Personal Data Protection Act

Thailand’s Personal Data Protection Act B.E. 2562 (2019) (“PDPA”) establishes a comprehensive legal framework governing how personal data is collected, used, disclosed, and safeguarded. As Thailand’s first unified data protection law, the PDPA fundamentally reshaped privacy compliance across public and private sectors, aligning Thai standards with global data protection norms while retaining distinct local enforcement and procedural features.

This article provides a deeper and more detailed examination of the PDPA, focusing on its legal structure, operational requirements, regulatory enforcement, and practical implications for organizations and individuals.

1. Background and legislative objectives

Before the PDPA, personal data protection in Thailand was fragmented across sector-specific laws such as telecommunications, banking, and consumer protection statutes. This patchwork approach left gaps in enforcement and legal certainty.

The PDPA was enacted to:

• Strengthen individual privacy rights

• Establish accountability for data-handling organizations

• Support digital economy growth

• Enhance international data transfer credibility

• Align Thailand with international privacy standards

The law reflects Thailand’s broader policy goal of building trust in digital transactions and cross-border data flows.

2. Scope and territorial reach

The PDPA applies to:

• Data controllers and data processors established in Thailand

• Foreign entities that process personal data of individuals located in Thailand, where activities relate to offering goods or services or monitoring behavior

Importantly, physical presence in Thailand is not required. Overseas companies targeting Thai residents may still fall within PDPA jurisdiction.

3. Personal data and sensitive personal data

Personal data

Personal data includes any information that identifies or can identify an individual, directly or indirectly. This may include:

• Names and identification numbers

• Contact information

• Online identifiers

• Location data

Sensitive personal data

Sensitive personal data receives heightened protection and includes:

• Racial or ethnic origin

• Religious beliefs

• Health and biometric data

• Criminal records

• Sexual orientation

Processing sensitive data is generally prohibited unless specific legal conditions are met.

4. Roles and responsibilities

Data controller

A data controller determines the purposes and means of processing personal data and bears primary legal responsibility under the PDPA.

Data processor

A data processor processes data on behalf of the controller and must follow documented instructions while maintaining appropriate security measures.

Both roles carry direct statutory obligations and potential liability.

5. Fundamental principles of data processing

The PDPA is built upon core processing principles:

• Lawfulness and fairness: Processing must have a legal basis and respect individual rights

• Purpose limitation: Data must be collected for clear, specific purposes

• Data minimization: Only necessary data may be processed

• Accuracy: Data must be kept accurate and up to date

• Storage limitation: Data must not be retained longer than necessary

• Security and confidentiality: Adequate safeguards must be implemented

These principles guide compliance assessments and enforcement decisions.

6. Lawful bases for processing personal data

Processing is permitted only where at least one lawful basis applies, such as:

• Consent of the data subject

• Contractual necessity

• Legal obligation

• Vital interests of an individual

• Legitimate interests of the controller

• Public interest or official authority

For sensitive personal data, explicit consent or specific statutory exemptions are required.

7. Consent standards and limitations

Consent must be:

• Freely given

• Informed and specific

• Clearly expressed

• Withdrawable at any time

Consent obtained through coercion, bundled agreements, or vague language may be invalid. Organizations must also maintain records proving consent was properly obtained.

8. Rights of data subjects

The PDPA grants individuals enforceable rights, including:

• Right to access and obtain copies of personal data

• Right to data portability

• Right to object to processing

• Right to rectification of inaccurate data

• Right to erasure or destruction

• Right to restrict processing

• Right to withdraw consent

Organizations must implement procedures to respond to rights requests within statutory timeframes.

9. Duties of data controllers

Data controllers must:

• Provide transparent privacy notices

• Maintain records of processing activities

• Implement technical and organizational security measures

• Ensure lawful data transfers

• Establish data breach response mechanisms

• Appoint a Data Protection Officer (DPO) where required

Failure to meet these duties exposes controllers to multiple layers of liability.

10. Obligations of data processors

Data processors are required to:

• Process data only according to documented instructions

• Maintain confidentiality

• Implement security safeguards

• Notify controllers of data breaches

• Refrain from unauthorized subcontracting

Processors may face direct liability for PDPA violations.

11. Data breach notification and response

When a personal data breach occurs:

• The controller must notify the Personal Data Protection Committee (PDPC) without delay

• Affected individuals must be informed if the breach poses a high risk

• Detailed breach records must be maintained

Effective incident response planning is a key compliance requirement.

12. Cross-border data transfers

Personal data may be transferred outside Thailand only if:

• The destination country provides adequate protection

• Appropriate safeguards are in place

• Consent or statutory exceptions apply

These rules significantly affect multinational companies and cloud-based services.

13. Data Protection Officer (DPO)

Organizations engaged in large-scale data processing or sensitive data handling must appoint a DPO. The DPO:

• Advises on compliance

• Monitors internal policies

• Acts as a liaison with regulators

• Supports data subject rights management

14. Regulatory authority and enforcement

The Personal Data Protection Committee (PDPC) oversees enforcement and issues binding notifications and guidelines. The PDPC has authority to:

• Conduct investigations

• Issue compliance orders

• Impose administrative fines

15. Penalties and liabilities

The PDPA imposes:

• Civil liability: Compensation for damages

• Administrative penalties: Fines imposed by regulators

• Criminal liability: For serious misuse of sensitive data

Directors and executives may be personally liable in certain cases.

16. Employment and HR data considerations

Employers must ensure PDPA compliance when handling:

• Employee records

• Biometric attendance systems

• Health and disciplinary data

Clear internal privacy policies and notices are essential.

17. Digital marketing and online platforms

Marketing activities must comply with:

• Consent requirements

• Opt-out mechanisms

• Transparency obligations

Improper data use for marketing may result in enforcement action.

18. Compliance challenges and best practices

Common compliance challenges include:

• Inadequate consent mechanisms

• Poor data mapping

• Weak vendor oversight

• Insufficient staff training

Sustainable compliance requires continuous monitoring, audits, and policy updates.

Conclusion

Thailand’s Personal Data Protection Act establishes a comprehensive and enforceable privacy regime that significantly affects how organizations manage personal data. By combining individual rights, organizational accountability, and meaningful penalties, the PDPA promotes responsible data governance across all sectors.

Organizations that proactively integrate legal, technical, and operational compliance measures not only reduce regulatory risk but also enhance trust and credibility in Thailand’s rapidly evolving digital economy.