Data Protection in Thailand: What Foreign Businesses Must Know About PDPA

Thailand's Personal Data Protection Act B.E. 2562 (2019) (PDPA) establishes the legal framework governing the collection, use, disclosure, and protection of personal data. For foreign businesses operating in Thailand, the law affects more than customer databases. It can apply to employee records, recruitment, marketing, website analytics, customer support, outsourced services, and the transfer of information between international group companies.

Understanding the PDPA is important when establishing a Thai subsidiary, acquiring a local business, appointing service providers, or managing operations from an overseas headquarters. A company's existing privacy policies or compliance with another country's data protection laws do not automatically satisfy Thai legal requirements.

This article explains the principal obligations foreign businesses should consider when handling personal data in Thailand.

1. When Does the PDPA Apply to Foreign Businesses?

The PDPA applies to organisations that collect, use, or disclose personal data in Thailand, subject to the Act's scope and applicable exemptions. Importantly, its application is not limited to Thai-incorporated companies.

Section 5 also extends the law to certain data controllers and data processors located outside Thailand. This may include foreign organisations that collect, use, or disclose personal data of individuals in Thailand in connection with offering goods or services to those individuals, whether or not payment is required, or monitoring their behaviour where that behaviour takes place in Thailand.

For example, a foreign e-commerce business that actively offers products to customers in Thailand may need to assess its obligations under the PDPA even if it has no Thai subsidiary. Similarly, an overseas digital service that tracks the behaviour of individuals in Thailand for profiling or targeted advertising may fall within the Act's territorial scope.

Foreign businesses should therefore assess their actual activities, target markets, data flows, and operational arrangements rather than relying solely on their place of incorporation.

2. What Qualifies as Personal Data?

Personal data generally means information relating to a natural person that enables the person to be identified, directly or indirectly, excluding information about deceased persons specifically.

Common examples include:

• Names, identification numbers, passport details, and contact information.
• Customer accounts, transaction histories, and delivery addresses.
• Employee files, payroll information, and recruitment records.
• IP addresses, online identifiers, and certain website activity records when linked to an identifiable individual.
• Photographs, CCTV footage, and recorded communications where an individual can be identified.

The PDPA also provides additional protection for sensitive personal data under Section 26. This category includes information concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, sexual behaviour, criminal records, health data, disability, trade union information, genetic data, biometric data, and other categories specified by law.

Processing sensitive personal data generally requires explicit consent unless a specific statutory exception applies. Businesses should not assume that a general privacy notice or an employee's signature on an ordinary employment document is sufficient to authorise every type of processing.

In practice, organisations should classify the personal data they handle and identify whether any information falls within the sensitive-data category before determining the applicable legal requirements.

3. Consent Is Not the Only Legal Basis for Processing

One common misconception is that a business must obtain consent before carrying out every activity involving personal data. The PDPA recognises several legal bases for processing, and the appropriate basis depends on the purpose and circumstances.

Relevant legal bases include:

Consent. Consent may be used where the law permits processing on this basis. It must satisfy applicable requirements, including being freely given, sufficiently informed, and specific to the relevant purpose. Where consent is relied upon, individuals must generally be able to withdraw it in accordance with the law.

Contractual necessity. Processing may be permitted where necessary to take steps at the request of the data subject before entering into a contract or to perform a contract to which the data subject is a party.

Legal obligation. A company may process personal data when necessary to comply with a legal obligation imposed on the data controller.

Legitimate interests. Processing may be permitted where necessary for the legitimate interests of the controller or another person, provided that the statutory conditions are satisfied and the relevant interests do not override the fundamental rights of the data subject.

Other statutory grounds. Depending on the circumstances, the PDPA also recognises grounds relating to public tasks, vital interests, and certain research, historical, or statistical purposes.

These legal bases are not interchangeable. A company should identify the purpose of each processing activity, determine the applicable legal basis, and document the reasoning. Consent should not be used as a universal substitute for this assessment.

For example, a company may be able to process employee payroll information because it is necessary to comply with legal obligations, while using employee photographs for unrelated promotional campaigns may require a separate assessment and potentially consent.

4. Privacy Notices and Transparency Obligations

A company that collects personal data must provide the information required by the PDPA. Section 23 generally requires a data controller to inform data subjects of relevant matters, including the purposes of collection, the legal basis where applicable, the consequences of not providing data, the categories of data collected, the retention period, the categories of recipients, and information about the controller and data subject rights.

The exact notice requirements depend on the circumstances, including whether information is collected directly from the individual or obtained from another source.

Foreign businesses commonly need separate or tailored privacy notices for different activities, such as:

• Customer registration and sales.
• Website use and online marketing.
• Recruitment and employment.
• CCTV monitoring.
• Vendor and business-contact management.
• Events, newsletters, and customer support.

A single generic privacy policy may not adequately explain all processing activities. Notices should accurately reflect actual business practices and should not promise protections or retention periods that the organisation cannot implement.

Where a company collects personal data indirectly from third parties, it must separately assess the applicable notification requirements and any statutory exceptions. The fact that information was supplied by a business partner does not automatically remove the company's obligations.

5. Data Controller and Data Processor Responsibilities

The PDPA distinguishes between a data controller and a data processor.

A data controller determines the purposes and means of processing personal data. A Thai company that decides what customer information to collect, why it is needed, and how it will be used will commonly act as a controller.

A data processor processes personal data on behalf of and under the instructions of a controller. Examples may include payroll providers, cloud-hosting providers, outsourced customer-service companies, and certain IT service providers.

The legal responsibilities differ according to each role. Controllers must establish a lawful basis, provide required information, manage data subject rights, and implement appropriate safeguards. Processors must comply with applicable statutory duties and process data in accordance with the controller's instructions and the relevant contractual arrangements.

Where a foreign headquarters, Thai subsidiary, and external service provider all handle personal data, the parties should determine their respective roles rather than assume that one entity bears every obligation.

Written data processing agreements should address matters such as processing instructions, confidentiality, security measures, assistance with data subject requests, breach notification, subcontracting, retention, and deletion or return of personal data.

Contractual allocation of responsibilities is important, but it does not automatically eliminate statutory liability.

6. Security Measures and Data Breach Notification

The PDPA requires data controllers and data processors to implement appropriate security measures in accordance with the law and applicable regulatory requirements.

Depending on the organisation's operations and risks, relevant measures may include access controls, encryption, authentication procedures, employee training, system monitoring, backup arrangements, secure disposal, vendor oversight, and documented incident-response procedures.

Security measures should reflect the sensitivity and volume of the information involved, the nature of the processing, and the potential consequences for individuals if information is compromised.

A personal data breach may involve unauthorised access, disclosure, alteration, loss, or destruction of personal data. Examples include sending a spreadsheet to the wrong recipient, losing a device containing unprotected customer information, or experiencing a cyberattack that exposes employee records.

Under Section 37(4), a data controller must notify the Personal Data Protection Committee's Office of a personal data breach without undue delay and, where feasible, within 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals. Where the breach is likely to result in a high risk, the controller must also notify the affected data subjects without undue delay, subject to the applicable legal requirements and exceptions.

The 72-hour period is not a general grace period for investigating an incident before taking action. Businesses should maintain a process for promptly escalating suspected breaches, assessing risks, preserving evidence, documenting decisions, and determining whether regulatory or individual notification is required.

Foreign headquarters and service providers should also establish clear internal reporting deadlines. If a Thai entity depends on an overseas IT team to investigate an incident, delayed communication could make compliance with Thai notification requirements more difficult.

7. Cross-Border Transfers of Personal Data

International data transfers are particularly important for multinational groups. A Thai subsidiary may routinely transmit employee records to an overseas headquarters, store customer information on cloud infrastructure located abroad, or use a foreign service provider to administer business systems.

Section 28 of the PDPA generally regulates transfers of personal data to a foreign country or international organisation. The applicable conditions depend on the transfer arrangement and relevant regulatory requirements.

The legal framework includes transfers to destinations recognised as providing adequate personal data protection, where applicable, and certain statutory exceptions. Where the relevant conditions are not met, businesses may need to rely on an appropriate safeguard, such as applicable standard contractual clauses or qualifying binding corporate rules, subject to the applicable Thai requirements.

The existence of a multinational corporate relationship does not, by itself, authorise the unrestricted transfer of personal data between group companies.

Before implementing a cross-border transfer, businesses should assess:

• The categories of personal data being transferred.
• The purposes and recipients of the transfer.
• The countries in which the data will be accessed, stored, or processed.
• The legal mechanism permitting the transfer.
• The contractual and technical safeguards required.
• The arrangements for responding to data subject requests and security incidents.

Companies should also review their cloud services, regional databases, global HR platforms, and group-wide customer relationship management systems. A transfer assessment should reflect actual access and processing arrangements, not merely the location of the contracting entity.

8. Data Subject Rights and Internal Procedures

The PDPA grants individuals rights in relation to their personal data, subject to the conditions and exceptions established by law.

Depending on the circumstances, these rights may include requesting access to personal data, obtaining copies, seeking correction, requesting erasure or destruction, requesting suspension of use, objecting to certain processing activities, and requesting the transfer of data where the statutory conditions apply. Individuals may also withdraw consent where processing is based on consent.

Foreign businesses should establish a process for receiving, verifying, recording, and responding to these requests within the applicable statutory timeframes.

A request may involve information held by several departments or systems. For example, a customer access request may require information from sales, marketing, customer support, and an external service provider. An effective response process therefore requires clear responsibilities and cooperation across the organisation.

Businesses should also recognise that not every request must automatically be granted. Certain rights are subject to statutory conditions, limitations, or exceptions. Responses should be assessed individually and documented appropriately.

9. When Must a Business Appoint a Data Protection Officer?

The PDPA requires certain data controllers and data processors to appoint a data protection officer (DPO) under Section 41.

The requirement may apply where an organisation's activities involve the collection, use, or disclosure of personal data that necessitates regular monitoring of personal data or the system, by virtue of the nature of the activities and the scale of the operations. It may also apply where the organisation's core activities involve the collection, use, or disclosure of sensitive personal data under Section 26.

The statutory criteria and applicable regulatory guidance should be assessed against the organisation's actual business model. A company should not conclude that a DPO is unnecessary merely because it has a relatively small workforce or is privately owned.

Where a DPO is required, the company should ensure that the appointment, responsibilities, reporting arrangements, and access to relevant information are consistent with the law. A DPO may be internal or external, provided the applicable requirements are satisfied.

Even where a formal DPO appointment is not mandatory, assigning clear responsibility for privacy compliance can help coordinate policies, vendor reviews, data subject requests, and incident response.

10. Penalties and Legal Exposure for Non-Compliance

Failure to comply with the PDPA can expose a business to administrative, civil, and, in certain circumstances, criminal liability.

The Act provides for administrative fines, with maximum amounts depending on the specific provision breached. Certain violations may attract fines of up to THB 5 million. The PDPA also permits compensation for damage suffered by data subjects, and the court may award punitive damages where the statutory conditions are met, subject to the applicable legal limits.

Criminal penalties may apply to certain offences, particularly those involving specified categories of sensitive personal data or unlawful disclosure, where the relevant statutory elements are satisfied.

The consequences of non-compliance are not limited to financial penalties. A data incident or regulatory complaint may also disrupt operations, damage customer confidence, affect commercial relationships, and complicate due diligence in a corporate transaction.

Foreign businesses should therefore treat PDPA compliance as an operational and governance issue rather than a document-preparation exercise.

11. A Practical PDPA Compliance Checklist for Foreign Businesses

Before launching or expanding operations in Thailand, a foreign business should consider the following steps:

1. Map personal data. Identify the personal data collected, its sources, the purposes of processing, the systems used, and the parties with access.
2. Determine legal roles. Establish which entities act as data controllers, data processors, or potentially joint controllers in each relevant activity.
3. Identify legal bases. Document the lawful basis for each processing purpose and assess whether any activity involves sensitive personal data.
4. Review privacy notices. Ensure that notices accurately explain collection, use, disclosure, retention, recipients, and applicable data subject rights.
5. Review contracts. Update agreements with vendors, payroll providers, cloud-service providers, and group companies to address processing responsibilities and safeguards.
6. Assess international transfers. Identify overseas access and transfers and confirm the applicable legal mechanism and contractual protections.
7. Implement security controls. Adopt proportionate technical and organisational measures and establish a documented incident-response process.
8. Prepare for data subject requests. Assign responsibility for handling requests, verifying identities, coordinating searches, and responding within the applicable deadlines.
9. Assess DPO requirements. Determine whether the statutory criteria for appointing a DPO are met.
10. Train personnel and review periodically. Provide practical training to relevant employees and reassess compliance when business activities, systems, vendors, or data flows change.

The scope of this work will depend on the organisation's activities. A business that processes only limited business-contact information may face a different compliance profile from an employer handling extensive HR records or a digital platform profiling large numbers of customers.

Conclusion

The PDPA is a core legal consideration for foreign businesses operating in or serving individuals in Thailand. Compliance requires an organisation to understand what personal data it handles, why it processes that data, which legal basis applies, who has access to it, and how the data is protected throughout its lifecycle.

For multinational groups, particular attention should be given to the allocation of responsibilities between Thai entities and overseas headquarters, cross-border transfers, vendor arrangements, and the management of data breaches.

A well-designed compliance framework should reflect actual business operations and be supported by appropriate contracts, internal procedures, technical safeguards, and employee training. Reviewing these matters before a problem arises can help businesses reduce legal exposure and establish a more reliable foundation for operating in Thailand.

This article is provided for general informational purposes only and does not constitute legal advice. The application of the PDPA depends on the facts of each case and the applicable laws and regulatory requirements.