🇹🇭Personal Data Protection Act B.E. 2562 (2019)

← Back to laws in Thailand

A consent-led law with GDPR-style rights and controller accountability

Thailand's Personal Data Protection Act, B.E. 2562 (2019) regulates the collection, use and disclosure of personal data. The law is designed to protect personal data effectively and provide remedies when data subjects' rights are violated. It applies across sectors, while still allowing sector-specific laws to operate alongside it in specified ways.

The PDPA is often compared to the GDPR, but its language and structure are distinctly Thai. It focuses on “collection, use or disclosure” rather than a single umbrella processing term. Consent is a major gateway, but it is not the only basis. The Act also recognises contract, legal obligation, vital interests, public interest, official authority, legitimate interests, research and other statutory grounds.

Scope and territorial reach

Section 5 applies the Act to collection, use or disclosure of personal data by a data controller or processor in Thailand, regardless of whether the activity itself takes place inside or outside Thailand. The Act also reaches controllers or processors outside Thailand where they collect, use or disclose personal data of data subjects in Thailand in connection with offering goods or services to them, whether or not payment is made, or monitoring their behaviour where that behaviour takes place in Thailand.

Section 4 excludes certain activities, including personal or household use, specified public authorities performing security and related functions, mass media, fine arts or literature conducted under professional ethics or public interest, parliamentary functions, courts and legal proceedings, and credit bureau operations. Some exempt controllers must still maintain personal data security standards.

Section 3 preserves sector-specific laws, but the PDPA may apply additionally to collection, use, disclosure, data subject rights, complaints and enforcement where the sectoral law does not provide equivalent protection or processes. This means businesses cannot assume that a sectoral regulator automatically displaces the PDPA.

Key definitions — personal data, controller and processor

Section 6 defines Personal Data as any information relating to a person that enables identification, directly or indirectly, but excludes information of deceased persons. A Data Controller is a person or juristic person with power and duties to make decisions regarding collection, use or disclosure. A Data Processor acts in relation to collection, use or disclosure pursuant to orders given by or on behalf of a Data Controller.

This distinction drives compliance responsibility. Controllers make decisions and carry the main accountability obligations. Processors must follow controller instructions, implement security measures, notify controllers of breaches and maintain processing records where required.

Where a processor acts beyond instructions and determines its own collection, use or disclosure, it may be treated as a controller for that activity.

Consent — clear, separate and freely given

Section 19 provides the general rule: a controller must not collect, use or disclose personal data unless the data subject has given consent before or at the time of collection, use or disclosure, unless the Act or another law permits it.

Consent requests must be explicit, written or electronic unless that is impossible by nature. The controller must also inform the purpose of collection, use or disclosure. The request must be clearly distinguishable from other matters, easily accessible, intelligible, use clear and plain language, and not be deceptive or misleading.

Consent must be freely given. Entering into a contract or receiving a service must not be made conditional on consent to collection, use or disclosure that is not necessary for or related to that contract or service. Consent that does not comply with the Act has no binding effect and does not permit processing.

The data subject may withdraw consent at any time. Withdrawal must be as easy as giving consent, unless restricted by law or by a contract that benefits the data subject. Withdrawal does not affect prior lawful processing, but the controller must inform the data subject if withdrawal will have consequences.

Minors and persons lacking full capacity

Section 20 creates special consent rules for minors, incompetent persons and quasi-incompetent persons. Where a minor is not sui juris by marriage or otherwise capable under the Civil and Commercial Code, consent may require the holder of parental responsibility. For a minor below ten years of age, consent must be obtained from the holder of parental responsibility.

For an incompetent person, consent must be obtained from the custodian with authority to act. For a quasi-incompetent person, consent must be obtained from the curator with authority to act. These rules also apply to withdrawal of consent, notices, exercise of data subject rights, complaints and other acts under the PDPA.

Purpose limitation and collection rules

Section 21 requires controllers to collect, use or disclose personal data according to the purpose notified to the data subject before or at the time of collection. A different purpose generally requires notice of the new purpose and consent before collection, use or disclosure, unless permitted by the PDPA or another law.

Section 22 limits collection to what is necessary for the controller's lawful purpose. Section 23 requires the controller, before or at the time of collection, to inform the data subject of the purpose, legal or contractual necessity, categories of data, retention period or expected retention period, recipients or categories of recipients, controller details and representative or DPO details where applicable, and the rights of the data subject.

Section 24 allows collection without consent in specified cases. These include public-interest archives, research or statistics with safeguards, prevention or suppression of danger to life, body or health, contract performance or pre-contract steps, public interest or official authority, legitimate interests not overridden by fundamental rights, and legal obligation.

Section 25 restricts collection from sources other than the data subject. It is allowed where the controller informs the data subject without delay and within 30 days and obtains consent, or where the collection falls within the consent exceptions in sections 24 or 26. The controller must also provide relevant purpose and notice information unless an exception applies.

Sensitive personal data

Section 26 prohibits collection of sensitive personal data without explicit consent unless a statutory exception applies. Sensitive categories include racial or ethnic origin, political opinions, cult, religious or philosophical beliefs, sexual behaviour, criminal records, health data, disability, trade union information, genetic data, biometric data and any other data that may affect the data subject in the same manner as prescribed by the Committee.

Exceptions include preventing or suppressing danger to life, body or health where the data subject cannot consent; legitimate activities by non-profit bodies with political, religious, philosophical or trade union purposes for members and regular contacts with safeguards; data made public with explicit consent; legal claims; and legal compliance for areas such as occupational medicine, medical diagnosis, health or social care, public health, employment protection, social security, research, statistics and substantial public interest with appropriate safeguards.

Criminal record data must be collected under control of an authorised official authority or subject to data protection measures prescribed by the Committee.

Use, disclosure and cross-border transfer

Section 27 provides that a controller must not use or disclose personal data without consent unless the data was collected without consent under sections 24 or 26. A recipient of disclosed data must not use or disclose that data for any purpose other than the purpose previously notified to the controller in the request to obtain the data. Where use or disclosure is exempt from consent, the controller must record it under section 39.

Section 28 regulates transfers abroad. Where the controller sends or transfers personal data to another country or an international organisation, the destination must have adequate data protection standards and the transfer must follow rules prescribed by the Committee, unless an exception applies. Exceptions include legal compliance, informed consent despite inadequate destination standards, contract performance, contracts in the data subject's interest, protection of life, body or health when consent cannot be obtained, and substantial public interest.

Section 29 allows intra-group transfers under a reviewed and certified personal data protection policy for affiliated undertakings. In the absence of adequacy or a certified policy, transfer may still be possible if suitable protection measures enable enforcement of data subject rights and effective legal remedies according to Committee rules.

Data subject rights

The PDPA creates a broad rights framework. Section 30 gives data subjects the right to request access to and copies of their personal data and to request disclosure of the acquisition of data obtained without consent. Controllers must comply without delay and within 30 days unless a lawful ground for rejection applies.

Section 31 creates a data portability right. Data subjects may request personal data in a readable, commonly used format usable or disclosable by automated means, and may request transfer to another controller where technically possible. The right applies to data collected on consent, contract-related grounds and other data prescribed by the Committee.

Section 32 gives a right to object in certain cases, including processing based on public task or legitimate interests, direct marketing, and scientific, historical or statistical research unless necessary for public interest. For direct marketing, once the data subject objects, the controller must stop processing.

Section 33 gives a right to erasure, destruction or anonymisation where data is no longer necessary, consent is withdrawn and there is no legal ground, objection succeeds, or data was unlawfully collected, used or disclosed. Section 34 gives a right to restriction of use in specified situations. Sections 35 and 36 require controllers to keep personal data accurate, up to date, complete and not misleading and to record refusals to correct.

Controller and processor duties

Section 37 imposes major controller duties. Controllers must implement appropriate security measures against unauthorised or unlawful loss, access, use, alteration, correction or disclosure, and review those measures when necessary or when technology changes. They must prevent third parties receiving personal data from using or disclosing it unlawfully or without authority, and must maintain systems for erasure or destruction when retention ends or data is no longer relevant or necessary.

Section 37 also requires breach notification. Controllers must notify the Office of a personal data breach without delay and, where feasible, within 72 hours after becoming aware of it, unless the breach is unlikely to result in risk to rights and freedoms. If the breach is likely to result in high risk, the controller must also notify data subjects and remedial measures without delay.

Controllers subject to the extraterritorial rule under section 5 paragraph two must designate a written representative in Thailand unless an exemption applies. Section 39 requires controllers to maintain records including collected data, purposes, controller details, retention period, access rights and methods, exempt use or disclosure, refusals of requests or objections, and security measures.

Section 40 requires processors to act only on controller instructions, provide security measures, notify the controller of breaches, and prepare processing records. The controller must have an agreement with the processor controlling processing activities and processor obligations.

Data protection officer

Section 41 requires controllers and processors to designate a data protection officer where they are a public authority as prescribed, where their activities require regular monitoring of personal data or systems due to a large amount of personal data, or where their core activity involves section 26 sensitive data.

The DPO may be shared across affiliated businesses or groups if easily contactable. The controller or processor must provide DPO contact information to data subjects and the Office. The DPO may be internal or external and may perform other duties if those duties do not conflict with DPO responsibilities.

Section 42 sets out DPO duties: advising the controller, processor, employees and service providers; investigating compliance; coordinating and cooperating with the Office; and maintaining confidentiality. Controllers and processors must support the DPO with adequate tools, equipment and access to personal data. They must not dismiss or terminate the DPO because the DPO performs PDPA duties, and the DPO must be able to report directly to the chief executive.

Complaints, civil liability and penalties

Chapter V creates an expert committee mechanism for complaints. Data subjects may file complaints where controllers, processors, employees or service providers violate or fail to comply with the Act or notifications under it. Expert committees may consider complaints, investigate acts causing damage, settle disputes, order action, and require documents or statements.

Section 77 creates civil liability. A controller or processor whose PDPA violation causes damage must compensate the data subject regardless of intent or negligence, unless it proves force majeure, the data subject's own act or omission, or compliance with an order of a government official. Compensation includes necessary expenses incurred to prevent or suppress damage.

Section 78 allows the court to award punitive damages in addition to actual compensation, up to two times the actual compensation amount. Claims are subject to limitation periods of three years from knowledge of damage and the liable controller or processor, or ten years from the wrongful act.

The PDPA also provides administrative fines. For example, failure by certain representatives to comply with record and DPO-related duties may be fined up to Baht one million, while failure to comply with expert committee orders or to cooperate with information requests or competent officials may be fined up to Baht five hundred thousand. The expert committee determines administrative fines and may first issue warnings or rectification orders depending on severity, business size and circumstances.

Transitional provisions

Section 95 allows controllers to continue collecting and using personal data collected before the effective date of the PDPA for the original purposes. However, the controller must prepare and publicise an easy consent-withdrawal method for data subjects who do not want continued collection and use. Disclosure and other acts beyond collection and use must comply with the Act.

This means legacy databases cannot simply be ignored. Organisations must identify old data, confirm original purposes, publish withdrawal mechanisms and bring any disclosure or new use into compliance.