Data & Privacy - Thailand

The PDPA (B.E. 2562/2019) is a single, economy-wide personal-data law modeled on the EU GDPR. Enacted 28 May 2019, its main operative provisions took full effect on 1 June 2022 after repeated extensions.

The Personal Data Protection Committee and its Office (the PDPC) is the regulator. It was formally established in January 2022, issues subordinate regulations and guidelines, and is chaired/structured with government and honorary expert members. Official portal: pdpc.or.th.

Controllers must establish a lawful basis (often consent) and notify data subjects of purpose, implement appropriate security measures, keep records of processing, appoint a Data Protection Officer where core activities involve large-scale processing (DPO rules effective Dec 2023), and notify the PDPC of breaches within 72 hours.

The PDPA grants rights to be informed, access, rectification, erasure/de-identification, restriction, objection, withdrawal of consent, data portability, and the right to lodge complaints with the PDPC — closely tracking GDPR rights.

Section 29 transfer rules (PDPC Notification of 2023, effective March 2024) require destinations to have adequate protection or be safeguarded by approved mechanisms such as Binding Corporate Rules or Standard Contractual Clauses. As of 2025 no adequacy list has been published, so transfers generally require these safeguards.

The PDPA carries administrative fines up to THB 5 million, civil/punitive damages, and criminal penalties (up to one year imprisonment and/or THB 1 million fine) for certain offences. In August 2025 the PDPC issued eight fines across five cases totaling about THB 21.5 million, marking a shift to active enforcement.