Regulations › Rest of world › Thailand
PDPA
Personal Data Protection Act B.E. 2562 (2019)
WhenIn effect since 1 June 2022
Who enforces itPersonal Data Protection Committee (PDPC) and its Office
Who it applies toControllers and processors in Thailand, and foreign ones offering goods or services to, or monitoring, people in Thailand.
Tell the regulatorNotify the PDPC Office within 72 hours of becoming aware, where feasible, unless no risk to ri…
DPO requiredDPO required for public authorities, large-scale regular monitoring, or core activities involv…
RegistrationNo registration of controllers
Transfers abroadDestination must have adequate standards, or a listed exception applies (consent, contract, et…
Request deadlineAccess requests must be fulfilled without delay and within 30 days
Maximum fineAdministrative fines up to THB 5 million per violation (about USD 150k)
Recent developments
Nothing reported yet. Regulatory Watch lists new rules, enforcement and court decisions as they arrive.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws