PDPA

What it is

The Personal Data Protection Act, B.E. 2562 (2019), is Thailand's first comprehensive data protection law. It was published in the Royal Gazette on 27 May 2019, and its main operative provisions were postponed several times before taking full effect on 1 June 2022. The drafting is heavily influenced by the EU's GDPR, and it creates the Personal Data Protection Committee (PDPC) and its supporting office.

Who it applies to

The Act applies to "data controllers" and "data processors" that collect, use or disclose personal data in Thailand. It also has extraterritorial reach: it applies to controllers and processors outside Thailand that offer goods or services to data subjects in Thailand or monitor their behaviour in Thailand. Certain bodies and activities are exempt, including purely personal or household use, some state security functions, and media or artistic activities in limited circumstances.

Core principles

Personal data may only be collected, used or disclosed for lawful purposes that have been notified to the data subject, and collection must be limited to what is necessary for those purposes. The controller must keep data accurate, secure and no longer than needed, and must be transparent about the processing. Obtaining consent by deception or misleading the data subject is prohibited.

Legal bases

Consent is a main basis, and it must be explicit, given in writing or electronically unless that is not possible, and freely withdrawable. Other bases include contract, legal obligation, vital interests, public task and legitimate interests. Sensitive personal data, such as race, political opinions, religion, health, biometrics and criminal records, is subject to stricter conditions and generally needs explicit consent or a narrow exception.

Individual rights

Data subjects have the right to withdraw consent, to access and obtain a copy of their data, to data portability, to object to processing, to erasure or anonymisation, to restriction of processing, and to rectification. Controllers must respond to requests within the statutory period and may refuse only in the circumstances the Act allows.

Key obligations

Controllers must provide security measures, notify data subjects of the purposes and other details at collection, keep records of processing, and put suitable agreements in place with processors. A data protection officer must be appointed in specified cases, such as large-scale monitoring or processing of sensitive data, and a controller outside Thailand may need to appoint a representative in Thailand. Processors must act only on the controller's instructions and keep their own records.

Data breaches

A controller must notify the Office of the PDPC of a personal data breach without delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to individuals' rights and freedoms. If the breach is likely to result in a high risk, the controller must also notify affected data subjects and the remedial measures promptly.

International transfers

Transferring personal data to another country is allowed if the destination has adequate data protection standards as determined by the PDPC, or if one of the Act's alternatives applies, such as consent with notice of the inadequate standards, approved binding corporate rules, or appropriate safeguards that give enforceable rights and effective remedies. PDPC announcements provide further detail on what counts as adequate safeguards.

Enforcement and penalties

Enforcement combines civil, criminal and administrative routes. Data subjects can claim compensation, and courts may award punitive damages of up to twice the actual damages. Criminal penalties include imprisonment and fines, notably for misuse of sensitive personal data in a way that harms or benefits another. Administrative fines imposed by the expert committee reach up to five million baht for the most serious violations, such as breaches involving sensitive data.

The official text

The authoritative version is the Thai-language Act published in the Royal Gazette. The English text linked here is an unofficial translation hosted by a university, not the PDPC's own publication, and the Act is supplemented by many subordinate regulations and PDPC announcements. Use the Thai text, not this summary, for anything that matters.