commerce, and group service providers can be in scope.[7][11]

Common exemptions include personal or household activity, certain state functions, and processing under specific statutory carve-outs.[7] The 2026 draft would further expand government-related exemptions and define “government agency” more precisely, but that change is not yet effective.[3][14]

There is no single general employee-count threshold for private-sector coverage; applicability turns primarily on whether an organisation acts as a controller or processor of personal data in scope of the Act.[7] Special-category or sensitive personal data receives heightened protection and usually requires an additional condition beyond ordinary processing.[11]

Core Requirements

  1. Identify a lawful basis before processing. Controllers must rely on a statutory basis for each processing activity, and current law requires a lawful basis analysis for collection, use, and disclosure; the 2026 draft would move Thailand closer to a multi-basis model resembling the GDPR, but that is still proposed.[1][3][7]
  1. Give a compliant privacy notice. Controllers must tell data subjects what data is collected, why it is collected, whether disclosure is mandatory or voluntary, retention periods, and data-subject rights, in a clear and accessible notice.[7][11]
  1. Limit processing to the stated purpose. Personal data must be collected only for legitimate, specific purposes and not used in ways that are incompatible with those purposes without a valid legal basis or consent where required.[7][11]
  1. Protect data with appropriate security measures. Controllers and processors must implement technical and organisational safeguards appropriate to the risk, including controls against unauthorized access, loss, alteration, and disclosure.[7][11]
  1. Support data-subject rights. Organisations must handle requests for access, deletion, portability, objection, restriction-related requests where applicable, and withdrawal of consent, subject to statutory limits.[12][7]
  1. Manage processors contractually. Controllers must use processors under terms that bind the processor to the controller’s instructions and PDPA-aligned safeguards, because processor misconduct can still trigger liability and sanctions.[11][7]
  1. Report breaches promptly. Where a personal-data breach poses risk to rights and freedoms, the controller must notify the PDPC within 72 hours, and notify affected individuals when required.[2][11]

Deadlines and Penalties

| milestone | date | what applies | |---|---:|---| | PDPA enacted | 27 May 2019 | The Act was adopted as Thailand’s general personal data statute.[11] | | Main substantive obligations in force | 1 June 2022 | Controllers and processors had to comply with core PDPA duties after the transition period.[11] | | PDPA access-rights notification effective | 14 September 2026 | New procedural rules for access requests applied, including identity checks, timelines, refusal grounds, fees, and recordkeeping.[12] | | Draft amendment public consultation opened | 16 July 2026 | Proposed amendments entered public consultation; they are not yet law.[1][14] | | Draft amendment consultation closed | 15 August 2026 | Consultation period ended; legislative timing remains uncertain.[1][14] |

Maximum sanctions under the current PDPA include administrative fines up to THB 5 million per violation, civil damages, and in some cases punitive damages up to twice actual compensation.[11][2] For certain serious offences, the Act also provides imprisonment of up to one year, a fine of up to THB 1 million, or both.[7][11]

How to Comply

  1. Map data and roles. Build a record of processing activities, classify each dataset, and identify whether the organisation is acting as controller, processor, or both for each use case.
  1. Assign lawful bases and notices. For every processing activity, document the PDPA basis, draft notices in plain Thai and English where needed, and align them with actual operational data flows.
  1. Build a rights-request workflow. Create intake, identity verification, decisioning, redaction, response, and appeal steps, with service levels that meet the PDPA and the newer 2026 access-rights procedure.[12]
  1. Implement risk-based security controls. Use ISO 27001 for the information-security management system, NIST CSF 2.0 to structure identify-protect-detect-respond-recover, and ISO 42001 where automated decisioning or AI systems influence personal-data processing.
  1. Contract processors tightly. Put in place data-processing clauses covering instructions, subprocessing, security, breach notice, audits, return/deletion, and cross-border transfer support.
  1. Prepare breach response. Test escalation paths so the PDPC can be notified within 72 hours where required, evidence is preserved, and affected individuals can be contacted quickly.[2][11]
  1. Review cross-border transfers. Maintain transfer safeguards, vendor due diligence, and country-specific assessments for offshore hosting, support centres, and intragroup service sharing.
  1. Monitor law changes. Track the 2026 amendment process, because any enacted revision may alter lawful bases, exemptions, or government-processing rules without changing the need to comply with the current Act in the meantime.[1][3][14]

Related Regulations

  • EU GDPR: The PDPA is broadly GDPR-like in structure, but Thailand’s current lawful-basis framework is not identical, and the 2026 draft would move it closer to the GDPR model.[1][3]
  • Singapore PDPA: Both laws regulate personal data in commercial settings, but Thailand’s Act includes broader criminal-style penalties and a different enforcement architecture.[11]
  • Malaysia PDPA 2010: Malaysia’s law is also sector-wide but differs in scope, consent mechanics, and cross-border-transfer rules, so regional programmes cannot be copied verbatim.
  • Thailand Cybersecurity Act: Security incidents may trigger both privacy and cybersecurity obligations, so incident response teams should coordinate legal review before external notifications.
  • Thailand Computer Crime Act: Data breaches, unauthorized access, or unlawful system activity can create parallel exposure under cybercrime rules in addition to PDPA sanctions.

FAQ

Does Thailand’s PDPA apply to companies outside Thailand?

Yes, if a foreign business offers goods or services to people in Thailand or monitors their behaviour, the law can apply extraterritorially.[7][11] Offshore vendors, adtech platforms, and group shared-service providers are common examples. A non-Thai headquarters does not remove PDPA exposure if the processing is targeted at the Thai market.[7]

Does the PDPA require consent for every type of processing?

No. The current PDPA uses statutory grounds and does not make consent the only route for all processing activities, although the 2026 draft would reorganize the framework and could make consent one lawful basis among others in a clearer multi-basis model.[1][3] Organisations should not assume consent is always required, but they should document the exact basis for each use case under the current law.[7]

What happens if a company misses the 72-hour breach notice deadline?

Missing the deadline can create separate administrative exposure, and the PDPC can impose a fine for failure to notify on time.[2][11] The practical risk is higher if the delay also worsens harm to data subjects or impedes containment and investigation.[11]

Are there special rules for sensitive personal data?

Yes. Sensitive personal data receives stronger protection and usually requires a specific condition or exception before processing can lawfully proceed.[11] Controllers should treat health, biometrics, criminal-record information, and similar categories as high-risk and build explicit approvals and safeguards around them.

Has Thailand already adopted the 2026 PDPA amendments?

No. As of 6 November 2026, the amendment bill remains in the legislative process after public consultation, so the current PDPA still governs.[1][3][14] Companies should monitor the bill, but compliance programmes must remain anchored in the existing law until an amendment is enacted and effective.

Sources

Put it into practice

More compliance guides