Thailand
ComprehensivePersonal Data Protection Act B.E. 2562 (PDPA)
Authority: Personal Data Protection Committee (PDPC) | Enforcement: Active | Enacted: June 2022
Overview
Thailand's PDPA came into full effect in June 2022 after several delays. Modelled on GDPR, it provides comprehensive data protection with consent-based processing, data subject rights, and cross-border transfer restrictions.
14-Topic Coverage
Data Protection Authority
Fully AddressedPDPC and Office of the PDPC oversee enforcement and issue regulations.
Consent Requirements
Fully AddressedConsent must be explicit. Six lawful bases including legitimate interest.
Data Subject Rights
Fully AddressedRights to access, rectification, erasure, restriction, portability, and objection.
Cross-Border Transfer
Fully AddressedAdequate protection required. PDPC regulations specify transfer mechanisms.
Breach Notification
Fully AddressedNotification to PDPC within 72 hours. Notification to data subjects if high risk.
DPO Requirements
Partially AddressedRequired for public authorities and organisations with large-scale processing.
Children's Data
Fully AddressedConsent of parent/guardian required for children under 10.
Penalties & Enforcement
Fully AddressedAdministrative fines up to THB 5 million. Criminal penalties up to 1 year imprisonment.
Sector-Specific Rules
Partially AddressedBank of Thailand and SEC have supplementary data requirements.
Cookie/Tracking
Partially AddressedGeneral consent requirements apply. No specific cookie regulation.
AI & Automated Decisions
Not AddressedNo specific provisions on automated decisions in PDPA.
Data Localisation
Not AddressedNo general data localisation requirement.
Significant Data Fiduciary
Not AddressedNo equivalent concept.
Government Data
Partially AddressedPDPA applies to government processing with certain exemptions.
Coverage Summary
Quick Navigation
Need Compliance Help?
Our data privacy team can help you navigate Thailand's regulations.
Book a Consultation