Thailand

Thailand's data-protection regime is anchored in the Personal Data Protection Act B.E. 2562 (2019) (PDPA), a GDPR-influenced omnibus statute. <cite index="2-1,2-2">The Personal Data Protection Act 2019 (PDPA) came into full effect as of June 1, 2022, following two enforcement suspensions, and is Thailand's first comprehensive law covering private sector entities.</cite> <cite index="61-1">The Personal Data Protection Committee (PDPC) is tasked with advisory and enforcement powers under the PDPA.</cite> <cite index="2-4,2-5">Four secondary laws accompany the PDPA covering security measures, ROPA criteria, an SME ROPA exemption, and administrative fines criteria, which became effective between June and December 2022.</cite> Material scope carves out certain public bodies and sectors: <cite index="5-20">the PDPA excludes public authorities that maintain state security from its scope, including financial security, security of the state or public safety, including duties respecting prevention and suppression of money laundering, forensic science or cybersecurity.</cite> <cite index="3-26">The PDPA also provides exceptions for legislative bodies and credit bureau companies.</cite> Territorial reach is broad: <cite index="3-14">the PDPA mirrors the GDPR's extraterritorial applicability and applies to controllers and processors outside of Thailand if they process personal data of data subjects in Thailand or offer goods and services to, or monitor behaviour of, the data subjects.</cite> There is no general registration/filing regime; instead controllers/processors maintain accessible Records of Processing Activities.

The PDPA's Chapter 2 provisions parallel GDPR Articles 6, 7 and 9. <cite index="5-9">Both texts have similar provisions regarding the legal basis of processing, as both list consent, performance of a contract, legal obligations, legitimate interests, or vital interests as a legal basis.</cite> Notably, <cite index="96-6,96-7">research and statistics are recognized as a lawful basis for processing personal data under the PDPA, contrasting with the EU GDPR, under which research and statistics necessitate separate lawful bases.</cite> On consent, <cite index="4-16">the data subject may withdraw his or her consent at any time.</cite> Special/sensitive categories are protected by a consent-plus model: <cite index="94-4">the PDPA outlines that any collection of certain types of data is prohibited without explicit consent except where it is for scientific, historical, or statistical purposes and suitable measures have been taken to protect the fundamental rights of the data subjects.</cite> <cite index="96-1,96-2">In the case of sensitive personal data, the same obligations apply but may be more stringent based on a risk-based approach for high-risk personal data, and the data controller must establish an ethics committee to review and approve related research.</cite> On anonymisation, <cite index="5-14">although the PDPA states that a data subject has the right to anonymise their personal data, unlike the GDPR, the PDPA does not define anonymised or pseudonymised data.</cite>

<cite index="3-15">Both the GDPR and the PDPA empower data subjects with several rights, including the right to erasure, the right to be informed, the right to object, the right to data portability, and the right to access.</cite> On erasure, <cite index="103-16,103-17">both the GDPR and the PDPA allow data subjects to request deletion of their personal information unless exceptions apply, though the scope of, and exemptions to, the right of erasure — including forms of request and response timelines — vary between the two regimes.</cite> On objection, <cite index="94-5">both the GDPR and the PDPA provide data subjects with the right to object to processing unless it is in the public interest.</cite> Portability rights are also mirrored from the GDPR framework. Specific statutory response-window figures (e.g., exact day-counts for access/erasure responses) were not independently confirmed from the primary PDPA text in this research pass.

PDIA-equivalent accountability is indirect: <cite index="54-32,54-33">while the GDPR specifically provides for DPIAs, the PDPA outlines that data controllers have a duty to provide appropriate security measures and review them when necessary, or when technology has changed, to maintain appropriate security standards.</cite> DPO appointment is mandatory in defined circumstances per PDPA Section 41 (public-authority status, large-scale/systematic processing, or large-scale special-category processing), though the full statutory trigger list was only partially retrievable from the primary text in this pass. Enforcement confirms real-world application: <cite index="13-2,13-3">the PDPC found a company failed to appoint a DPO despite handling personal data for over 100,000 individuals as a core activity, which triggered the PDPA's DPO-designation requirement.</cite> On ROPA, <cite index="1-10,1-11">the PDPC released Rules and Procedures for the Preparation and Maintenance of the Record of Processing Activities by the Data Processor, requiring records to be readily accessible and promptly presented to the Office of the PDPC or data controllers.</cite> <cite index="14-18,14-19">Small businesses, community/social enterprises, cooperatives, foundations, associations, religious and nonprofit organisations are exempted from the ROPA requirement except for instances involving rejection of a data subject's request or objection.</cite> Security: <cite index="25-11,25-12,25-13">security measures must consist of appropriate organizational and technical measures ensuring ongoing confidentiality, integrity and availability of personal data, including access control and user access management, with periodic review required.</cite> Breach notification: <cite index="6-1">under Section 37(4) of the PDPA and Section 5(3) of the notification, data controllers are required to notify the PDPC of a personal data breach without undue delay and, when feasible, within 72 hours of becoming aware of the breach.</cite> <cite index="1-13,1-14">If the breach carries a high risk to rights and freedoms, controllers must also notify affected data subjects, per the PDPC's Criteria and Procedures for Handling Personal Data Breaches, effective 15 Dec 2022.</cite> <cite index="1-17,1-18">If a breach cannot be reported within 72 hours, the controller may request an exemption from penalties, provided the request is submitted no later than 15 days after becoming aware of the breach with valid reasons for the delay.</cite> Joint-controller-specific rules and detailed statutory retention/disposal periods were not independently located in this pass.

<cite index="1-19">Section 28 of the PDPA stipulates the need for sending or transferring data to a destination country or international organization with adequate data protection standards.</cite> <cite index="25-16,25-17">In December 2023 the PDPC issued Criteria on the Protection of Personal Data Sent or Transferred Abroad pursuant to Section 28, clarifying that 'sending or transferring personal data' excludes data transit where personal data passes through an intermediary such as cloud computing services.</cite> <cite index="25-18,25-19">Adequacy is not itemised in detail but is assessed against factors including measures or legal mechanisms in the destination country consistent with the PDPA and the presence of enforcing agencies there.</cite> On intragroup transfers, <cite index="14-7,14-8">the PDPC issued rules on intragroup transfers under Section 29, exempting Section 28 obligations for transfers within a group of undertakings that follow PDPC-approved binding corporate rules.</cite> <cite index="14-10,14-11">Appropriate safeguards recognised absent adequacy or approved BCRs include standard data protection clauses, certification, or legally binding agreements between Thai and foreign entities.</cite> Most recently, <cite index="29-13">the PDPC issued updated regulations on BCRs for data protection within corporate groups, effective 17 February 2026.</cite> No PDPC-published list of jurisdictions formally granted or receiving Thai-PDPA adequacy status was identified, and no general data-localisation mandate distinct from the Section 28/29 transfer regime was located.

Financial services carry an independent overlay: <cite index="72-2,72-3">the Bank of Thailand (BoT) requires financial institutions to follow specific data-protection and privacy procedures under the Financial Institutions Business Act B.E. 2551 (FIBA), although these requirements are independent from other data protection and privacy legislation.</cite> <cite index="75-3,75-4">In August 2021, the BoT issued an official letter directing banks and financial institutions to prepare for PDPA compliance ahead of the (then) enforcement date.</cite> Credit reporting retains sector specificity: <cite index="71-8,71-9">before the PDPA, data protection regulation was limited to specific sectors including government agencies, telecommunications, and the National Credit Bureau, and the PDPA now mandates continued compliance with both existing sectoral regulation and the PDPA for these sectors.</cite> No PDPA-specific sub-legislation distinct from the general framework was independently identified for health, telecoms/ePrivacy, employment, education, or insurance sectors in this pass.

Direct marketing is multi-regulator: <cite index="52-4,52-6,52-9">direct-marketing activity in Thailand is governed by the Direct Sale and Direct Marketing Act B.E. 2545, the Consumer Protection Act B.E. 2522, the PDPA, and the Computer-Related Crime Act B.E. 2550, with the Office of the Consumer Protection Board and the PDPC both issuing relevant guidance.</cite> No PDPC-specific cookie-consent notification, dark-pattern prohibition, Global-Privacy-Control-style opt-out-signal recognition, clean-room/data-collaboration-room rule, or cross-context-advertising ('sale'/'share') framework distinct from general PDPA consent principles was identified in the sources reviewed for this run.

The PDPA carries a state-security carve-out but no dedicated algorithmic/biometric/genetic sub-regime: <cite index="5-20">the PDPA excludes public authorities that maintain state security — including financial security, public safety, prevention/suppression of money laundering, forensic science, and cybersecurity — from its scope.</cite> On AI, governance remains soft-law and sector-specific rather than binding, cross-cutting legislation: <cite index="43-5">Thailand's Electronic Transactions Development Agency (ETDA) has launched a public consultation on draft AI-data-protection guidelines to balance innovation with privacy rights and ensure PDPA compliance,</cite> and separately <cite index="61-16">the Bank of Thailand has sought public input on AI guidelines for financial services, focusing on risk management and transparency.</cite> No PDPA-specific Article-22-style automated-decision-making transparency right, dedicated biometric-data regime, or genetic-data regime distinct from the general special-category rules was independently identified.

Minors' consent capacity is governed by reference to Thai civil-law majority/sui-juris concepts rather than a fixed statutory age threshold as in GDPR Art.8: <cite index="31-1,31-2">unlike the GDPR — under which children under 16 must have parental/guardian consent, with Member States able to lower the threshold to 13 — the PDPA provides that minors who are not sui juris by marriage or otherwise lack capacity as a sui juris person under the Civil and Commercial Code require consent to be given on their behalf.</cite> No PDPA-specific age-verification mechanism, minor-profiling ban, education-sector-specific rule, or dependent-adults provision distinct from these general consent-capacity rules was independently identified in this pass.

<cite index="25-8">The Expert Committee is authorized to consider complaints, investigate and impose punitive measures for PDPA violations.</cite> <cite index="5-14">Violations of the PDPA can, alongside monetary and administrative penalties, result in imprisonment for a term not exceeding one year.</cite> <cite index="47-1,47-2">Pre-enforcement legal commentary indicated administrative fines could reach up to THB 5,000,000 (approximately EUR 141,000).</cite> In practice, <cite index="13-7,13-8">on 31 July 2024 — two years after the PDPA became fully enforceable — the Expert Committee issued its first administrative fine, a THB 7 million penalty against an online-retail company for notable compliance failures,</cite> a figure exceeding the commonly-cited single-violation cap and suggesting aggregation across multiple concurrent breaches (failure to appoint a DPO, mishandling of complaints, and inadequate remediation of ongoing customer-data misuse). <cite index="1-6,1-7">In setting fines, the Expert Committee weighs factors including offence severity, the size of the controller/processor's business, benefits derived and harm caused, broader implications for related industries, the offender's level of responsibility, and remedial or mitigating action taken.</cite> Recent developments within the 180-day window include <cite index="29-13">PDPC BCR regulations effective 17 February 2026</cite> and <cite index="82-9,82-10">a 2026 PDPC clarification, issued in response to a company-led public consultation, detailing the Section 12 risk-evaluation criteria that determine when a breach-notification exemption applies.</cite> Regulator funding/headcount data and a standalone private-right-of-action mechanism (distinct from the PDPC complaint/administrative-fine pathway and referenced class-action potential) were not independently confirmed in this pass.