Regulations › Rest of world › Thailand
PDPA
Personal Data Protection Act B.E. 2562 (2019)
WhenIn effect since 1 June 2022
Who enforces itPersonal Data Protection Committee (PDPC) and its Office
Who it applies toControllers and processors in Thailand, and foreign ones offering goods or services to, or monitoring, people in Thailand.
Tell the regulatorNotify the PDPC Office within 72 hours of becoming aware, where feasible, unless no risk to ri…
DPO requiredDPO required for public authorities, large-scale regular monitoring, or core activities involv…
RegistrationNo registration of controllers
Transfers abroadDestination must have adequate standards, or a listed exception applies (consent, contract, et…
Request deadlineAccess requests must be fulfilled without delay and within 30 days
Maximum fineAdministrative fines up to THB 5 million per violation (about USD 150k)
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Reach and lawful basis
Reach abroad
2
Applies to controllers or processors abroad that offer goods or services to people in Thailand or monitor their behavior in Thailand.s.5 · source ↗
Read in an English translation labeled unofficial (hosted by Mahidol University); Thai text is authoritative.
Lawful basis
1
Consent or six other bases: research, vital interests, contract, public task, legitimate interests, and legal obligation.s.24 · source ↗
Read in an English translation labeled unofficial (hosted by Mahidol University); Thai text is authoritative.
Consent
3
Consent must be explicit, in writing or electronic form unless impossible, separate from other terms, and as easy to withdraw as to give.s.19 · source ↗
Read in an English translation labeled unofficial (hosted by Mahidol University); Thai text is authoritative.
Sensitive data
2
Sensitive data (health, beliefs, criminal records, biometrics, genetics, etc.) requires explicit consent unless a listed exception applies.s.26 · source ↗
Read in an English translation labeled unofficial (hosted by Mahidol University); Thai text is authoritative.
Children
3
Minors (under 20) need guardian consent unless they could act alone; under 10 always needs guardian consent.s.20 · source ↗
Read in an English translation labeled unofficial (hosted by Mahidol University); Thai text is authoritative. Age 20 is the Civil and Commercial Code majority age.
People's rights
Rights
3
Access, portability, objection, erasure, restriction and rectification.ss.30-35 · source ↗
Read in an English translation labeled unofficial (hosted by Mahidol University); Thai text is authoritative. No standalone automated-decision right.
Request deadline
2
Access requests must be fulfilled without delay and within 30 days.s.30 · source ↗
Read in an English translation labeled unofficial (hosted by Mahidol University); Thai text is authoritative.
Marketing
1
Data subjects may object to direct marketing at any time; no PDPA-specific opt-in for electronic marketing.s.32(2) · source ↗
Read in an English translation labeled unofficial (hosted by Mahidol University); Thai text is authoritative.
Governance
DPO required
1
DPO required for public authorities, large-scale regular monitoring, or core activities involving sensitive data.s.41 · source ↗
Read in an English translation labeled unofficial (hosted by Mahidol University); Thai text is authoritative.
DPO qualifications
1
PDPC may prescribe qualifications; DPO must have knowledge of data protection and be free of conflicts.ss.41-42 · source ↗
Read in an English translation labeled unofficial (hosted by Mahidol University); Thai text is authoritative.
Registration
0
No registration of controllers.None · source ↗
Read in an English translation labeled unofficial (hosted by Mahidol University); Thai text is authoritative.
DPIA
1
No express DPIA duty in the Act; risk-based security and PDPC guidance encourage assessments.s.37(1) · source ↗
Read in an English translation labeled unofficial (hosted by Mahidol University); Thai text is authoritative. No statutory DPIA article confirmed.
Records
2
Controllers must keep written or electronic records of processing; small organizations exempt per PDPC notification.s.39 · source ↗
Read in an English translation labeled unofficial (hosted by Mahidol University); Thai text is authoritative.
Retention
2
Controllers must examine and erase or anonymize data after the retention period or when no longer needed.ss.33, 37(3) · source ↗
Read in an English translation labeled unofficial (hosted by Mahidol University); Thai text is authoritative.
Breaches
Tell the regulator
2
Notify the PDPC Office within 72 hours of becoming aware, where feasible, unless no risk to rights.s.37(4) · source ↗
Read in an English translation labeled unofficial (hosted by Mahidol University); Thai text is authoritative.
Tell people
2
Notify affected data subjects without delay where the breach is likely high risk, with remedial measures.s.37(4) · source ↗
Read in an English translation labeled unofficial (hosted by Mahidol University); Thai text is authoritative.
Transfers
Transfers abroad
2
Destination must have adequate standards, or a listed exception applies (consent, contract, etc.); intra-group transfers need a PDPC-certified policy.ss.28-29 · source ↗
Read in an English translation labeled unofficial (hosted by Mahidol University); Thai text is authoritative.
Localization
0
No data localization requirement.None · source ↗
Read in an English translation labeled unofficial (hosted by Mahidol University); Thai text is authoritative.
Enforcement
Maximum fine
2
Administrative fines up to THB 5 million per violation (about USD 150k).ss.82-90 · source ↗
Read in an English translation labeled unofficial (hosted by Mahidol University); Thai text is authoritative.
Criminal liability
2
Up to 1 year imprisonment and/or THB 1 million fine for unlawful use or disclosure of sensitive data; directors liable for instructed acts.ss.79-81 · source ↗
Read in an English translation labeled unofficial (hosted by Mahidol University); Thai text is authoritative.
Private action
3
Strict liability for damages, plus punitive damages up to twice actual damages; class actions available under civil procedure.ss.77-78 · source ↗
Read in an English translation labeled unofficial (hosted by Mahidol University); Thai text is authoritative. Class action route is the Civil Procedure Code, not the PDPA.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws