The Personal Data Protection Act (PDPA) B.E. 2562 has been fully in force since 1 June 2022. After two years of guidance, the regulator moved to active enforcement. The first administrative fine, 7 million baht, was imposed in August 2024. In August 2025, the regulator announced eight more fines in five cases. If your business collects personal data of people in Thailand, whether you are based in Thailand or abroad, the PDPA applies to you, and its enforcement is no longer theoretical.
Last updated: October 2026
What is Thailand’s PDPA?
The Personal Data Protection Act B.E. 2562 (2019) is Thailand’s first general personal data protection law. Inspired by the European GDPR, whose main principles it follows, it governs the collection, use and disclosure of the personal data of individuals in Thailand.
The Act is administered by the Personal Data Protection Committee (PDPC), which issues regulations and guidelines and enforces the law through its office. Expert committees appointed by the PDPC handle complaints and impose administrative fines.
Who does the PDPA apply to?
This is the first point that is often misunderstood: the PDPA has extraterritorial reach. It applies to:
- any organisation established in Thailand that collects, uses or discloses personal data
- any organisation outside Thailand that collects, uses or discloses personal data of people in Thailand, when it offers them goods or services, whether paid or not, or monitors their behaviour in Thailand
In practice, a European e-commerce site selling to customers in Thailand, an app used in Thailand or a foreign consulting firm working with Thai clients can all be subject to the PDPA.
Exemptions include personal or household activities, certain state activities relating to national security and public safety, and media activities carried out under professional ethics.
Key definitions
Personal data: any information that identifies a natural person directly or indirectly, such as a name, address, email, phone number, IP address, location data or online identifier. Data of deceased persons is excluded.
Sensitive data: a special category with stricter rules, covering racial or ethnic origin, political opinions, religious or philosophical beliefs, sexual behaviour, criminal records, health data, disability, trade union information, genetic data and biometric data. Collecting it generally requires explicit consent, unless another specific legal basis applies.
Data controller: the person or entity that decides how and why personal data is collected, used or disclosed.
Data processor: the person or entity that processes personal data on behalf of the data controller.
Legal bases for processing
Every collection or use of personal data must be based on one of the following legal bases:
- Consent: freely given, informed, specific, separate from other terms and withdrawable at any time
- Contract: when processing is needed to perform a contract with the data subject
- Legal obligation: when processing is required by law
- Vital interest: to prevent or suppress a danger to a person’s life, body or health
- Public task: to carry out a task in the public interest or exercise official authority
- Legitimate interest: unless the data subject’s fundamental rights override it
- Research, statistics or historical archives: with appropriate safeguards
Consent is the most demanding basis. It must be obtained before collection, clearly separated from other contractual terms, and must not be a condition for a service unless the data is needed for it. In the Worldcoin case of November 2025, the authorities questioned whether consent was truly voluntary when crypto tokens were offered in exchange for iris scans.
Main obligations for businesses
Privacy notice
Every organisation processing personal data must inform data subjects, at or before the time of collection, of:
- the purpose of the processing and its legal basis
- the data collected and how long it will be kept
- the categories of people or organisations it may be disclosed to
- the identity and contact details of the data controller and, where applicable, its DPO
- the rights of data subjects
Security measures
Organisations must put in place appropriate measures to protect data against unauthorised access, loss, use, change or disclosure. These include organisational measures (internal policies, training), technical measures (encryption, access control) and physical measures (secure premises), as set out in the PDPC’s security notification. The August 2025 fines show that weak passwords, the absence of risk assessments and missing data processing agreements are all sanctioned.
Data breach notification
In the event of a personal data breach:
- notify the PDPC without undue delay and, where possible, within 72 hours of becoming aware of it, unless the breach is unlikely to create a risk
- notify affected individuals without undue delay if the risk to them is high, together with the remedial measures
Failure to notify the PDPC was one of the violations cited in several of the fines imposed so far.
Data Protection Officer (DPO)
A Data Protection Officer must be appointed by:
- public authorities designated by the PDPC
- organisations whose core activities involve regular and systematic monitoring of personal data on a large scale (for example, data on 100,000 people or more)
- organisations whose core activities involve processing sensitive data
A PDPC announcement of 9 October 2025, effective 9 December 2025, widened the list of state agencies that must appoint a DPO. Failing to appoint a DPO when required is a separate breach: it was cited in the first fine of August 2024.
Record of processing activities
Data controllers must keep a record of their processing activities, which the PDPC can ask to see. Small businesses benefit from some exemptions, but not if they process sensitive data or carry out high-risk processing.
Data processing agreements
When a service provider processes personal data for you (IT, payroll, call centre, cloud, records destruction), you need a written agreement setting out its obligations. In the August 2025 cases, both controllers and processors were fined, including a contractor hired to destroy medical records.
International data transfers
Transfers of personal data outside Thailand are governed by Sections 28 and 29 of the PDPA and by two PDPC notifications issued in December 2023, in force since 24 March 2024.
Personal data can only be transferred outside Thailand to countries with adequate protection, or with appropriate safeguards:
- Adequacy list: the PDPC has not yet published a list of countries with adequate protection.
- Standard contractual clauses: the most widely used mechanism in practice. The PDPC accepts its own models as well as models such as the ASEAN Model Contractual Clauses and the EU standard contractual clauses.
- Binding Corporate Rules (BCRs): for transfers within a group. The PDPC issued its BCR certification rules on 29 September 2025 and approved its first BCRs the following day.
- Other exceptions: such as the explicit consent of the data subject, after being informed of the risks, or the performance of a contract.
The rights of data subjects
The PDPA gives individuals whose data is processed the following rights:
- Access: to obtain a copy of their data and know how it was obtained
- Portability: to receive their data in a structured, machine-readable format and have it transferred
- Objection: to object to certain processing, including direct marketing
- Erasure: to have their data deleted, destroyed or anonymised in certain cases
- Restriction: to have the use of their data suspended in certain cases
- Rectification: to have inaccurate data corrected and kept up to date
- Withdrawal of consent: at any time, without affecting processing already carried out
- Complaint: to file a complaint with the PDPC
Unlike the GDPR, the PDPA does not provide a specific right not to be subject to automated decision-making.
Enforcement since 2024: the end of the grace period
The PDPA moved from guidance to active enforcement from mid-2024. Here are the documented facts.
First fine: August 2024
On 21 August 2024, the PDPC announced its first administrative fine since the Act came into force: 7 million baht against a large private online retailer of IT products. The company had collected data on more than 100,000 customers without appointing a DPO, had inadequate security measures, delayed notifying the PDPC of breaches and ignored complaints. The leaked data had been used by call-centre scam gangs.
Wave of fines: August 2025
On 1 August 2025, the PDPC announced eight administrative fines in five cases, totalling about 14.5 million baht, against public and private organisations:
- A government agency and its system developer: 153,120 baht each, after a cyberattack exposed data on more than 200,000 people, offered for sale on the dark web. The agency had weak passwords, no risk assessment and no data processing agreement.
- A private hospital: 1.21 million baht, and 16,940 baht for the individual hired to destroy its medical records, after about 1,000 patient records leaked.
- A computer equipment retailer: 7 million baht, for inadequate security, failure to notify the breach and no DPO.
- A cosmetics company: 2.5 million baht, for inadequate security and failure to notify the breach.
- A collectible toy seller and its booking system developer: 500,000 baht for the seller and 3 million baht for the developer, after a hacker accessed the booking system.
The PDPC also ordered the organisations to fix their systems within 30 days. According to reports on the announcement, total administrative fines since the PDPA came into force exceed 21.5 million baht.
The Worldcoin case: November 2025
On 24 November 2025, the Thai authorities ordered World (formerly Worldcoin), the iris-scanning project, to stop its iris scanning in Thailand and to delete the biometric data collected, reportedly about 1.2 million records. The concerns raised were that offering crypto tokens could undermine voluntary consent, that iris data is high-risk biometric data, and that the data could be used beyond its stated purposes.
PDPC Eagle Eye
The PDPC runs a unit called PDPC Eagle Eye, which uses technology to monitor data leaks on search engines, online sources and the dark web. It allows the regulator to contact organisations about a suspected breach without waiting for a complaint.
The regulator’s current priorities
Recent cases and guidance point to several priority areas: healthcare and the destruction of medical records, biometric processing (digital identity, fintech onboarding, access control), and outsourced processing (call centres, cloud services, booking systems). A draft amendment to the PDPA was also put to public consultation at the end of 2025.
Penalties
The PDPA provides three types of penalties.
Administrative fines
Depending on the breach, administrative fines can reach 1 million, 3 million or 5 million baht per breach (Sections 82 to 90). The first fine of 7 million baht exceeded the 5 million figure because several separate breaches were combined. The PDPC can also order corrective measures, with additional fines if they are not carried out.
Criminal penalties
Criminal penalties mainly concern the unlawful use or disclosure of sensitive data:
- up to 6 months’ imprisonment and/or a fine of up to 500,000 baht when it is likely to cause damage
- up to 1 year’s imprisonment and/or a fine of up to 1 million baht when done to obtain an unlawful benefit
Directors and managers can be held personally liable when the offence results from their instructions or their failure to act.
Civil liability
A data subject harmed by a breach can claim compensation for the actual damage. The court can also award punitive damages on top of it.
Emergency Decree on technology crime: April 2025
The Emergency Decree on Measures for the Prevention and Suppression of Technology Crimes (No. 2) B.E. 2568, in force since 13 April 2025, adds specific criminal offences for the misuse of personal data:
- collecting, possessing or disclosing personal data to enable a crime: up to 1 year’s imprisonment and/or a fine of up to 100,000 baht
- buying, selling, exchanging or unlawfully profiting from personal data: up to 5 years’ imprisonment and/or a fine of up to 500,000 baht
Practical checklist for businesses in Thailand
Here is what every business processing personal data in Thailand should have in place:
- Privacy notices: for customers, employees and job applicants, clear and up to date
- Consent management: including for non-essential website cookies, in line with PDPC guidance
- Record of processing activities: an internal document listing all processing activities
- Data processing agreements: with every service provider that accesses personal data
- Security measures: passwords, access control, risk assessments and regular reviews
- Breach response plan: a documented procedure to meet the 72-hour deadline
- DPO: appointed if your core activities require it
- Transfer mechanism: standard contractual clauses or BCRs for any transfer outside Thailand, including to a parent company or cloud servers abroad
Key points
- Thailand’s PDPA has been fully in force since June 2022, and active enforcement began in August 2024 with the first fine.
- It applies to any organisation processing personal data of people in Thailand, even if it is based abroad.
- Key obligations: a legal basis for all processing, privacy notices, security measures, breach notification within 72 hours, a DPO where required and processing agreements with service providers.
- International transfers have been regulated since March 2024: standard contractual clauses or BCRs are needed, as there is no adequacy list yet.
- More than 21.5 million baht of administrative fines in total, according to reports, against both controllers and processors.
- Since April 2025, an emergency decree adds criminal penalties of up to 5 years’ imprisonment for trading in personal data.
Frequently asked questions about the PDPA in Thailand
Does the PDPA apply to a foreign SME selling online to customers in Thailand?
Yes. The PDPA has extraterritorial reach. Any organisation that offers goods or services to people in Thailand, or monitors their behaviour, is subject to the Act wherever it is based. A European SME running an e-commerce site with customers in Thailand is covered.
Is GDPR compliance enough to comply with the PDPA?
GDPR compliance covers most PDPA requirements, as the two laws share the same principles. But there are differences: Thai-specific notifications (security, DPO, breach notification, transfers), the absence of an adequacy list, documents filed with the PDPC, such as BCR applications, that must be in Thai, and differences in data subject rights. A specific PDPA review is recommended.
When is a DPO mandatory?
For public authorities designated by the PDPC, for organisations whose core activities involve large-scale, regular and systematic monitoring of personal data, and for those whose core activities involve processing sensitive data. Failing to appoint a DPO when required is a separate breach.
How should data transfers to servers in Europe or the United States be handled?
As the PDPC has not published an adequacy list, the safest mechanism is to sign standard contractual clauses with the recipient, using a model accepted by the PDPC, such as the ASEAN Model Contractual Clauses or the EU standard contractual clauses. Groups can also have Binding Corporate Rules certified by the PDPC since September 2025.
What should you do in the event of a data breach?
Notify the PDPC without undue delay and, where possible, within 72 hours of becoming aware of it. If the risk to the people affected is high, notify them without undue delay as well. Document the breach, the measures taken and the notifications. Failure to notify the PDPC was cited in several of the fines imposed so far.
Is the data of Thai employees covered by the PDPA?
Yes. Employee data (contracts, payslips, evaluations, health data and so on) is personal data covered by the PDPA, and health data is sensitive data. Employers need a legal basis to process it and must inform their employees about how their data is used.
Conclusion
Thailand’s PDPA has left its grace period behind and entered a phase of sustained enforcement. The fines imposed in 2024 and 2025 are not just warnings: they set precedents that will guide the regulator’s next decisions, and they show that processors are fined as well as controllers. For businesses operating in Thailand or offering services to people in Thailand, compliance is no longer optional.
Data protection is one of several compliance areas to manage when doing business in Thailand, alongside the rules on foreign ownership set out in our article on Thailand’s Foreign Business Act. If you want your PDPA compliance assessed or need support putting the required measures in place, contact our team at our offices in Thailand.
