Educational Information Only — Not Legal Advice

    This site provides educational information only and is not a substitute for professional legal advice. Consult a qualified Thai lawyer for personalized guidance. Laws may change. Full DisclaimerPrivacy Policy

    Skip to main content
    Last updated:
    Share:

    Educational Information Only

    The content on this page is for general educational purposes and does not constitute legal advice. Every legal situation is unique. For matters involving investigation, arrest, litigation, or formal proceedings, consult a qualified legal professional.

    Back to Penalties & Fines
    Regulatory Law

    PDPA Data Protection Violation Penalties in Thailand

    Penalties under Thailand's Personal Data Protection Act (PDPA) for data breaches, non-compliance, and unauthorized data use.

    Updated:

    Overview

    Thailand's PDPA (Personal Data Protection Act B.E. 2562 (2019)) imposes significant penalties on organizations that mishandle personal data. Both administrative fines and criminal penalties apply.

    Penalties Table

    OffenceStatuteFine RangePrison RangeForeigner Note
    Collecting data without consentPDPA, Section 90Up to THB 5,000,000 (administrative)Up to 1 year (criminal)Applies to any business collecting Thai resident data
    Using data beyond stated purposePDPA, Section 91Up to THB 5,000,000Up to 6 months
    Failure to report data breachPDPA, Section 37Up to THB 3,000,000NoneBreaches must be reported to PDPC within 72 hours
    Transferring data internationally without safeguardsPDPA, Section 28Up to THB 5,000,000Up to 1 year
    Unauthorized disclosure of personal dataPDPA, Section 90Up to THB 5,000,000Up to 6 months
    Failure to appoint Data Protection Officer (when required)PDPA, Section 42Up to THB 1,000,000None

    Important Notes

    The PDPA applies to ANY organization processing Thai resident data, including foreign companies

    Class action lawsuits are permitted under PDPA — victims can sue collectively

    The Personal Data Protection Committee (PDPC) oversees enforcement

    PDPA is modeled on GDPR but has some significant differences

    Data subjects can claim compensation for actual damages caused by violations

    Disclaimer: This information is for educational purposes only and does not constitute legal advice. Penalties shown are statutory provisions and actual sentences may vary based on case circumstances and judicial discretion. Always consult a qualified Thai lawyer for specific legal advice.

    Need professional legal assistance?

    When a matter involves investigation, arrest, detention, litigation, or regulatory action, professional legal representation becomes essential.

    Speak to Anglo Siam Legal

    feedback.wasThisHelpful