Home » Resources » Understanding Thailand’s Personal Data Protection Act (PDPA)

Understanding Thailand's Personal Data Protection Act (PDPA)

The Personal Data Protection Act (PDPA), B.E. 2562 (2019), Thailand’s first-ever data privacy legislation, took effect on June 1, 2022. This was just over three years after its introduction in the Royal Thai Government Gazette. Following a series of updates and the country’s first legal action for PDPA noncompliance, the law remains an important milestone for Thai companies and organizations dealing with the data of Thai subjects. 

The law regulates how businesses operating in Thailand should handle the personal data of the country’s citizens and their right to privacy. It specifically requires businesses to establish clear mechanisms for data subject consent and implement safeguards to protect sensitive data, thus aligning with international data protection norms.

A Personal Data Protection Committee (PDPC) was created to enforce the law and ensure compliance, along with publishing guidelines, standards, and exceptions for data controllers. The PDPC’s release of additional sub-regulations in March 2024 further clarified compliance requirements, particularly for cross-border data transfers and Binding Corporate Rules (BCRs).

Broad protections across all platforms

The PDPA comprehensively regulates the collection, use, and disclosure of personal data in online, offline, and paper-based contexts.

It applies to all businesses operating in Thailand, or offering services to people in Thailand, including those outsourcing data to third parties. Additionally, it provides specific exemptions for personal or household activities, public security, and mass media operations conducted in line with professional ethics.

The broad protections aim to align with evolving digital economy standards, ensuring relevance in global trade and data processing frameworks.

Let’s look more at the PDPA to understand its similarities and differences with other local, national, and international data management standards.

Unique principles

Like many of the newer data protection laws, PDPA leverages several of the same principles as the European Union’s General Data Protection Regulation (GDPR). Both laws try to limit the nature of personal data and how long an organization can hold it.

Because of PDPA’s similarity to GDPR, a company doing business in the EU will be familiar with most of the PDPA’s provisions. It will be able to adjust its compliance program to PDPA’s specific requirements. For example, under both laws, organizations have 72 hours to notify customers of a data breach unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.

Understanding each law

There are a few critical differences that businesses operating or planning to operate in Thailand must understand.

• Consent is a cornerstone of the PDPA, and one of the primary legal bases for the processing of data. 
  • The Act states that data controllers shall not collect personal data without consent unless it is done for specific purposes, such as performing tasks in the public interest or enacting certain contractual obligations. 
  • In most commercial cases, however, obtaining the explicit consent of the data subject is necessary. 
  • Consent must be clearly documented and businesses must enable easy withdrawal mechanisms for data subjects.
• In both the GDPR and PDPA, the Data Controller is responsible for ensuring that the data is accurate. However, PDPA obligates the Data Controller to ensure that the personal data remains accurate, up-to-date, complete, and not misleading. The Data Subject can request the Data Controller to comply with this requirement.
• GDPR restricts data profiling and contains a strong definition of Right to Profiling, which does not appear in PDPA.
• Some data controllers qualifying as small and medium-sized enterprises (“SMEs”), as defined under the Small and Medium-sized Enterprise Promotions Act (“SMEs Act”), are exempt from keeping a Record of Processing Activities (RoPA). There are exceptions, however, and even SMEs may have to prepare a RoPA if they collect data that poses a risk to the rights and freedoms of data subjects, for example.
• Under PDPA, Data Controllers do not need to conduct a data protection impact assessment (DPIA). However, as part of their security obligations, they must review their security measures when necessary or when the technology has changed to maintain suitable security and safety requirements successfully.
• The Thailand Supervisory Authority accepts specific industry control frameworks, such as ISO 27001, as sufficient evidence to comply with minimum security standards published by Thailand’s Ministry of Digital Economy and Society.

Enforcement and penalties

Failure to meet PDPA laws can result in criminal, civil, and administrative penalties. The most egregious violations involving sensitive personal data and unauthorized disclosure are punishable by up to a year in prison.

The amount of the penalty varies according to the nature of the violation of the law.

While many sources state that the maximum administrative fine under the PDPA is Baht 5 million, in November 2024 the PDPC fined a prominent Thai IT distributor Baht 7 million (approximately $204,000 USD) for violating PDPA principles, including:

• Inadequate security measures (Section 37(1))
• Delayed notification of the PDPC (Section 37(4))
• Failure to appoint a DPO promptly (Section 41(2))

In addition to financial penalties, the company was ordered to overhaul its data protection framework within 30 days and provide weekly updates to the PDPC.

This case underscores the importance of PDPA compliance for businesses.

Data breach management

Organizations must adopt comprehensive incident response plans, including breach notification procedures and swift corrective actions.

The PDPC’s phased notification process allows for timely updates as more information becomes available. Businesses should also establish clear escalation protocols for handling breaches to ensure rapid response.

Comply with Thailand’s PDPA with Blancco

Contact us to learn more about the critical role of data destruction in the PDPA, including how Blancco’s data erasure solutions can support you in erasing end-of-life personal data.

First published in 2023. Updated in 2025 to reflect recent changes.

You may be interested in:

Blancco Data Erasure Software Certified for Government Use in Australia, New Zealand

Blancco Partners with Deloitte to Reduce Enterprise Cyber Risk in India

Governments and public sector organizations spend millions globally each year destroying data storage devices despite sustainable alternatives

A spotlight on GDPR: Is your data centre compliant?