Educational Information Only
The content on this page is for general educational purposes and does not constitute legal advice. Every legal situation is unique. For matters involving investigation, arrest, litigation, or formal proceedings, consult a qualified legal professional.
Data Protection (PDPA)
Personal Data Protection Act compliance & enforcement.
Overview
Thailand's Personal Data Protection Act B.E. 2562 (2019) (PDPA) came into full effect on June 1, 2022. Modeled after the EU's GDPR, the PDPA regulates the collection, use, disclosure, and transfer of personal data. It applies to any organization processing personal data of individuals in Thailand, regardless of where the organization is located. The PDPA established the Personal Data Protection Committee (PDPC) as the enforcement authority. Violations can result in administrative fines up to THB 5 million, criminal penalties including imprisonment, and civil damages.
Key Legislation
Topics Covered
Overview
Introduction to Thailand's PDPA
Consent & Legal Basis
Lawful bases for processing personal data
Data Subject Rights
Individual rights under the PDPA
Data Protection Officer
DPO requirements and responsibilities
Cross-Border Transfers
Rules for transferring data outside Thailand
Enforcement & Penalties
PDPC enforcement powers and penalty structure
For Foreigners
PDPA compliance for foreign businesses
Offences
Detailed information on specific offences, their elements, penalties, and defences.
Unauthorized Use of Personal Data
Using personal data without lawful basis or beyond the consented purpose.
Failure to Notify Data Breach
Failing to notify the PDPC and affected individuals of a personal data breach within 72 hours.
For Foreigners
Special Considerations for Foreign Nationals
Foreign nationals face unique considerations in Thai data protection (pdpa) matters, including language barriers, immigration implications, and procedural differences. Understanding these distinctions is essential for protecting your rights.
Read foreigners guideFrequently Asked Questions
Does the PDPA apply to foreign companies?
Yes, the PDPA applies to any organization processing personal data of individuals in Thailand, regardless of where the organization is based.
What are the penalties for PDPA violations?
Penalties include administrative fines up to THB 5 million, criminal penalties including up to 1 year imprisonment, and unlimited civil damages.
When is consent required under the PDPA?
Consent is required unless another lawful basis applies (legitimate interest, contractual necessity, legal obligation, vital interest, or public interest).
Do I need to appoint a Data Protection Officer (DPO) under the PDPA?
A DPO must be appointed if your core activities involve regular monitoring of data subjects or large-scale processing of sensitive data.
Is CCTV footage considered personal data under the PDPA?
Yes, CCTV footage that can identify individuals is personal data under the PDPA and may include biometric data (facial recognition), which is sensitive data.
When Legal Representation Matters
If you are facing a data protection / pdpa matter that involves investigation, arrest, litigation, or formal proceedings, professional legal representation becomes essential.
Anglo Siam Legal provides experienced legal services across Thailand for both Thai nationals and foreigners.
feedback.wasThisHelpful