Personal Data Protection Act

Lists activities outside the Act's scope, including collection purely for personal or household purposes; state agencies acting for national security, public safety, anti-money-laundering, forensic science or cybersecurity; media, artistic and literary work within professional ethics; Parliament and its committees; the courts and the criminal-justice process; and credit-bureau data under the Credit Information Business law.

Applies to controllers and processors located in Thailand regardless of where processing occurs, and to those outside Thailand where they offer goods or services to data subjects in Thailand or monitor their behaviour in Thailand — extraterritorial reach similar to GDPR Article 3.

Defines personal data as information enabling direct or indirect identification of a living natural person (data of the deceased is excluded), and defines data controller, data processor, the Committee and the Office.

Consent must generally be obtained before or at the time of collection, given explicitly in writing or electronically, with the purpose stated, clearly separated from other terms and in plain language. A contract or service may not be conditioned on consent that is unnecessary to it, and the data subject may withdraw consent as easily as it was given.

Permits collection without consent only on specified bases: public-interest research or archiving with safeguards; vital interests; performance of or steps toward a contract with the data subject; a public task or exercise of official authority; legitimate interests not overridden by the data subject's rights; and legal obligations of the controller.

Prohibits collecting data on race, ethnicity, political opinion, religious or philosophical belief, sexual behaviour, criminal records, health, disability, trade-union membership, and genetic or biometric data without explicit consent, subject to narrow exceptions such as vital interests, substantial public interest, and preventive or occupational medicine.

Bars using or disclosing personal data without consent unless an exemption under s.24 or s.26 applies, and binds recipients to the purpose notified to the controller.

Transfers of personal data abroad are permitted only where the destination country or international organisation provides adequate protection under Committee rules, with exceptions such as legal compliance, informed consent, contractual necessity, vital interests and substantial public interest.

Grants the data subject the right to access and obtain a copy of their personal data; related sections grant the rights to data portability (s.31), to object to processing (s.32), to erasure (s.33) and to restriction of processing (s.34).

Requires appropriate security measures, controls on onward disclosure, and a system to erase data no longer needed. A personal-data breach must be notified to the Office without delay and within 72 hours where feasible — unless the breach is unlikely to affect individuals' rights and freedoms — and, where the breach is high-risk, to affected data subjects together with remedial guidance.

Requires the controller to keep records of processing activities — at least the personal data collected and the purpose of each type of processing — available for inspection by data subjects and the Office.

Requires a controller or processor to appoint a Data Protection Officer where it is a prescribed public authority, where its activities require regular large-scale monitoring of personal data, or where its core activity is processing sensitive data under s.26.

A controller or processor that causes damage by breaching the Act must compensate the data subject regardless of intent or negligence, unless it proves force majeure, the data subject's own act, or compliance with a lawful official order. Under s.78 the court may add punitive damages of up to twice the actual compensation, and a claim is time-barred after 3 years from when the data subject knew of both the damage and the person liable, or 10 years from the breach.

Unlawful use or disclosure of sensitive personal data in a manner likely to cause another damage, loss of reputation, contempt, hatred or humiliation is punishable by up to 6 months' imprisonment or a fine up to THB 500,000 or both, rising to up to 1 year or THB 1 million where done to obtain an unlawful benefit; the offence is compoundable.

Administrative fines on controllers are tiered: up to THB 1 million (s.82 — e.g., notice, record-keeping, DPO and access-response failures), up to THB 3 million (s.83 — e.g., unlawful collection or transfer and security or processing-standard failures under s.37), and up to THB 5 million for the most serious breaches involving sensitive data under this section. Processors face parallel fines of up to THB 1–5 million (ss.85–87), and the Expert Committee imposes the fines under s.90.