Thailand PDPA compliance: privacy notices, contracts and DPO
The Personal Data Protection Act B.E. 2562 (2019) applies to any business collecting or using personal data in Thailand, and to overseas businesses offering goods or services to people in Thailand (section 5). We map your data, draft documents and set internal procedures. Final interpretation rests with the PDPC and the courts.
Ask about PDPA on LINE @THAILCompliance steps
- Map what data you hold, from whom, where it is stored, who receives it and for how long, and keep a record of processing (section 39)
- Assign a lawful basis to each activity and separate sensitive data that needs explicit consent
- Prepare privacy notices for customers, staff and applicants, plus consent forms and a website cookie policy
- Sign data processing agreements with vendors such as payroll, cloud and marketing providers
- Set procedures for data subject requests (sections 30–36) and a breach plan able to notify the PDPC within 72 hours
- Assess whether a DPO is mandatory and train staff who handle personal data
Frequently asked questions
Do small businesses have to comply?
Yes, whenever they collect, use or disclose personal data of customers, staff or partners. The Act has applied in full since 1 June 2022. Some PDPC notifications relax certain duties, such as record keeping, for small enterprises; check which apply to you.
Is consent always required?
No. Section 24 allows other bases, such as performance of a contract, legal obligation or legitimate interest. Sensitive data under section 26, such as health, religion or biometrics, needs explicit consent unless a statutory exception applies.
How fast must a data breach be reported?
Section 37(4) requires notifying the PDPC without delay and within 72 hours of becoming aware, unless the breach is unlikely to affect individuals' rights. High-risk breaches must also be notified to data subjects with remedial steps.
Do we need a DPO?
Section 41 requires one, for example where core activities involve regular, large-scale monitoring of personal data or processing sensitive data, or for public bodies designated by notification. Others may appoint one voluntarily.
Can data be sent to a parent company or overseas cloud?
Yes, under sections 28–29: for example where the destination has adequate standards as notified, binding intra-group policies have been reviewed, or appropriate safeguards such as standard contractual clauses under PDPC notifications are in place.
What are the penalties?
Civil liability (courts may add punitive damages up to twice actual damages), criminal penalties in some cases, and administrative fines of up to 5 million baht under section 90, depending on the breach.
Related services
Sources
- Personal Data Protection Act B.E. 2562, Royal Gazette vol. 136 part 69 Kor (Thai)
- Personal Data Protection Committee Office (PDPC): notifications and guidance
Sources checked 30 Oct 2026. Our service fees are quoted per scope of work.