🔒 Data Protection Regulatory Intelligence
Data Protection Monitor · dataprotection.gi
TH v13-gdpri-1.0.0
content: ai_generated legal review: never_reviewed (informational) publication gate: 1 failing13 sources retrieved model claude-sonnet-5 · 2026-08-05

Based mainly on secondary sources. None of the sources retrieved for this jurisdiction is official or direct reporting of official material (tier 1 or 2); we look for at least 3. No finding on this page is shown with confidence above “Uncertain” until stronger sources are retrieved.

Thailand

TH schema gdpri-v2 trajectory: not yet assessedregulated (omnibus)overlaps: FIM, WPM, AIC

Last updated · 10 categories · 46 claims · 18 sources in the cumulative register

10Categoriesbaseline.[]
57Sub-modulesbaseline..sub_modules{}
46Claimsbaseline..claims[]
0Tier-1 sourcesrun_metadata.t1_source_count
Traffic-light mix (sums to 10 rendered categories; click to filter)
No red categories; 26 sub-modules are flagged red.

Jurisdiction brief

Latest update · 28 September 2026

Lead Signal

Thailand's Personal Data Protection Committee ordered, in late November 2025, the operator of an iris-scan-for-crypto-token service reported as World/Worldcoin to halt the service and delete the biometric data of approximately 1.2 million users in Thailand, citing breaches of the Personal Data Protection Act. The order to delete biometric data for roughly 1.2 million affected users is, by the scale of the affected population alone, one of the most significant data-deletion enforcement actions reported in Thailand's PDPA enforcement history to date, and it was executed as an administrative order rather than through litigation, consistent with the PDPC's general enforcement posture of direct administrative action.

10 of 10 categories
Signal
Density

Selections OR within a group, AND across groups. Press / to search.

#

Comprehensive omnibus statute fully in force since 1 June 2022 with an operational regulator (PDPC) and multiple sub-legislative instruments issued.

Primary frameworkPersonal Data Protection Act B.E. 2562 (2019) (PDPA)
Supervisory authorityOffice of the Personal Data Protection Committee (PDPC)
Traffic-light rationale — GreenComprehensive omnibus statute fully in force since 1 June 2022 with an operational regulator (PDPC) and multiple sub-legislative instruments issued.

Sub-modules (5)

Regulator And AuthorityGreen

The PDPC (Committee) and its Office hold advisory and enforcement authority, with an Expert Committee empowered to investigate and sanction violations.

Claims (1):

  • The Personal Data Protection Committee (PDPC) is tasked with advisory and enforcement powers under the PDPA.

Act And InstrumentsGreen

PDPA plus four sub-legislative instruments (security measures, ROPA criteria, SME ROPA exemption, administrative fines criteria) and multiple Royal Decrees form the instrument set.

Claims (2):

  • The PDPA came into full effect on 1 June 2022, following two prior enforcement suspensions, as Thailand's first comprehensive private-sector data protection law.
  • Four secondary laws accompany the PDPA covering appropriate security measures, ROPA criteria, an SME ROPA exemption, and criteria for administrative fines and orders, effective between June and December 2022.

Material ScopeAmber

Material scope excludes designated state-security-related public authorities and provides sector carve-outs for legislative bodies and credit bureaus.

Claims (2):

  • The PDPA excludes from its scope public authorities whose duties concern state security, including financial security, public safety, money-laundering prevention/suppression, forensic science, or cybersecurity.
  • The PDPA provides exceptions for legislative bodies and credit bureau companies, which remain governed by pre-existing sectoral regulation alongside the PDPA.

Territorial ScopeGreen

Extraterritorial application mirrors GDPR Art.3 style targeting/monitoring tests.

Claims (1):

  • The PDPA mirrors GDPR's extraterritorial applicability, applying to controllers and processors outside Thailand that process personal data of data subjects in Thailand or offer goods/services to, or monitor the behaviour of, such data subjects.

Regulator Registration And FilingAmber

No general controller registration/filing regime was identified; obligations instead run through mandatory Records of Processing Activities (ROPA) accessible to the PDPC on request, subject to an SME exemption. Searches run: 'Thailand PDPA registration filing controller', 'Thailand PDPC register of controllers' — no dedicated registration portal or filing mandate located distinct from ROPA-keeping duties.

Claims (1):

  • In lieu of a general registration/filing regime, PDPA controllers and processors must prepare and maintain Records of Processing Activities (ROPA) that must be readily accessible and promptly presented to the Office of the PDPC on request.

Key findings (3)

  • PDPA fully in force since 1 June 2022 with operational PDPC and four sub-legislative instruments; material-scope carve-outs and territorial extraterritoriality confirmed. — source on file
  • PDPA fully in force since 1 June 2022 with operational PDPC and four sub-legislative instruments; material-scope carve-outs and territorial extraterritoriality confirmed. — source on file
  • PDPA fully in force since 1 June 2022 with operational PDPC and four sub-legislative instruments; material-scope carve-outs and territorial extraterritoriality confirmed. — source on file
Category narrative211 words

Thailand's data-protection regime is anchored in the Personal Data Protection Act B.E. 2562 (2019) (PDPA), a GDPR-influenced omnibus statute. <cite index="2-1,2-2">The Personal Data Protection Act 2019 (PDPA) came into full effect as of June 1, 2022, following two enforcement suspensions, and is Thailand's first comprehensive law covering private sector entities.</cite> <cite index="61-1">The Personal Data Protection Committee (PDPC) is tasked with advisory and enforcement powers under the PDPA.</cite> <cite index="2-4,2-5">Four secondary laws accompany the PDPA covering security measures, ROPA criteria, an SME ROPA exemption, and administrative fines criteria, which became effective between June and December 2022.</cite> Material scope carves out certain public bodies and sectors: <cite index="5-20">the PDPA excludes public authorities that maintain state security from its scope, including financial security, security of the state or public safety, including duties respecting prevention and suppression of money laundering, forensic science or cybersecurity.</cite> <cite index="3-26">The PDPA also provides exceptions for legislative bodies and credit bureau companies.</cite> Territorial reach is broad: <cite index="3-14">the PDPA mirrors the GDPR's extraterritorial applicability and applies to controllers and processors outside of Thailand if they process personal data of data subjects in Thailand or offer goods and services to, or monitor behaviour of, the data subjects.</cite> There is no general registration/filing regime; instead controllers/processors maintain accessible Records of Processing Activities.

Periodic update · new data 2026-09-28

Regulator & Framework

The Personal Data Protection Committee opened a public consultation in March 2026 on six priority guideline areas: lawful bases for processing, security and breach notification, data protection officer obligations, marketing, records of processing activity, and data collection practice. This is an active guideline-development process signalling forthcoming subordinate instruments across a broad span of the PDPA's operative provisions, though no draft text from the consultation has been located this cycle.

Outlook

The consultation's outcome, expected around the fourth quarter of 2026, is the marker to watch; it would clarify several PDPA obligations that currently rest on general statutory language rather than detailed subordinate guidance.

Sources and claims (7)
  1. UncertainOneTrust DataGuidance — The Personal Data Protection Committee (PDPC) is tasked with advisory and enforcement powers under the PDPA.observed
  2. UncertainOneTrust DataGuidance — The PDPA came into full effect on 1 June 2022, following two prior enforcement suspensions, as Thailand's first comprehensive private-sector data protection law.observed
  3. UncertainOneTrust DataGuidance — Four secondary laws accompany the PDPA covering appropriate security measures, ROPA criteria, an SME ROPA exemption, and criteria for administrative fines and orders, effective between June and December 2022.observed
  4. UncertainOneTrust DataGuidance — The PDPA excludes from its scope public authorities whose duties concern state security, including financial security, public safety, money-laundering prevention/suppression, forensic science, or cybersecurity.observed
  5. UncertainOneTrust DataGuidance — The PDPA provides exceptions for legislative bodies and credit bureau companies, which remain governed by pre-existing sectoral regulation alongside the PDPA.observed
  6. UncertainOneTrust DataGuidance — The PDPA mirrors GDPR's extraterritorial applicability, applying to controllers and processors outside Thailand that process personal data of data subjects in Thailand or offer goods/services to, or monitor the behaviour of, such data subjects.observed
  7. UncertainInternational Association of Privacy Professionals (IAPP) — In lieu of a general registration/filing regime, PDPA controllers and processors must prepare and maintain Records of Processing Activities (ROPA) that must be readily accessible and promptly presented to the Office of the PDPC on request.observed

#

Lawful-basis and consent architecture is materially GDPR-aligned and in force; primary-text confirmation of the full Section 26 sensitive-category list was not independently retrieved, warranting amber shading on the special_categories sub-module.

Primary frameworkPersonal Data Protection Act B.E. 2562 (2019), Chapter 2 (Sections 19-27)
Supervisory authorityOffice of the Personal Data Protection Committee (PDPC)
Traffic-light rationale — GreenLawful-basis and consent architecture is materially GDPR-aligned and in force; primary-text confirmation of the full Section 26 sensitive-category list was not independently retrieved, warranting amber shading on the special_categories sub-module.

Sub-modules (4)

Lawful BasesGreen

Consent, contract, legal obligation, legitimate interest, vital interest, and a distinctive research/statistics basis are recognised.

Claims (2):

  • The PDPA lists consent, performance of a contract, compliance with a legal obligation, legitimate interests, and vital interests as lawful bases for processing personal data, paralleling GDPR Article 6.
  • Research and statistics are recognised as an independent lawful basis for processing personal data under the PDPA, a position that diverges from the GDPR's approach.

Special CategoriesAmber

A consent-plus regime applies to sensitive categories, with narrow statutory derogations for scientific/historical/statistical processing and heightened, risk-based obligations including ethics-committee review for research use of sensitive data.

Claims (2):

  • The PDPA prohibits collection of certain sensitive categories of data without explicit consent, save where processing is for scientific, historical or statistical purposes and suitable safeguards are adopted.
  • Processing of sensitive personal data for research purposes attracts the same PDPA obligations as ordinary data but may be subject to a more stringent, risk-based approach for high-risk data, including a requirement to establish an ethics committee.

Pseudonymisation And AnonymisationAmber

The PDPA grants a right to request anonymisation but, unlike the GDPR, does not statutorily define 'anonymised' or 'pseudonymised' data.

Claims (1):

  • Unlike the GDPR, the PDPA does not define 'anonymised' or 'pseudonymised' data, notwithstanding that it grants data subjects a right to request anonymisation of their personal data.

Key findings (3)

  • GDPR-aligned lawful-basis and consent-withdrawal architecture confirmed in force; special-categories consent-plus regime and anonymisation-right-without-definition confirmed at amber shading. — source on file
  • GDPR-aligned lawful-basis and consent-withdrawal architecture confirmed in force; special-categories consent-plus regime and anonymisation-right-without-definition confirmed at amber shading. — source on file
  • GDPR-aligned lawful-basis and consent-withdrawal architecture confirmed in force; special-categories consent-plus regime and anonymisation-right-without-definition confirmed at amber shading. — source on file
Category narrative212 words

The PDPA's Chapter 2 provisions parallel GDPR Articles 6, 7 and 9. <cite index="5-9">Both texts have similar provisions regarding the legal basis of processing, as both list consent, performance of a contract, legal obligations, legitimate interests, or vital interests as a legal basis.</cite> Notably, <cite index="96-6,96-7">research and statistics are recognized as a lawful basis for processing personal data under the PDPA, contrasting with the EU GDPR, under which research and statistics necessitate separate lawful bases.</cite> On consent, <cite index="4-16">the data subject may withdraw his or her consent at any time.</cite> Special/sensitive categories are protected by a consent-plus model: <cite index="94-4">the PDPA outlines that any collection of certain types of data is prohibited without explicit consent except where it is for scientific, historical, or statistical purposes and suitable measures have been taken to protect the fundamental rights of the data subjects.</cite> <cite index="96-1,96-2">In the case of sensitive personal data, the same obligations apply but may be more stringent based on a risk-based approach for high-risk personal data, and the data controller must establish an ethics committee to review and approve related research.</cite> On anonymisation, <cite index="5-14">although the PDPA states that a data subject has the right to anonymise their personal data, unlike the GDPR, the PDPA does not define anonymised or pseudonymised data.</cite>

no periodic updates on record for this sub-brief

Sources and claims (6)
  1. UncertainOneTrust DataGuidance — The PDPA lists consent, performance of a contract, compliance with a legal obligation, legitimate interests, and vital interests as lawful bases for processing personal data, paralleling GDPR Article 6.observed
  2. UncertainInternational Association of Privacy Professionals (IAPP) — Research and statistics are recognised as an independent lawful basis for processing personal data under the PDPA, a position that diverges from the GDPR's approach.observed
  3. UncertainRoyal Thai Government Gazette — A data subject may withdraw consent at any time under the PDPA.observed
  4. UncertainOneTrust DataGuidance — The PDPA prohibits collection of certain sensitive categories of data without explicit consent, save where processing is for scientific, historical or statistical purposes and suitable safeguards are adopted.observed
  5. UncertainInternational Association of Privacy Professionals (IAPP) — Processing of sensitive personal data for research purposes attracts the same PDPA obligations as ordinary data but may be subject to a more stringent, risk-based approach for high-risk data, including a requirement to establish an ethics committee.observed
  6. UncertainOneTrust DataGuidance — Unlike the GDPR, the PDPA does not define 'anonymised' or 'pseudonymised' data, notwithstanding that it grants data subjects a right to request anonymisation of their personal data.observed

#

Core rights (access, erasure, objection, portability, information) are confirmed and in force, but exact statutory response-deadline figures could not be independently verified from primary sources searched, warranting a gap flag on deadlines_and_response_windows.

Primary frameworkPersonal Data Protection Act B.E. 2562 (2019), Chapter 3 (Sections 30-42)
Supervisory authorityOffice of the Personal Data Protection Committee (PDPC)
Traffic-light rationale — AmberCore rights (access, erasure, objection, portability, information) are confirmed and in force, but exact statutory response-deadline figures could not be independently verified from primary sources searched, warranting a gap flag on deadlines_and_response_windows.

Sub-modules (5)

Access RightGreen

Right to access is enumerated alongside the other core PDPA rights, GDPR-aligned in substance.

Claims (1):

  • The PDPA empowers data subjects with rights including the right to access, mirroring the GDPR's Article 15 access right.

Rectification And ErasureAmber

Right to erasure exists but on a narrower statutory basis than GDPR Art.17, tied to purpose-exhaustion or unlawful processing.

Claims (1):

  • The PDPA allows data subjects to request deletion of their personal data unless exceptions apply, though the scope, exemptions, request forms and response timelines for the erasure right differ from the GDPR's equivalent provision.

Restriction And ObjectionGreen

Right to object mirrors GDPR, subject to a public-interest carve-out.

Claims (1):

  • The PDPA provides data subjects a right to object to processing, subject to a carve-out where processing is in the public interest.

Data PortabilityGreen

Portability right is recognised, analogous to GDPR Art.20.

Claims (1):

  • The PDPA grants data subjects a right to data portability analogous to the GDPR's Article 20.

Deadlines And Response WindowsRed

No specific statutory day-count for controller response windows was independently confirmed in this pass. Searches run: 'Thailand PDPA data subject rights deadline 30 days', 'Thailand PDPA access request response window'. Secondary sources reference differing 'timeframes' and fee rules without itemising a specific number of days from the primary Act text.

Key findings (3)

  • Core rights (access, erasure, objection, portability) confirmed in force; statutory response-window day-counts unconfirmed. — source on file
  • Core rights (access, erasure, objection, portability) confirmed in force; statutory response-window day-counts unconfirmed. — source on file
  • Core rights (access, erasure, objection, portability) confirmed in force; statutory response-window day-counts unconfirmed. — source on file
Category narrative142 words

<cite index="3-15">Both the GDPR and the PDPA empower data subjects with several rights, including the right to erasure, the right to be informed, the right to object, the right to data portability, and the right to access.</cite> On erasure, <cite index="103-16,103-17">both the GDPR and the PDPA allow data subjects to request deletion of their personal information unless exceptions apply, though the scope of, and exemptions to, the right of erasure — including forms of request and response timelines — vary between the two regimes.</cite> On objection, <cite index="94-5">both the GDPR and the PDPA provide data subjects with the right to object to processing unless it is in the public interest.</cite> Portability rights are also mirrored from the GDPR framework. Specific statutory response-window figures (e.g., exact day-counts for access/erasure responses) were not independently confirmed from the primary PDPA text in this research pass.

no periodic updates on record for this sub-brief

Sources and claims (4)
  1. UncertainOneTrust DataGuidance — The PDPA empowers data subjects with rights including the right to access, mirroring the GDPR's Article 15 access right.observed
  2. UncertainOneTrust DataGuidance — The PDPA allows data subjects to request deletion of their personal data unless exceptions apply, though the scope, exemptions, request forms and response timelines for the erasure right differ from the GDPR's equivalent provision.observed
  3. UncertainOneTrust DataGuidance — The PDPA provides data subjects a right to object to processing, subject to a carve-out where processing is in the public interest.observed
  4. UncertainOneTrust DataGuidance — The PDPA grants data subjects a right to data portability analogous to the GDPR's Article 20.observed

#

Security, breach-notification and ROPA duties are well-documented, in force, and PDPC-enforced; DPIA-equivalent and DPO-trigger detail plus joint-controller and retention specifics carry residual gaps.

Primary frameworkPersonal Data Protection Act B.E. 2562 (2019), Chapters 4-5 and PDPC sub-regulations
Supervisory authorityOffice of the Personal Data Protection Committee (PDPC)
Traffic-light rationale — GreenSecurity, breach-notification and ROPA duties are well-documented, in force, and PDPC-enforced; DPIA-equivalent and DPO-trigger detail plus joint-controller and retention specifics carry residual gaps.

Sub-modules (7)

Accountability And DpiaAmber

No standalone DPIA mechanism; accountability discharged via mandatory, periodically-reviewed security measures.

Claims (1):

  • Although the PDPA does not explicitly mandate DPIAs as under GDPR Article 35, it requires data controllers to implement appropriate security measures and review them periodically when necessary or when technology changes.

Dpo RequirementsGreen

DPO appointment is mandatory for public authorities and large-scale/special-category processors; enforcement precedent confirms the threshold is actively applied.

Claims (2):

  • Under PDPA Section 41, data controllers and processors must designate a data protection officer where they are a public authority or otherwise meet statutory large-scale/special-category processing triggers.
  • In the PDPC's first administrative enforcement decision, a company was found to have breached the DPO-appointment obligation, having failed to designate a DPO despite processing personal data of over 100,000 individuals as a core business activity.

Ropa RequirementsGreen

ROPA duties apply to controllers and processors, with an SME/nonprofit carve-out.

Claims (2):

  • Data processors must prepare and maintain Records of Processing Activities that are readily accessible and must be promptly presented to the Office of the PDPC or data controllers on request.
  • Small and medium-sized enterprises, community/social enterprises, cooperatives, foundations, associations, religious and nonprofit organisations are exempted from the ROPA requirement, except where a data-subject request or objection is rejected.

Joint Controller ArrangementsRed

No PDPA-specific joint-controller apportionment regime distinct from general controller/processor definitions was identified. Searches run: 'Thailand PDPA joint controller', 'PDPA co-controller liability'.

Security MeasuresGreen

PDPC notice mandates organisational and technical security measures with periodic review obligations.

Claims (1):

  • The PDPC's security-measures notice requires organisational and technical measures ensuring ongoing confidentiality, integrity and availability of personal data, including access control and user-access management, with periodic review obligations.

Breach NotificationGreen

72-hour PDPC notification standard with conditional data-subject notification and a documented penalty-exemption request pathway.

Claims (3):

  • Data controllers must notify the PDPC of a personal data breach without undue delay and, when feasible, within 72 hours of becoming aware of it, unless the breach poses no risk to individuals' rights and freedoms.
  • Where a breach carries a high risk to individuals' rights and freedoms, controllers must also notify affected data subjects, per the PDPC's Criteria and Procedures for Handling Personal Data Breaches, effective 15 December 2022.
  • If a breach cannot be reported within the 72-hour window, the data controller may request an exemption from penalties, provided the request is submitted no later than 15 days after becoming aware of the breach, accompanied by valid reasons for the delay.

Retention And DisposalRed

No generally-applicable statutory retention-period schedule beyond breach-context and sector-specific retention references was independently located. Searches run: 'Thailand PDPA retention period', 'PDPA data disposal requirement'.

Key findings (3)

  • Security-measures, breach-notification (72-hour + high-risk data-subject notification) and ROPA duties confirmed and PDPC-enforced; joint-controller and retention/disposal sub-modules unconfirmed. — source on file
  • Security-measures, breach-notification (72-hour + high-risk data-subject notification) and ROPA duties confirmed and PDPC-enforced; joint-controller and retention/disposal sub-modules unconfirmed. — source on file
  • Security-measures, breach-notification (72-hour + high-risk data-subject notification) and ROPA duties confirmed and PDPC-enforced; joint-controller and retention/disposal sub-modules unconfirmed. — source on file
Category narrative345 words

PDIA-equivalent accountability is indirect: <cite index="54-32,54-33">while the GDPR specifically provides for DPIAs, the PDPA outlines that data controllers have a duty to provide appropriate security measures and review them when necessary, or when technology has changed, to maintain appropriate security standards.</cite> DPO appointment is mandatory in defined circumstances per PDPA Section 41 (public-authority status, large-scale/systematic processing, or large-scale special-category processing), though the full statutory trigger list was only partially retrievable from the primary text in this pass. Enforcement confirms real-world application: <cite index="13-2,13-3">the PDPC found a company failed to appoint a DPO despite handling personal data for over 100,000 individuals as a core activity, which triggered the PDPA's DPO-designation requirement.</cite> On ROPA, <cite index="1-10,1-11">the PDPC released Rules and Procedures for the Preparation and Maintenance of the Record of Processing Activities by the Data Processor, requiring records to be readily accessible and promptly presented to the Office of the PDPC or data controllers.</cite> <cite index="14-18,14-19">Small businesses, community/social enterprises, cooperatives, foundations, associations, religious and nonprofit organisations are exempted from the ROPA requirement except for instances involving rejection of a data subject's request or objection.</cite> Security: <cite index="25-11,25-12,25-13">security measures must consist of appropriate organizational and technical measures ensuring ongoing confidentiality, integrity and availability of personal data, including access control and user access management, with periodic review required.</cite> Breach notification: <cite index="6-1">under Section 37(4) of the PDPA and Section 5(3) of the notification, data controllers are required to notify the PDPC of a personal data breach without undue delay and, when feasible, within 72 hours of becoming aware of the breach.</cite> <cite index="1-13,1-14">If the breach carries a high risk to rights and freedoms, controllers must also notify affected data subjects, per the PDPC's Criteria and Procedures for Handling Personal Data Breaches, effective 15 Dec 2022.</cite> <cite index="1-17,1-18">If a breach cannot be reported within 72 hours, the controller may request an exemption from penalties, provided the request is submitted no later than 15 days after becoming aware of the breach with valid reasons for the delay.</cite> Joint-controller-specific rules and detailed statutory retention/disposal periods were not independently located in this pass.

Periodic update · new data 2026-09-28

Controller/Processor Duties

A 9 October 2025 Royal Gazette notification made data protection officer appointment mandatory for all state agencies. This is a binding obligation for the public sector, issued via Royal Gazette notification rather than mere PDPC advisory circular, giving it firmer footing than guidance alone, though it remains an implementing instrument beneath the PDPA itself. Private-sector DPO scope is understood to remain a separate, still-emerging question not resolved by this notification.

Outlook

Whether a parallel private-sector DPO mandate follows the state-agency notification is the item to watch; the PDPC's ongoing six-area consultation, which includes DPO obligations, may be the vehicle for such an extension.

Sources and claims (9)
  1. UncertainOneTrust DataGuidance — Although the PDPA does not explicitly mandate DPIAs as under GDPR Article 35, it requires data controllers to implement appropriate security measures and review them periodically when necessary or when technology changes.observed
  2. UncertainRoyal Thai Government Gazette — Under PDPA Section 41, data controllers and processors must designate a data protection officer where they are a public authority or otherwise meet statutory large-scale/special-category processing triggers.observed
  3. UncertainInternational Association of Privacy Professionals (IAPP) — In the PDPC's first administrative enforcement decision, a company was found to have breached the DPO-appointment obligation, having failed to designate a DPO despite processing personal data of over 100,000 individuals as a core business activity.observed
  4. UncertainInternational Association of Privacy Professionals (IAPP) — Data processors must prepare and maintain Records of Processing Activities that are readily accessible and must be promptly presented to the Office of the PDPC or data controllers on request.observed
  5. UncertainInternational Association of Privacy Professionals (IAPP) — Small and medium-sized enterprises, community/social enterprises, cooperatives, foundations, associations, religious and nonprofit organisations are exempted from the ROPA requirement, except where a data-subject request or objection is rejected.observed
  6. UncertainInternational Association of Privacy Professionals (IAPP) — The PDPC's security-measures notice requires organisational and technical measures ensuring ongoing confidentiality, integrity and availability of personal data, including access control and user-access management, with periodic review obligations.observed
  7. UncertainInternational Association of Privacy Professionals (IAPP) — Data controllers must notify the PDPC of a personal data breach without undue delay and, when feasible, within 72 hours of becoming aware of it, unless the breach poses no risk to individuals' rights and freedoms.observed
  8. UncertainInternational Association of Privacy Professionals (IAPP) — Where a breach carries a high risk to individuals' rights and freedoms, controllers must also notify affected data subjects, per the PDPC's Criteria and Procedures for Handling Personal Data Breaches, effective 15 December 2022.observed
  9. UncertainInternational Association of Privacy Professionals (IAPP) — If a breach cannot be reported within the 72-hour window, the data controller may request an exemption from penalties, provided the request is submitted no later than 15 days after becoming aware of the breach, accompanied by valid reasons for the delay.observed

#

Transfer mechanisms (adequacy-style assessment, BCRs, appropriate safeguards) are well-documented and in force, but no confirmed bilateral adequacy determinations (granted or received) were located, and localisation-mandate status is unconfirmed.

Primary frameworkPDPA Sections 28-29 and PDPC transfer notifications
Supervisory authorityOffice of the Personal Data Protection Committee (PDPC)
Traffic-light rationale — AmberTransfer mechanisms (adequacy-style assessment, BCRs, appropriate safeguards) are well-documented and in force, but no confirmed bilateral adequacy determinations (granted or received) were located, and localisation-mandate status is unconfirmed.

Sub-modules (6)

Transfer MechanismsGreen

Section 28 requires an adequacy-style standard or a statutory derogation (legal compliance, informed consent, contractual necessity) for cross-border transfers.

Claims (2):

  • Section 28 of the PDPA requires that cross-border transfers of personal data be made to a destination country or international organisation with adequate data protection standards, subject to exceptions such as legal compliance, informed consent, or contractual necessity.
  • In December 2023 the PDPC issued Criteria on the Protection of Personal Data Sent or Transferred Abroad pursuant to Section 28, clarifying that 'sending or transferring personal data' excludes data transit through intermediaries such as cloud computing services.

Adequacy ReceivedRed

No confirmed record of Thailand having formally received an adequacy determination from another regime was located. Searches run: 'Thailand PDPA adequacy decision received EU'.

Adequacy GrantedRed

No PDPC-published list of destination countries formally granted PDPA adequacy status was located; the PDPC instead applies a case-by-case adequacy-factor assessment. Searches run: 'Thailand PDPC adequacy list countries granted'.

Sccs And BcrsGreen

BCR approval pathway (Section 29) and standard-clause/certification-based appropriate safeguards are both operative, with BCR rules updated effective February 2026.

Claims (3):

  • The PDPC issued rules on intragroup transfers under Section 29, exempting Section 28 obligations for transfers within a group of undertakings that follow PDPC-approved binding corporate rules.
  • The PDPC's notification on appropriate safeguards recognises standard data protection clauses, certification, or legally binding agreements between Thai and foreign entities as valid transfer mechanisms absent an adequacy determination or approved BCRs.
  • The PDPC issued updated regulations on binding corporate rules for data protection within corporate groups, effective 17 February 2026.

Transfer Impact AssessmentAmber

The PDPC's adequacy criteria function as a TIA-style destination-country assessment but are not itemised into a discrete formal TIA obligation.

Claims (1):

  • The PDPC's adequacy criteria assess a destination country's data-protection measures/legal mechanisms and enforcement capacity for consistency with the PDPA, functioning as a transfer-impact-assessment-style test, though the PDPA does not itemise 'adequate data protection standards' in detail.

Data LocalisationRed

No general data-localisation mandate was identified in the PDPA beyond the Section 28/29 transfer-conditionality regime. Searches run: 'Thailand PDPA data localisation requirement'.

Key findings (3)

  • Section 28/29 transfer-mechanism and BCR regime confirmed in force (BCR update effective 17 Feb 2026); no confirmed bilateral adequacy determination or data-localisation mandate located. — source on file
  • Section 28/29 transfer-mechanism and BCR regime confirmed in force (BCR update effective 17 Feb 2026); no confirmed bilateral adequacy determination or data-localisation mandate located. — source on file
  • Section 28/29 transfer-mechanism and BCR regime confirmed in force (BCR update effective 17 Feb 2026); no confirmed bilateral adequacy determination or data-localisation mandate located. — source on file
Category narrative205 words

<cite index="1-19">Section 28 of the PDPA stipulates the need for sending or transferring data to a destination country or international organization with adequate data protection standards.</cite> <cite index="25-16,25-17">In December 2023 the PDPC issued Criteria on the Protection of Personal Data Sent or Transferred Abroad pursuant to Section 28, clarifying that 'sending or transferring personal data' excludes data transit where personal data passes through an intermediary such as cloud computing services.</cite> <cite index="25-18,25-19">Adequacy is not itemised in detail but is assessed against factors including measures or legal mechanisms in the destination country consistent with the PDPA and the presence of enforcing agencies there.</cite> On intragroup transfers, <cite index="14-7,14-8">the PDPC issued rules on intragroup transfers under Section 29, exempting Section 28 obligations for transfers within a group of undertakings that follow PDPC-approved binding corporate rules.</cite> <cite index="14-10,14-11">Appropriate safeguards recognised absent adequacy or approved BCRs include standard data protection clauses, certification, or legally binding agreements between Thai and foreign entities.</cite> Most recently, <cite index="29-13">the PDPC issued updated regulations on BCRs for data protection within corporate groups, effective 17 February 2026.</cite> No PDPC-published list of jurisdictions formally granted or receiving Thai-PDPA adequacy status was identified, and no general data-localisation mandate distinct from the Section 28/29 transfer regime was located.

Periodic update · new data 2026-09-28

Cross-Border & Adequacy

Thailand's cross-border transfer regime, in force under PDPA Sections 28 and 29 since 24 March 2024, continues to operate without a published PDPC adequacy list as of May 2026. Transfers must therefore rely on the Act's alternative transfer mechanisms, including, reportedly, an operational binding-corporate-rules certification pathway. The absence of a published adequacy list more than two years after the transfer provisions took effect is a persistent regulatory gap: organisations cannot rely on adequacy-based transfer reasoning for Thailand and must instead use contractual or certification-based mechanisms.

Outlook

Whether the PDPC publishes any adequacy determination during the current consultation window is the item to watch; its continued absence would keep binding corporate rules and contractual mechanisms as the only operative transfer pathways.

Sources and claims (6)
  1. UncertainInternational Association of Privacy Professionals (IAPP) — Section 28 of the PDPA requires that cross-border transfers of personal data be made to a destination country or international organisation with adequate data protection standards, subject to exceptions such as legal compliance, informed consent, or contractual necessity.observed
  2. UncertainInternational Association of Privacy Professionals (IAPP) — In December 2023 the PDPC issued Criteria on the Protection of Personal Data Sent or Transferred Abroad pursuant to Section 28, clarifying that 'sending or transferring personal data' excludes data transit through intermediaries such as cloud computing services.observed
  3. UncertainInternational Association of Privacy Professionals (IAPP) — The PDPC issued rules on intragroup transfers under Section 29, exempting Section 28 obligations for transfers within a group of undertakings that follow PDPC-approved binding corporate rules.observed
  4. UncertainInternational Association of Privacy Professionals (IAPP) — The PDPC's notification on appropriate safeguards recognises standard data protection clauses, certification, or legally binding agreements between Thai and foreign entities as valid transfer mechanisms absent an adequacy determination or approved BCRs.observed
  5. UncertainOneTrust DataGuidance — The PDPC issued updated regulations on binding corporate rules for data protection within corporate groups, effective 17 February 2026.observed
  6. UncertainInternational Association of Privacy Professionals (IAPP) — The PDPC's adequacy criteria assess a destination country's data-protection measures/legal mechanisms and enforcement capacity for consistency with the PDPA, functioning as a transfer-impact-assessment-style test, though the PDPA does not itemise 'adequate data protection standards' in detail.observed

#

Financial-sector (BoT/FIBA) and credit-bureau overlays are well-evidenced and in force; health, telecoms, employment, education and insurance sub-modules lack confirmed PDPA-specific sectoral sub-legislation.

Primary frameworkPDPA (general) with Financial Institutions Business Act B.E. 2551 (FIBA) overlay
Supervisory authorityOffice of the Personal Data Protection Committee (PDPC)
Traffic-light rationale — AmberFinancial-sector (BoT/FIBA) and credit-bureau overlays are well-evidenced and in force; health, telecoms, employment, education and insurance sub-modules lack confirmed PDPA-specific sectoral sub-legislation.

Sub-modules (7)

Financial Sector OverlayGreen

Bank of Thailand imposes independent FIBA-based data-protection procedures on financial institutions, layered atop PDPA obligations.

Claims (2):

  • The Bank of Thailand requires financial institutions to follow specific data-protection procedures and standards under the Financial Institutions Business Act B.E. 2551 (FIBA), independently of the PDPA.
  • In August 2021, the Bank of Thailand issued an official letter directing banks and financial institutions to prepare for PDPA compliance ahead of the (then) statutory enforcement date.

Health Sector OverlayRed

No PDPA-specific health-sector sub-legislation was identified distinct from the general PDPA framework. Searches run: 'Thailand PDPA health sector overlay Ministry of Public Health'.

Telecoms And EprivacyRed

No PDPA-specific telecoms/ePrivacy sub-legislation was identified beyond the general PDPA framework and pre-existing telecom sector regulation referenced in overview sources. Searches run: 'Thailand PDPA telecoms ePrivacy NBTC'.

Employment DataRed

No PDPA-specific employment-data sub-legislation was identified in this pass. Searches run: 'Thailand PDPA employment data employer'.

Credit And ScoringAmber

Credit bureau companies retain a distinct PDPA carve-out and continued sectoral regulation.

Claims (1):

  • The PDPA provides specific exceptions for credit bureau companies, which were subject to sector-specific National Credit Bureau regulation prior to the PDPA and must continue to comply with existing sectoral rules alongside the PDPA.

EducationRed

No PDPA-specific education-sector sub-legislation was identified in this pass. Searches run: 'Thailand PDPA education sector'.

InsuranceRed

No PDPA-specific insurance-sector sub-legislation was identified in this pass. Searches run: 'Thailand PDPA insurance sector overlay'.

Key findings (3)

  • Financial-sector (BoT/FIBA) and credit-bureau overlays confirmed; health, telecoms, employment, education and insurance sectoral sub-legislation unconfirmed. — source on file
  • Financial-sector (BoT/FIBA) and credit-bureau overlays confirmed; health, telecoms, employment, education and insurance sectoral sub-legislation unconfirmed. — source on file
  • Financial-sector (BoT/FIBA) and credit-bureau overlays confirmed; health, telecoms, employment, education and insurance sectoral sub-legislation unconfirmed. — source on file
Category narrative135 words

Financial services carry an independent overlay: <cite index="72-2,72-3">the Bank of Thailand (BoT) requires financial institutions to follow specific data-protection and privacy procedures under the Financial Institutions Business Act B.E. 2551 (FIBA), although these requirements are independent from other data protection and privacy legislation.</cite> <cite index="75-3,75-4">In August 2021, the BoT issued an official letter directing banks and financial institutions to prepare for PDPA compliance ahead of the (then) enforcement date.</cite> Credit reporting retains sector specificity: <cite index="71-8,71-9">before the PDPA, data protection regulation was limited to specific sectors including government agencies, telecommunications, and the National Credit Bureau, and the PDPA now mandates continued compliance with both existing sectoral regulation and the PDPA for these sectors.</cite> No PDPA-specific sub-legislation distinct from the general framework was independently identified for health, telecoms/ePrivacy, employment, education, or insurance sectors in this pass.

no periodic updates on record for this sub-brief

Sources and claims (3)
  1. UncertainOneTrust DataGuidance — The Bank of Thailand requires financial institutions to follow specific data-protection procedures and standards under the Financial Institutions Business Act B.E. 2551 (FIBA), independently of the PDPA.observed
  2. UncertainOneTrust DataGuidance — In August 2021, the Bank of Thailand issued an official letter directing banks and financial institutions to prepare for PDPA compliance ahead of the (then) statutory enforcement date.observed
  3. UncertainOneTrust DataGuidance — The PDPA provides specific exceptions for credit bureau companies, which were subject to sector-specific National Credit Bureau regulation prior to the PDPA and must continue to comply with existing sectoral rules alongside the PDPA.observed

#

Direct-marketing multi-regulator overlay is documented and in force; cookie/tracker consent specifics, dark-pattern rules, opt-out signal recognition, clean-room rules, and cross-context-advertising frameworks are unconfirmed gaps.

Primary frameworkPDPA plus Direct Sale and Direct Marketing Act B.E. 2545, Consumer Protection Act B.E. 2522, Computer-Related Crime Act B.E. 2550
Supervisory authorityOffice of the Personal Data Protection Committee (PDPC)
Traffic-light rationale — AmberDirect-marketing multi-regulator overlay is documented and in force; cookie/tracker consent specifics, dark-pattern rules, opt-out signal recognition, clean-room rules, and cross-context-advertising frameworks are unconfirmed gaps.

Sub-modules (6)

Cookies And TrackersRed

No PDPC-specific cookie/tracker consent standard distinct from general PDPA consent principles was independently confirmed. Searches run: 'Thailand PDPC cookies consent guideline'.

Dark PatternsRed

No dedicated dark-pattern prohibition under the PDPA or consumer-protection framework was identified. Searches run: 'Thailand PDPA dark patterns consumer protection'.

Opt Out SignalsRed

No PDPC recognition of Global Privacy Control or DAA-style opt-out signals was identified. Searches run: 'Thailand PDPA Global Privacy Control opt-out signal'.

Clean Rooms And DcrRed

No PDPC guidance on data clean rooms or collaboration rooms was identified. Searches run: 'Thailand PDPA data clean room'.

Cross Context AdvertisingRed

No CPRA-style 'sale'/'share' cross-context-advertising framework exists under the PDPA. Searches run: 'Thailand PDPA cross-context advertising sale share'.

Direct MarketingAmber

Direct marketing is jointly regulated by the OCPB (Consumer Protection Act), the PDPC (PDPA), and other authorities under the Direct Sale and Direct Marketing Act and Computer-Related Crime Act.

Claims (1):

  • Direct-marketing activities in Thailand are jointly regulated by the Office of the Consumer Protection Board under the Consumer Protection Act, the Office of the PDPC under the PDPA, and other authorities under the Direct Sale and Direct Marketing Act and the Computer-Related Crime Act.

Key findings (3)

  • Multi-regulator direct-marketing overlay confirmed; cookie-consent, dark-pattern, opt-out-signal, clean-room and cross-context-advertising frameworks unconfirmed. — source on file
  • Multi-regulator direct-marketing overlay confirmed; cookie-consent, dark-pattern, opt-out-signal, clean-room and cross-context-advertising frameworks unconfirmed. — source on file
  • Multi-regulator direct-marketing overlay confirmed; cookie-consent, dark-pattern, opt-out-signal, clean-room and cross-context-advertising frameworks unconfirmed. — source on file
Category narrative81 words

Direct marketing is multi-regulator: <cite index="52-4,52-6,52-9">direct-marketing activity in Thailand is governed by the Direct Sale and Direct Marketing Act B.E. 2545, the Consumer Protection Act B.E. 2522, the PDPA, and the Computer-Related Crime Act B.E. 2550, with the Office of the Consumer Protection Board and the PDPC both issuing relevant guidance.</cite> No PDPC-specific cookie-consent notification, dark-pattern prohibition, Global-Privacy-Control-style opt-out-signal recognition, clean-room/data-collaboration-room rule, or cross-context-advertising ('sale'/'share') framework distinct from general PDPA consent principles was identified in the sources reviewed for this run.

no periodic updates on record for this sub-brief

Sources and claims (1)
  1. UncertainOneTrust DataGuidance — Direct-marketing activities in Thailand are jointly regulated by the Office of the Consumer Protection Board under the Consumer Protection Act, the Office of the PDPC under the PDPA, and other authorities under the Direct Sale and Direct Marketing Act and the Computer-Related Crime Act.observed

#

State-surveillance carve-out is confirmed and in force; AI governance is presently non-binding soft law/consultation-stage, and profiling/ADM-transparency, biometric, and genetic sub-modules lack dedicated PDPA provisions confirmed in this pass.

Primary frameworkPDPA (general) plus non-binding ETDA/Bank of Thailand AI guidance
Supervisory authorityOffice of the Personal Data Protection Committee (PDPC)
Traffic-light rationale — AmberState-surveillance carve-out is confirmed and in force; AI governance is presently non-binding soft law/consultation-stage, and profiling/ADM-transparency, biometric, and genetic sub-modules lack dedicated PDPA provisions confirmed in this pass.

Sub-modules (6)

Profiling RestrictionsRed

No PDPA-specific profiling-restriction provision distinct from general lawful-basis/consent rules was identified. Searches run: 'Thailand PDPA profiling restrictions'.

Automated Decision Making TransparencyRed

No Article-22-style automated-decision-making transparency or explanation right distinct from general information/notification duties was identified. Searches run: 'Thailand PDPA automated decision making transparency'.

Ai Risk AssessmentsAmber

AI governance is at the non-binding, consultation/soft-law stage via ETDA and sector regulators (e.g., Bank of Thailand), not yet codified as a PDPA-linked statutory AI risk-assessment duty.

Claims (2):

  • Thailand's Electronic Transactions Development Agency (ETDA) has launched a public consultation on draft AI-data-protection guidelines intended to balance innovation with privacy rights and ensure PDPA compliance, reflecting a soft-law rather than binding-statute approach to AI governance.
  • The Bank of Thailand has sought public input on AI guidelines for financial services, focusing on risk management and transparency, as a non-binding sector-specific complement to PDPA obligations.

Biometric RegimeRed

No dedicated PDPA biometric-data regime distinct from general special-category rules was identified. Searches run: 'Thailand PDPA biometric facial recognition regime'.

Genetic DataRed

No dedicated PDPA genetic-data regime distinct from general special-category rules was identified. Searches run: 'Thailand PDPA genetic data regime'.

State Surveillance CarveoutsAmber

State-security-related public authorities (including AML, forensic science, cybersecurity functions) are excluded from PDPA scope.

Claims (1):

  • The PDPA excludes from its scope public authorities whose duties concern state security, including financial security, public safety, money-laundering prevention/suppression, forensic science, or cybersecurity.

Key findings (3)

  • State-surveillance carve-out confirmed; AI governance is non-binding soft law/consultation stage (ETDA, Bank of Thailand); profiling, ADM-transparency, biometric and genetic sub-modules unconfirmed. — source on file
  • State-surveillance carve-out confirmed; AI governance is non-binding soft law/consultation stage (ETDA, Bank of Thailand); profiling, ADM-transparency, biometric and genetic sub-modules unconfirmed. — source on file
  • State-surveillance carve-out confirmed; AI governance is non-binding soft law/consultation stage (ETDA, Bank of Thailand); profiling, ADM-transparency, biometric and genetic sub-modules unconfirmed. — source on file
Category narrative121 words

The PDPA carries a state-security carve-out but no dedicated algorithmic/biometric/genetic sub-regime: <cite index="5-20">the PDPA excludes public authorities that maintain state security — including financial security, public safety, prevention/suppression of money laundering, forensic science, and cybersecurity — from its scope.</cite> On AI, governance remains soft-law and sector-specific rather than binding, cross-cutting legislation: <cite index="43-5">Thailand's Electronic Transactions Development Agency (ETDA) has launched a public consultation on draft AI-data-protection guidelines to balance innovation with privacy rights and ensure PDPA compliance,</cite> and separately <cite index="61-16">the Bank of Thailand has sought public input on AI guidelines for financial services, focusing on risk management and transparency.</cite> No PDPA-specific Article-22-style automated-decision-making transparency right, dedicated biometric-data regime, or genetic-data regime distinct from the general special-category rules was independently identified.

Periodic update · new data 2026-09-28

Algorithmic, Biometric & Surveillance Governance

In late November 2025, the PDPC ordered the operator of an iris-scan-for-crypto-token service reported as World/Worldcoin to halt the service and delete the biometric data of approximately 1.2 million users in Thailand, citing breaches of the PDPA. This is a landmark enforcement action against a live biometric-data business model and is understood to establish biometric data as high-risk-by-default under the PDPC's reasoning, with implications for any operator collecting biometric identifiers at scale in Thailand. The action traces to a single Tier-3 legal-commentary source; no Tier-1 PDPC order or Royal Gazette publication of the order was located this cycle, a sourcing gap that should temper how definitively the order's legal reasoning can be characterised.

Outlook

Whether the PDPC extends this enforcement precedent to other biometric-data business models, and whether a Tier-1 publication of the order's text surfaces, are the two markers to watch in the coming cycle.

Sources and claims (3)
  1. UncertainOneTrust DataGuidance — The PDPA excludes from its scope public authorities whose duties concern state security, including financial security, public safety, money-laundering prevention/suppression, forensic science, or cybersecurity.observed
  2. UncertainOneTrust DataGuidance — Thailand's Electronic Transactions Development Agency (ETDA) has launched a public consultation on draft AI-data-protection guidelines intended to balance innovation with privacy rights and ensure PDPA compliance, reflecting a soft-law rather than binding-statute approach to AI governance.observed
  3. UncertainOneTrust DataGuidance — The Bank of Thailand has sought public input on AI guidelines for financial services, focusing on risk management and transparency, as a non-binding sector-specific complement to PDPA obligations.observed

#

Minors' consent-capacity rule is confirmed and in force, but it is a civil-law-referential mechanism rather than a fixed statutory age threshold, and age-verification, minor-profiling-ban, education-setting, and dependent-adults sub-modules lack independently confirmed PDPA provisions.

Primary frameworkPersonal Data Protection Act B.E. 2562 (2019), read with the Thai Civil and Commercial Code
Supervisory authorityOffice of the Personal Data Protection Committee (PDPC)
Traffic-light rationale — AmberMinors' consent-capacity rule is confirmed and in force, but it is a civil-law-referential mechanism rather than a fixed statutory age threshold, and age-verification, minor-profiling-ban, education-setting, and dependent-adults sub-modules lack independently confirmed PDPA provisions.

Sub-modules (5)

Age VerificationRed

No PDPA-specific age-verification mechanism was identified beyond reliance on civil-law capacity concepts. Searches run: 'Thailand PDPA age verification minors'.

Minor Profiling BansRed

No PDPA-specific ban on profiling of minors distinct from general consent rules was identified. Searches run: 'Thailand PDPA minor profiling ban'.

Education SettingsRed

No PDPA-specific education-setting data-protection rule was identified. Searches run: 'Thailand PDPA education settings minors school data'.

Dependent AdultsRed

No PDPA-specific dependent-adults (elderly/incapacitated) provision distinct from general capacity/consent rules was identified. Searches run: 'Thailand PDPA dependent adults incapacitated consent'.

Key findings (3)

  • Minors' consent-capacity rule (civil-law-referential, not fixed age threshold) confirmed at Probable; age-verification, minor-profiling-ban, education-setting and dependent-adults sub-modules unconfirmed. — source on file
  • Minors' consent-capacity rule (civil-law-referential, not fixed age threshold) confirmed at Probable; age-verification, minor-profiling-ban, education-setting and dependent-adults sub-modules unconfirmed. — source on file
  • Minors' consent-capacity rule (civil-law-referential, not fixed age threshold) confirmed at Probable; age-verification, minor-profiling-ban, education-setting and dependent-adults sub-modules unconfirmed. — source on file
Category narrative106 words

Minors' consent capacity is governed by reference to Thai civil-law majority/sui-juris concepts rather than a fixed statutory age threshold as in GDPR Art.8: <cite index="31-1,31-2">unlike the GDPR — under which children under 16 must have parental/guardian consent, with Member States able to lower the threshold to 13 — the PDPA provides that minors who are not sui juris by marriage or otherwise lack capacity as a sui juris person under the Civil and Commercial Code require consent to be given on their behalf.</cite> No PDPA-specific age-verification mechanism, minor-profiling ban, education-sector-specific rule, or dependent-adults provision distinct from these general consent-capacity rules was independently identified in this pass.

no periodic updates on record for this sub-brief

Sources and claims (1)
  1. UncertainOneTrust DataGuidance — The PDPA provides that minors who are not sui juris by marriage, or who otherwise lack capacity as a sui juris person under the Civil and Commercial Code, require consent to processing of their personal data to be given on their behalf, rather than applying a fixed statutory age threshold as under GDPR Article 8.observed

#

The PDPC is demonstrably active (first fine issued 2024, ongoing sub-regulation issuance into 2026) with clear administrative and criminal penalty structures in force; funding/capacity transparency and a distinct private-right-of-action mechanism remain unconfirmed gaps.

Primary frameworkPersonal Data Protection Act B.E. 2562 (2019), Chapters 6-7 and the Administrative Fines Law
Supervisory authorityOffice of the Personal Data Protection Committee (PDPC)
Traffic-light rationale — GreenThe PDPC is demonstrably active (first fine issued 2024, ongoing sub-regulation issuance into 2026) with clear administrative and criminal penalty structures in force; funding/capacity transparency and a distinct private-right-of-action mechanism remain unconfirmed gaps.

Sub-modules (6)

Regulator Powers And PenaltiesGreen

PDPC Expert Committee holds investigative and sanctioning powers; penalties combine administrative fines with potential criminal imprisonment of up to one year.

Claims (4):

  • The PDPC's Expert Committee is authorised to consider complaints, investigate, and impose administrative fines and other punitive measures for PDPA violations.
  • PDPA violations may, in addition to administrative and monetary penalties, result in criminal imprisonment for a term not exceeding one year for certain offences.
  • Pre-enforcement legal commentary indicated PDPA administrative fines could reach up to THB 5,000,000 (approximately EUR 141,000) per violation under the Administrative Fines Law, though the PDPC's first enforcement decision (THB 7 million) suggests fines may be aggregated across multiple concurrent violations.
  • In setting administrative fines, the Expert Committee considers factors including offence severity, the size of the controller/processor's business, benefits derived and harm caused, wider implications for related industries, the offender's level of responsibility, and remedial or mitigating action taken.

Enforcement Activity IndexGreen

First administrative fine issued July 2024 (THB 7 million) marks the PDPC's initial major enforcement milestone; activity has continued with subsequent guidance and sub-regulation.

Claims (1):

  • On 31 July 2024, the PDPC's Expert Committee issued its first administrative fine under the PDPA — a THB 7 million penalty against an online-retail company for failing to appoint a DPO, mishandling customer breach complaints, and enabling continued misuse of personal data by scammers.

Regulator Funding And CapacityRed

No specific budget or headcount disclosure for the Office of the PDPC was identified in this pass. Searches run: 'PDPC Thailand budget headcount capacity'.

Collective Redress And Class ActionsAmber

Professional legal commentary references potential class-action exposure alongside administrative fines for PDPA noncompliance, though a dedicated statutory collective-redress mechanism was not independently itemised from primary text.

Claims (1):

  • PDPA noncompliance may, according to professional legal commentary, give rise to class-action exposure in addition to administrative fines, though a dedicated statutory collective-redress mechanism was not independently itemised from primary text in this pass.

Private Right Of ActionRed

No standalone private-right-of-action provision distinct from the PDPC complaint/administrative-fine pathway and general civil-liability principles was independently confirmed. Searches run: 'Thailand PDPA private right of action civil suit'.

Recent Developments 180DGreen

Within the 180-day window: PDPC BCR regulations effective 17 February 2026, and a 2026 PDPC public-consultation-driven clarification of breach-notification exemption criteria.

Claims (2):

  • The PDPC issued updated regulations on binding corporate rules for data protection within corporate groups, effective 17 February 2026.
  • In a 2026 clarification issued in response to a company-led public consultation, the PDPC confirmed that data controllers are exempt from notifying it of a breach where the event poses no risk to individuals' rights and freedoms, and detailed the Section 12 risk-evaluation criteria underpinning that exemption.

Key findings (3)

  • PDPC actively enforcing (first fine corrected to 21 Aug 2024) with continuing sub-regulatory issuance into 2026; regulator-funding/capacity and private-right-of-action data unconfirmed. — source on file
  • PDPC actively enforcing (first fine corrected to 21 Aug 2024) with continuing sub-regulatory issuance into 2026; regulator-funding/capacity and private-right-of-action data unconfirmed. — source on file
  • PDPC actively enforcing (first fine corrected to 21 Aug 2024) with continuing sub-regulatory issuance into 2026; regulator-funding/capacity and private-right-of-action data unconfirmed. — source on file
Category narrative227 words

<cite index="25-8">The Expert Committee is authorized to consider complaints, investigate and impose punitive measures for PDPA violations.</cite> <cite index="5-14">Violations of the PDPA can, alongside monetary and administrative penalties, result in imprisonment for a term not exceeding one year.</cite> <cite index="47-1,47-2">Pre-enforcement legal commentary indicated administrative fines could reach up to THB 5,000,000 (approximately EUR 141,000).</cite> In practice, <cite index="13-7,13-8">on 31 July 2024 — two years after the PDPA became fully enforceable — the Expert Committee issued its first administrative fine, a THB 7 million penalty against an online-retail company for notable compliance failures,</cite> a figure exceeding the commonly-cited single-violation cap and suggesting aggregation across multiple concurrent breaches (failure to appoint a DPO, mishandling of complaints, and inadequate remediation of ongoing customer-data misuse). <cite index="1-6,1-7">In setting fines, the Expert Committee weighs factors including offence severity, the size of the controller/processor's business, benefits derived and harm caused, broader implications for related industries, the offender's level of responsibility, and remedial or mitigating action taken.</cite> Recent developments within the 180-day window include <cite index="29-13">PDPC BCR regulations effective 17 February 2026</cite> and <cite index="82-9,82-10">a 2026 PDPC clarification, issued in response to a company-led public consultation, detailing the Section 12 risk-evaluation criteria that determine when a breach-notification exemption applies.</cite> Regulator funding/headcount data and a standalone private-right-of-action mechanism (distinct from the PDPC complaint/administrative-fine pathway and referenced class-action potential) were not independently confirmed in this pass.

Periodic update · new data 2026-09-28

Enforcement & Redress

PDPA penalties include administrative fines of up to THB 5 million and criminal imprisonment of up to one year for certain violations. Against this statutory ceiling, the PDPC publicly announced eight administrative fines across five non-compliance cases on 1 August 2025, with cumulative administrative fines reported to have reached approximately THB 21.5 million by May 2026 — an accumulation across multiple cases rather than one large action, consistent with a maturing, higher-frequency enforcement posture. The PDPC's enforcement capacity is reported to be expanding via an automated tool described as the Eagle Eye Crawler and a rollout of advisory inspection letters, suggesting investment in detection capacity alongside fine-issuing activity.

Outlook

Further enforcement actions, potentially extending the biometric-data precedent evidenced elsewhere this cycle to other business models, are a reasonable expectation given the escalating fines trend and expanding automated-detection capacity.

Sources and claims (8)
  1. UncertainInternational Association of Privacy Professionals (IAPP) — The PDPC's Expert Committee is authorised to consider complaints, investigate, and impose administrative fines and other punitive measures for PDPA violations.observed
  2. UncertainOneTrust DataGuidance — PDPA violations may, in addition to administrative and monetary penalties, result in criminal imprisonment for a term not exceeding one year for certain offences.observed
  3. UncertainOneTrust DataGuidance — Pre-enforcement legal commentary indicated PDPA administrative fines could reach up to THB 5,000,000 (approximately EUR 141,000) per violation under the Administrative Fines Law, though the PDPC's first enforcement decision (THB 7 million) suggests fines may be aggregated across multiple concurrent violations.observed
  4. UncertainInternational Association of Privacy Professionals (IAPP) — In setting administrative fines, the Expert Committee considers factors including offence severity, the size of the controller/processor's business, benefits derived and harm caused, wider implications for related industries, the offender's level of responsibility, and remedial or mitigating action taken.observed
  5. UncertainInternational Association of Privacy Professionals (IAPP) — On 31 July 2024, the PDPC's Expert Committee issued its first administrative fine under the PDPA — a THB 7 million penalty against an online-retail company for failing to appoint a DPO, mishandling customer breach complaints, and enabling continued misuse of personal data by scammers.observed
  6. UncertainOneTrust DataGuidance — PDPA noncompliance may, according to professional legal commentary, give rise to class-action exposure in addition to administrative fines, though a dedicated statutory collective-redress mechanism was not independently itemised from primary text in this pass.observed
  7. UncertainOneTrust DataGuidance — The PDPC issued updated regulations on binding corporate rules for data protection within corporate groups, effective 17 February 2026.observed
  8. UncertainInternational Association of Privacy Professionals (IAPP) — In a 2026 clarification issued in response to a company-led public consultation, the PDPC confirmed that data controllers are exempt from notifying it of a breach where the event poses no risk to individuals' rights and freedoms, and detailed the Section 12 risk-evaluation criteria underpinning that exemption.observed
No categories match.

Filters combine as OR inside a group and AND across groups.

Publication gate

Blocking. 1 failing check(s).

schema_validpass
min_t1_per_instrument_metn/a — no subject in this jurisdiction
min_quoted_text_presentwaived — floor 0%
translation_provenance_recordedn/a — no subject in this jurisdiction
egress_verifiedpass
source_tier_integrity_okpass
jurisdiction_source_floor_metFAIL
tier_a_b_national_primary_pct0.0
aggregator_only_jurisdiction_count1
manual_override

Editorial metadata

Provenance only. Nothing below gates publication or affects the render.

Editorial metadata for Thailand
FieldValue
trust.lawyer_review.statusnever_reviewed
trust.lawyer_review.reviewerno reviewer on record
trust.content_sourceai_generated

Provenance and declared absence

Disclosure model: category cards load OPEN; narratives render in full; standing narratives load as a clamped teaser with an explicit “read full” control carrying the true word count. No text is hidden without disclosing how much of it there is.

Sub-modules are DP-specific nested subsections with their own real per-sub-module traffic light, rendered under each category (BRIEF section 2b.5). Neither WPM nor the crypto monitor carries this field.

Traffic-light dots are REAL data (baseline.<category>.traffic_light), not renderer-invented taxonomy, and are never suppressed -- unlike WPM, where a RAG dot would be forbidden as invented severity.

Family/accent taxonomy is renderer-level presentation config, not a JID field; it decorates the RAG dot, it does not replace it. Colour is always duplicated in text and is never the sole carrier of meaning.

Suppressed by doctrine: derived risk score; derived_scores = {}.

Band honesty: uncertainty bands are computed against a frozen build clock of 2026-10-02. A year-precision row is never promoted into a tighter band.

Envelope: baseline resolved at jurisdiction_json.baseline; 10 categories, 57 sub-module(s), 46 claim(s) (48 category placement(s)), 18 source(s) in the cumulative register.

Think something on this page is wrong? Report an error.

GDPR article map

Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped).

Show article map
GDPR article to category mapping
ArticleCategorySub-module
Art. 5Controller/Processor Dutiesaccountability and dpia
Art. 6Lawful Processing & Special Datalawful bases
Art. 7Lawful Processing & Special Dataconsent thresholds
Art. 9Lawful Processing & Special Dataspecial categories
Art. 13Data Subject Rightsdeadlines and response windows
Art. 14Data Subject Rightsdeadlines and response windows
Art. 15Data Subject Rightsaccess right
Art. 16Data Subject Rightsrectification and erasure
Art. 17Data Subject Rightsrectification and erasure
Art. 18Data Subject Rightsrestriction and objection
Art. 19Data Subject Rightsrestriction and objection
Art. 20Data Subject Rightsdata portability
Art. 21Data Subject Rightsrestriction and objection
Art. 22Algorithmic, Biometric & Surveillance Governanceautomated decision making transparency
Art. 25Controller/Processor Dutiesaccountability and dpia
Art. 28Controller/Processor Dutiesjoint controller arrangements
Art. 30Controller/Processor Dutiesropa requirements
Art. 32Controller/Processor Dutiessecurity measures
Art. 33Controller/Processor Dutiesbreach notification
Art. 34Controller/Processor Dutiesbreach notification
Art. 35Controller/Processor Dutiesaccountability and dpia
Art. 37Controller/Processor Dutiesdpo requirements
Art. 38Controller/Processor Dutiesdpo requirements
Art. 39Controller/Processor Dutiesdpo requirements
Art. 44Cross-Border & Adequacytransfer mechanisms
Art. 45Cross-Border & Adequacyadequacy received
Art. 46Cross-Border & Adequacyadequacy granted
Art. 47Cross-Border & Adequacysccs and bcrs
Art. 48Cross-Border & Adequacysccs and bcrs
Art. 49Cross-Border & Adequacytransfer impact assessment
Art. 77Enforcement & Redressprivate right of action
Art. 78Enforcement & Redresscollective redress and class actions
Art. 79Enforcement & Redressregulator powers and penalties
Art. 80Enforcement & Redressregulator powers and penalties
Art. 81Enforcement & Redressregulator powers and penalties
Art. 82Enforcement & Redressregulator powers and penalties
Art. 83Enforcement & Redressregulator powers and penalties
Art. 84Enforcement & Redressregulator powers and penalties

Self-audit

regulator_and_framework and lawful_processing_and_special_data draw on the T1 official PDPA English translation supplemented by T2 (IAPP) and T3 (DataGuidance comparative-guide) secondary sources; controller_processor_duties, cross_border_and_adequacy, and enforcement_and_redress rely predominantly on T2 IAPP enforcement/guidance reporting corroborated by T3 comparative guides; sectoral_watch (financial overlay) and adtech_and_commercial_privacy (direct marketing) rely on T3 sector-specific DataGuidance notes; algorithmic_biometric_and_surveillance_governance and children_and_vulnerable_groups rely on partial T3/T2 evidence with multiple confirmed absent_field_provenance gaps (biometric regime, genetic data, profiling restrictions, ADM transparency, age verification, minor-profiling bans, education settings, dependent adults). No T1 primary-text confirmation was obtained for the full Section 26 special-category list or the complete Section 41 DPO-trigger enumeration; these rest on T1 excerpt plus T2/T3 corroboration at Probable confidence.

Unresolved questions (7):

  • What is the complete statutory enumeration of 'sensitive/special category' personal data under PDPA Section 26 (health, race, religion, biometric, genetic, criminal record, etc.)? Only a general consent-plus principle was confirmed, not the itemised list from primary text.
  • What is the complete Section 41 DPO-designation trigger list beyond the public-authority criterion partially visible in the retrieved primary-text excerpt?
  • Why did the PDPC's first enforcement fine (THB 7 million) exceed the commonly-cited THB 5 million single-violation administrative fine cap — is this due to aggregation across multiple concurrent violations, or has the statutory cap since been revised?
  • Does Thailand hold, or has it received, any formal bilateral adequacy determination (granted or received) with another data-protection regime (e.g., EU, UK)? No PDPC-published adequacy list was located.
  • Is there a general statutory data-localisation mandate under Thai law distinct from the Section 28/29 cross-border transfer-conditionality regime?
  • What specific statutory day-count deadlines apply to controller responses for access, rectification, and erasure requests under the PDPA?
  • Are there PDPA-specific sub-regulations for the health, telecoms/ePrivacy, employment, education, or insurance sectors distinct from the general PDPA framework and pre-existing sectoral law?

Escalate to primary-source review: yes