By Daniel de Almeida Afonso · Last updated: October 12, 2026
Thailand's Personal Data Protection Act (PDPA) has been fully enforceable since June 1, 2022, and it applies to any business that collects, uses or discloses personal data in Thailand, or that offers goods or services to people in Thailand or monitors their behavior there, whether or not it has an office in the country. Administrative fines reach THB 5 million for the most serious violations, a few offenses carry up to one year in prison, and the regulator has been issuing fines since 2024.
This guide covers who must comply, what the law requires, how consent and cookies fit in, the real penalties, and the enforcement record so far. The Act is modeled on the GDPR, but the details differ in places that matter.
When did the Thailand PDPA take effect?
The PDPA was published in the Royal Thai Government Gazette on May 27, 2019, and most of its provisions were due to apply a year later. Two postponements followed. A royal decree in May 2020 pushed enforcement for most businesses to May 31, 2021, and a second decree in May 2021 pushed it to June 1, 2022.
The Personal Data Protection Committee (PDPC), which issues the rules and guidance under the Act, was appointed in January 2022. Since June 2022 the Act has applied in full, and the PDPC has been issuing subordinate regulations that fill in the detail.
Who does the Thailand PDPA apply to?
The Act applies to any controller or processor located in Thailand, wherever the processing takes place (Section 5). It also reaches businesses outside Thailand when they offer goods or services to people in Thailand, even for free, or monitor behavior that takes place in Thailand.
The Act excludes a short list of activities (Section 4), including:
- Personal or household use only.
- State security, public safety, anti-money-laundering and cybersecurity work by public authorities.
- Media, fine arts or literature activity that follows professional ethics or serves the public interest.
- Parliamentary work, court proceedings and credit bureau operations under their own law.
A foreign business covered by the extraterritorial rule must also appoint a representative in Thailand, in writing, with authority to act for it without limit of liability (Section 37(5)). Some businesses can be exempted (Section 38).
What are the key definitions?
- Personal data: information that identifies a living person, directly or indirectly. Data about deceased people is excluded.
- Data controller: the person or company that decides how personal data is collected, used or disclosed.
- Data processor: a person or company that handles data on the controller's instructions.
- Sensitive personal data: racial or ethnic origin, political opinions, creed, religious or philosophical beliefs, sexual behavior, criminal records, health data, disability, trade union information, genetic data and biometric data (Section 26). The Committee can add similar categories.
What are the lawful bases for processing?
Consent is the default. A controller may not collect, use or disclose personal data without it, unless the Act or another law allows it (Sections 19 and 24). The alternatives to consent are:
- Research, statistics or historical archives, with safeguards.
- Preventing danger to a person's life, body or health.
- Performing a contract with the data subject.
- A public-interest task or official authority.
- Legitimate interests, unless the person's fundamental rights override them.
- Compliance with a legal obligation.
Sensitive data is stricter. Collecting it requires explicit consent unless a narrow exception applies, such as protecting life, establishing or defending legal claims, or specific health, employment and research purposes (Section 26).
What does valid consent look like?
Section 19 sets out the rules, and they are more detailed than many summaries suggest:
- Ask before or at the time of collection.
- Make the request explicit, in writing or electronically, and clearly distinguishable from other matters.
- State the purpose in plain language that is not deceptive or misleading.
- Make consent freely given. A contract or a service cannot be conditioned on consent to data use that is not necessary for it.
- Let people withdraw at any time, as easily as they gave consent.
A consent request that breaks these rules has no binding effect and does not entitle the controller to process the data.
Minors. If the child is under 10, consent comes from the holder of parental responsibility. For older minors, parental consent is also required unless the act is one a minor may do alone under the Civil and Commercial Code (Section 20). That is different from the GDPR's age-16 default, and it is not a flat "10 and over can consent" rule.
How do cookies and online tracking fit in?
The PDPA does not mention cookies. It regulates personal data, and cookies, device IDs and similar identifiers fall under it when they relate to an identifiable person. The practical result: if a cookie or tracker collects personal data and you have no other lawful basis, you need consent that meets Section 19.
In practice, that means:
- Do not set analytics or advertising trackers before the visitor has opted in.
- Do not treat scrolling or continued browsing as consent.
- Do not bundle consent into your terms and conditions.
- State each purpose in plain language.
- Make withdrawal as easy as accepting, for example through a persistent settings link.
- Keep a record of who consented, when, and to what, so you can show it later.
I could not find a PDPC rule written specifically for cookies, so these points come from reading Section 19 and from common practice, not from a cookie regulation. Strictly necessary cookies are best justified on another basis, such as performing a contract, and documented. For banner design and wording, see our guide to cookie banners and what they must say.
What rights do people have?
The Act gives individuals these rights over their data (Sections 30 to 36 and 73):
- Access and a copy of their data.
- Portability in a machine-readable format.
- Objection, including to direct marketing at any time.
- Erasure, destruction or anonymization when the data is no longer needed or consent is withdrawn.
- Restriction of use, and correction of inaccurate data.
- Withdrawal of consent at any time.
- A complaint to the PDPC's expert committee if the Act is broken.
When a controller refuses a request, it must record the refusal and the reasons.
What must a privacy notice contain?
At or before collection, tell people the purposes, which data you collect and for how long, who may receive it, whether providing it is required by law or contract, your contact details (plus a representative or DPO if you have one), and their rights (Section 23).
What other duties do businesses have?
Security. Controllers must maintain appropriate security measures and review them when technology changes (Section 37). A 2022 PDPC notification sets a minimum standard covering access control, audit trails, staff awareness and processor requirements.
Breach notification. Notify the PDPC office without delay and, where feasible, within 72 hours of becoming aware of a breach, unless it is unlikely to risk people's rights and freedoms. If the risk is high, notify the affected people too (Section 37(4)). Processors must tell the controller (Section 40).
Records of processing. Controllers must keep records of the data collected, purposes, retention periods and security measures (Section 39), and processors must keep their own. A June 2022 PDPC notification exempts some small organizations, but not where processing is regular, risks people's rights, or involves sensitive data.
Data protection officer. A DPO is required for public authorities, for controllers and processors whose activities need regular monitoring of data because of large volumes, and for those whose core activity is processing sensitive data (Section 41). The Act leaves "large volumes" to Committee notification, and I could not confirm a published threshold. The PDPC's first fine rested on a company processing the data of more than 100,000 people as a core business, according to law firm reports.
Can you transfer personal data out of Thailand?
Sending personal data abroad requires that the destination has adequate protection, unless an exception applies (Section 28). The exceptions include legal compliance, the person's informed consent, performing a contract, protecting life, and substantial public interest. Without an adequacy decision, transfers can proceed with appropriate safeguards, or within a corporate group under binding corporate rules certified by the PDPC office (Section 29).
Two PDPC notifications on these rules were published in the Gazette on December 25, 2023 and took effect on March 24, 2024, according to law firm summaries. They cover the adequacy test, binding corporate rules, and safeguards such as standard contractual clauses and certification. Reports I read say the PDPC has not published a list of approved countries, so check each transfer against the notifications. For the wider picture on transfer mechanisms, see our cross-border data transfers guide.
What are the penalties for violating the PDPA?
There are three tracks: civil, criminal and administrative.
Civil. A controller or processor that violates the Act and causes damage must compensate the person, whether the breach was intentional or negligent, unless it can prove force majeure or the person's own act, or that it followed a government order (Section 77). Courts may add punitive damages of up to twice the actual compensation (Section 78). Claims expire three years after the person learns of the damage and who is liable, or ten years after the wrongful act.
Criminal. Criminal liability is narrower than many summaries claim. It covers misuse of sensitive data and disclosure by people who learn data while performing duties under the Act (Sections 79 and 80):
- Using or disclosing sensitive data beyond the consented purpose, or transferring it abroad in breach of the Act, in a way likely to cause damage or harm to reputation: up to 6 months in prison, a fine up to THB 500,000, or both.
- The same conduct to gain an unlawful benefit: up to 1 year, a fine up to THB 1 million, or both.
- Disclosing data learned while performing duties under the Act: up to 6 months, up to THB 500,000, or both.
Directors and managers behind a company's offense can be punished too (Section 81).
Administrative. The PDPC's expert committee can impose fines in tiers (Sections 82 to 89):
| Maximum fine | Examples of what triggers it |
|---|---|
| THB 1 million | Failing to give the privacy notice, to keep records, to appoint a DPO, or to follow Committee-prescribed consent forms |
| THB 3 million | Using data beyond the notified purpose, collecting more than necessary, weak security, failing to notify a breach, misleading consent, unlawful transfers; processors who fail to follow controller instructions |
| THB 5 million | Violating the sensitive data rules, including transferring sensitive data abroad unlawfully |
| THB 500,000 | Ignoring an expert committee order or failing to provide requested facts |
The expert committee may issue a warning or a fix-it order before a fine, and must weigh the severity of the act and the size of the business (Section 90). THB 5 million is the ceiling for the most serious tier only, not for every breach.
What has enforcement looked like so far?
Enforcement began with the first administrative fine, announced in August 2024 after an order dated July 31, 2024. The PDPC fined an online IT products retailer THB 7 million: THB 1 million for failing to appoint a DPO, THB 3 million for inadequate security, and THB 3 million for failing to report breaches. Customers had complained of scam calls from people who knew their purchase details. Sources differ on whether the company was officially named, so I am not naming it.
On August 1, 2025, the PDPC announced further fines across five cases, which law firm summaries link to a state agency and its developer, a private hospital and its contractor, a cosmetics company, and a toy retailer and its processor. The recurring failures were weak security, missing breach reports, no DPO and poor processor oversight. In three of the cases, the processor, developer or contractor was fined alongside the main organization. Law firms report the cumulative total differently (some say over THB 21 million, another counts THB 14.5 million for the 2025 batch), so check the PDPC's own announcements before quoting a number.
The lesson: the early cases were about basics (security, breach reporting, DPOs), not cookie banners or consent wording.
How should you prepare?
- Map your data. Know what personal data you collect, where it flows, who processes it, and the lawful basis for each use.
- Decide on consent versus another basis for each purpose, and write it down.
- Update privacy notices to cover the Section 23 contents.
- Set up rights handling: a way to receive, track and answer access, erasure, objection and portability requests, and to record refusals.
- Put security and a breach plan in place that can meet the 72-hour window, including a way for processors to alert you.
- Check whether you need a DPO, a Thailand representative, and records of processing. Our guide to GDPR records of processing is a useful starting point for the format, but Section 39 lists its own required fields.
- Review processor contracts and your cross-border transfer mechanism.
- Train your staff and review all of this regularly.
GDPR compliance gives you a head start, not a finish line. See how the two laws differ in our Thailand PDPA vs GDPR comparison, and read about the role itself in our guide to data protection officers.
Frequently asked questions
Does the Thailand PDPA apply to a company outside Thailand?
Yes, if it offers goods or services to people in Thailand or monitors their behavior there. Payment does not matter. It must also appoint a representative in Thailand in writing, unless exempted.
What is the maximum fine under the Thailand PDPA?
The highest administrative fine is THB 5 million, and it applies to violations of the sensitive data and related transfer rules. Most other violations are capped at THB 1 million or THB 3 million. Criminal penalties and civil damages are separate and can apply in addition.
Do I need consent for cookies in Thailand?
If a cookie or tracker collects personal data and no other lawful basis applies, yes, and the consent must meet Section 19. The PDPA does not name cookies, and I found no PDPC cookie rule, so use the Section 19 standard: opt-in before setting, plain language, separate from the terms, easy to withdraw.
Do I need a data protection officer in Thailand?
Only in certain cases: public authorities, organizations whose activities need regular monitoring of large volumes of data, and those whose core activity is processing sensitive data. In its first fine the PDPC found a DPO was required for a company processing data of more than 100,000 people.
At what age can a child consent under the PDPA?
Under age 10, only a parent or guardian can consent. For older minors, parental consent is generally also needed unless the act is one a minor can do alone under the Civil and Commercial Code.
Secure Privacy offers a short demo of its consent management platform for teams that want to see how consent collection and logging work.
