Personal Data Protection Act (PDPA)

Thailand's first comprehensive data protection law, similar to the GDPR, which governs the processing of personal data.

JurisdictionThailand
CategoryPrivacy & Data Protection
StatusActive
Latest development

Analysis

Key Requirements

Thailand's Personal Data Protection Act (PDPA) establishes several key requirements for organizations processing personal data:

  • Lawful Basis for Processing: Organizations must have a valid legal basis for collecting, using, or disclosing personal data. This includes obtaining explicit consent from data subjects, unless another lawful basis applies such as legal obligation or legitimate interests.
  • Data Subject Rights: The PDPA grants individuals several rights over their personal data, including:
  • Right to access their data
  • Right to data portability
  • Right to object to processing
  • Right to erasure ("right to be forgotten")
  • Right to restrict processing
  • Right to rectification of inaccurate data

Organizations must have processes in place to fulfill these rights upon request.

  • Data Protection Officer (DPO): Certain organizations are required to appoint a DPO to oversee PDPA compliance and serve as a point of contact for data subjects and the regulatory authority.
  • Cross-Border Data Transfers: When transferring personal data outside of Thailand, organizations must ensure the recipient country has adequate data protection standards or implement appropriate safeguards.
  • Privacy Notices: Organizations must provide clear and transparent privacy notices to data subjects, detailing how their personal data will be collected, used, and disclosed.

Compliance Challenges

Organizations face several challenges in achieving and maintaining PDPA compliance:

  • Consent Management: Obtaining and managing valid consent from data subjects can be complex, especially for organizations with large customer bases. A study by Deloitte found that 62% of Thai organizations struggled with consent management.
  • Data Mapping and Inventory: Many organizations lack a clear understanding of what personal data they hold and where it resides. The JIB case highlighted the importance of maintaining accurate data inventories to prevent breaches.
  • Legacy Systems: Older IT systems may not have been designed with data protection in mind, making it difficult to implement necessary controls. A KPMG report found that 45% of Thai companies cited legacy systems as a major obstacle to PDPA compliance.
  • Employee Training: Ensuring all staff understand their PDPA obligations can be challenging, especially in large organizations. The Gramm-Leach-Bliley Act (GLBA) case study from the US demonstrates the importance of comprehensive employee training programs.

Implementation Best Practices

To effectively implement PDPA compliance, organizations should:

  • Conduct a Data Protection Impact Assessment (DPIA): Regularly assess the risks associated with data processing activities. The PDPC provides DPIA guidelines to help organizations identify and mitigate privacy risks.
  • Implement Privacy by Design: Integrate data protection considerations into all processes and systems from the outset. The IAPP Privacy by Design documentation offers a framework for this approach.
  • Establish a Data Governance Program: Create clear policies and procedures for data handling. The ISO/IEC 27701 standard provides a useful framework for privacy information management.
  • Use Consent Management Platforms: Implement tools to streamline consent collection and management. OneTrust and Secure Privacy offer PDPA-compliant consent management solutions.
  • Regular Audits and Training: Conduct periodic compliance audits and provide ongoing staff training. The PDPC offers training resources to help organizations educate their employees.

Recent Updates

The PDPA has undergone several recent updates:

  • Full Enforcement: The PDPA came into full effect on June 1, 2022, after multiple postponements due to the COVID-19 pandemic.
  • Subordinate Regulations: The PDPC has issued several subordinate regulations to clarify specific aspects of the PDPA, including data breach notification procedures and cross-border data transfer requirements.
  • Guidance on Cookies: In March 2023, the PDPC released guidelines on the use of cookies and similar technologies, clarifying consent requirements for different types of cookies.

Related Regulations

The PDPA interacts with several other regulations:

  • Cybersecurity Act: This law complements the PDPA by focusing on national cybersecurity measures. Organizations subject to both laws must ensure compliance with both data protection and cybersecurity requirements.
  • Electronic Transactions Act: This act governs electronic signatures and transactions, which often involve personal data processing. Organizations must consider both laws when handling digital transactions.
  • EU General Data Protection Regulation (GDPR): While separate from the PDPA, the GDPR shares many similarities. Organizations operating in both jurisdictions should be aware of the differences and similarities between these regulations.

Industry Impact

The PDPA has had significant impacts across various industries:

Sources

Recent developments

  • — Singapore PDPC issued Decisions and an Undertaking imposing financial penalties on four organizations for PDPA breaches, including inadequate patch management and lack of data protection officers, affecting over 1 million individuals.[1] (source)
  • — CCPA updates effective January 1, 2026 mandate opt-out confirmations, expanded right-to-know for historical data, ADMT disclosures, and risk assessments for high-risk activities like selling data or using automated profiling.[2] (source)
  • — Taiwan PDPA amendments promulgated on November 11, 2025 establish the PDPC, introduce mandatory data breach notifications to the commission, enhanced security measures, and inspection powers, with effective date pending.[3] (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates