Thailand PDPA Compliance & Outsourced DPO

The scope question decides whether the rest matters

The Personal Data Protection Act B.E. 2562 (2019) came into full force on 1 June 2022 after two postponements. It applies to a data controller or processor in Thailand, and it also reaches organisations outside Thailand where they offer goods or services to data subjects in Thailand, or monitor their behaviour in Thailand. A foreign company with no Thai entity can therefore be in scope through its website and its marketing, and where it is, it must appoint a representative in Thailand.

Personal data is defined broadly: any information relating to an identified or identifiable natural person, excluding data of the deceased. A separate and stricter category — sensitive personal data — covers racial or ethnic origin, political opinions, religious or philosophical beliefs, sexual behaviour, criminal records, health data, disability, trade union information, genetic and biometric data. Handling that category on the wrong legal basis is where the most serious exposure sits, and biometric attendance systems are the example we see most often in Thai workplaces.

The Act is closely modelled on the EU General Data Protection Regulation, and organisations with a mature GDPR programme start well ahead. They are not finished, however. The PDPA's consent formalities, its criminal provisions and its Thai-language notice expectations differ enough that a translated GDPR notice is not a compliant PDPA notice.

Lawful bases and the consent trap

• Consent must be explicit, freely given, informed, presented separately from other terms, and as easy to withdraw as to give. Bundled acceptance inside general terms and conditions does not meet this standard.
• Because consent is fragile, contractual necessity, legal obligation, vital interests, public task and legitimate interests are frequently the better bases for routine processing such as payroll and customer fulfilment.
• Legitimate interests must be balanced against the data subject's rights, and the assessment should be documented at the time, not reconstructed after a complaint.
• Sensitive personal data requires explicit consent or one of the narrower statutory exceptions; employment-related exceptions are limited and should not be assumed.
• Consent obtained before the Act took effect can continue to be relied on only where it satisfies the Act's requirements for the same purposes; legacy consent should be audited rather than presumed valid.

The obligations that generate visible work

Enforcement exposure and how a programme is sequenced

The Act carries three distinct kinds of liability. Administrative fines run up to five million baht for the most serious contraventions. Civil liability includes compensation and the possibility of punitive damages of up to twice the actual damage. Criminal provisions attach to certain misuses of sensitive data and to disclosure by those who obtained data in the course of duty, with imprisonment and fines, and directors can be exposed where the offence was committed with their consent or through their neglect. That third category is why PDPA is a board-level topic in Thailand rather than an IT topic.

A workable programme is sequenced, not simultaneous. Map the data first, because every later decision depends on knowing what you hold. Fix the lawful bases and rewrite the notices second, since those are what a regulator or complainant sees first. Then close the contractual gaps with processors, stand up the rights-request and breach processes, and only then invest in tooling. Organisations that buy a consent platform before mapping their data almost always end up rebuilding it.

Common mistakes and how we avoid them

More questions we are asked

Do we need a DPO?

Section 41 sets out the cases where appointment is mandatory, including certain public-body activity, large-scale regular monitoring, and core activity involving sensitive data. Where it is not mandatory, document the assessment that reached that conclusion.

How long may we retain personal data?

The Act does not set fixed periods. Retention must be tied to purpose and to any specific statutory retention rule, such as accounting and tax record obligations, and the periods should be published in the notice.

Is a foreign company without a Thai entity in scope?

It can be, where it offers goods or services to data subjects in Thailand or monitors their behaviour there. In-scope foreign controllers must appoint a representative in Thailand.

What must happen after a breach?

Assess risk immediately. Where notification is required, notify the Office of the PDPC within 72 hours of becoming aware, and notify affected data subjects where the risk to their rights is high.

What do you deliver on a PDPA engagement?

Data mapping, records of processing, bilingual notices and consent wording, processor clauses, rights-request and breach playbooks, and staff briefing materials in Thai and English.