Q1361. What is Thailand's PDPA and does my business have to comply?

Answered by the NYC Visa & Translation team

Thailand's Personal Data Protection Act B.E. 2562 (PDPA) protects any data that can identify a person — names, phone numbers, emails, addresses, health data — and has been fully enforced since 1 June 2022. Almost every business that collects customer, employee, or contact data falls within scope, including small online shops that store delivery addresses. Core duties of a data controller: (1) have a lawful basis for collecting and using data, such as consent or contractual necessity (2) inform data subjects of the purposes of collection (3) keep data secure (4) provide channels for data subjects to exercise rights — access, correction, deletion (5) notify the PDPC office of high-risk data breaches. Exemptions are narrow, such as purely personal household use. Our team can review your data flows and prepare privacy notices and consent documents that meet the legal standard. This is general guidance; requirements and fees change — always verify with the PDPC, ETDA, the Thai Customs Department, or the Department of Foreign Trade before proceeding.