Data protection & privacy laws in Thailand (2026)

Thailand's PDPC ordered Tools for Humanity (Worldcoin/World) to suspend iris-scan biometric enrollment and delete approximately 1.2 million Thais' iris records, finding violations of PDPA sensitive-data consent rules and cross-border transfer requirements. It was the first major PDPC enforcement action specifically targeting biometric data.

The PDPC announced eight orders in five cases (public and private sector) totalling THB 14.5 million — including a hospital fined after a contractor used patient records as sweet wrapping, and a collectibles company whose processor faced THB 3 million in fines. Running cumulative fines since 2022 surpassed THB 21.5 million, marking a clear escalation in enforcement intensity.

Two years after full enforcement began, the PDPC imposed its inaugural administrative fine (the statutory maximum of THB 7 million) on IT retailer JIB Computer Group for a data breach enabling call-centre fraud, failure to appoint a DPO, inadequate security measures, and missing the 72-hour breach-notification deadline. The case set the enforcement benchmark for all subsequent PDPA actions.

Two subordinate regulations gazetted in December 2023 (Whitelist Adequacy Notification under s.28 and BCR/Appropriate-Safeguards Notification under s.29) became legally effective, requiring Thai data controllers to verify that destination countries meet adequacy standards or to use SCCs or BCRs before sending personal data abroad. No country has yet been placed on the whitelist.

After two consecutive one-year postponements, all substantive chapters of the Personal Data Protection Act B.E. 2562 (2019) — including data-subject rights, lawful-basis obligations, and the administrative penalty regime — became fully enforceable on 1 June 2022. The Personal Data Protection Committee had been formally constituted in January 2022, providing the independent regulatory authority the Act required.

A second amendment to the postponement Royal Decree, published 8 May 2021, extended the compliance deferral by another year to 1 June 2022, citing the PDPC's incomplete constitution and businesses' need for further preparation time. The two back-to-back deferrals meant the PDPA's substantive provisions remained unenforced for three years after royal assent.

A Royal Decree published 21 May 2020 exempted most organisations from PDPA data-subject-rights and controller obligations until 31 May 2021, citing the PDPC's incomplete formation and the need for stakeholder readiness. It was Thailand's first of two successive one-year deferrals of the landmark law.

An amendment to the 2007 Computer Crime Act, adopted by the junta-appointed National Legislative Assembly and gazetted 24 January 2017 (effective 24 May 2017), broadened cybercrime definitions, introduced court oversight for government access to traffic data, and criminalised dissemination of false information that could damage national security — cementing the CCA as the primary digital-privacy backstop in the years before the PDPA.