81%
of Thailand's 21 requirements are already met by European Union (GDPR). Here is what PDPA adds, biggest gaps first.
ConsentReach and lawful basisGap
GDPR2 Consent must be freely given, specific, informed and unambiguous by clear affirmative action, and the controller must be able to demonstrate it.
PDPA adds3 Consent must be explicit, in writing or electronic form unless impossible, separate from other terms, and as easy to withdraw as to give.
s.19 · source ↗
ChildrenReach and lawful basisGap
GDPR2 Parental consent required for information society services offered to children under 16; Member States may lower the age to no less than 13.
PDPA adds3 Minors (under 20) need guardian consent unless they could act alone; under 10 always needs guardian consent.
s.20 · source ↗
RetentionGovernanceGap
GDPR1 Storage limitation: keep identifiable data no longer than necessary; erase when no longer needed.
PDPA adds2 Controllers must examine and erase or anonymize data after the retention period or when no longer needed.
ss.33, 37(3) · source ↗
Criminal liabilityEnforcementGap
GDPR1 Member States set other penalties, including criminal penalties, for infringements not subject to administrative fines.
PDPA adds2 Up to 1 year imprisonment and/or THB 1 million fine for unlawful use or disclosure of sensitive data; directors liable for instructed acts.
ss.79-81 · source ↗
Already covered by GDPR: Reach abroad, Lawful basis, Sensitive data, Rights, Request deadline, Marketing, DPO required, DPO qualifications, Registration, DPIA, Records, Tell the regulator, Tell people, Transfers abroad, Localization, Maximum fine, Private action.
A gap means PDPA is more demanding than GDPR on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
