On September 29, 2025, Thailand's Office of the Personal Data Protection Committee (PDPC Office) published its Regulations on the Review and Certification of Binding Corporate Rules B.E. 2568 (2025) (the Regulations).

Thailand's Personal Data Protection Committee (PDPC) has released separate guidelines for data controllers to follow in obtaining data subjects' consent and notifying data subjects of ...

Following the enactment of Thailand's Personal Data Protection Act (PDPA) in May 2019, Tilleke & Gibbins' dedicated data protection team in Bangkok has been committed to monitoring, participating in...

Thailand's Personal Data Protection Act (PDPA) enforcement has entered a new phase, and the insurance industry is squarely in the regulatory spotlight.

On January 28, 2025, the Office of the Personal Data Protection Committee (PDPC) hosted Data Privacy Day 2025, bringing together over 1,000 participants from both the public and private sectors.

Thailand's Personal Data Protection Committee (PDPC) has launched a public consultation period to gather input for a forthcoming...

Four decisions from the Expert Committee under Thailand's Personal Data Protection Act B.E. 2562 (2019) (PDPA) indicate that there will no longer be any relaxation of PDPA enforcement.

On September 14, 2023, Thailand's Personal Data Protection Committee (PDPC) published a notification on the requirements for the appointment of a data protection officer (DPO)...

Generative artificial intelligence (GenAI) is no longer a distant innovation confined to science fiction and research labs; it has become an integral part of daily business operations worldwide.

Thailand's data protection regulator has published draft guidance on lawful bases for processing personal data and marketing practices under the PDPA. The guidance introduces a five-step process for selecting lawful bases, emphasizes separating marketing consent from core services, and addresses AI-driven marketing transparency. Organizations processing personal data in Thailand face new expectations around accountability, consent management, and documentation of compliance efforts.

In September 2021, the Bank of Thailand (BOT) issued its Guidelines on Data Governance to provide financial institutions with recommendations on how to ensure that their data governance will be in compliance with accepted international principles.

Incidents of unauthorized disclosure of personal information to third parties has raised concern over personal data security across the globe...

Thailand’s Office of the Personal Data Protection Committee (PDPC) recently released draft guidance on records of processing activities (ROPA) for personal data controllers and processors under the Personal Data Protection Act B.E. 2562 (2019) (PDPA).

Data protection officers (DPOs) have become a fixture of Thailand’s privacy compliance landscape since the Personal Data Protection Act B.E. 2562 (2019) (PDPA) took full effect and the Office of the Personal Data Protection Committee (PDPC) began requiring certain organizations to appoint them.

Thailand's Securities and Exchange Commission (SEC) has established a comprehensive governance framework for the use of artificial intelligence and machine learning (AI/ML) in the capital markets.

As many are already aware, following the change of government in Myanmar on February 1, 2021, a draft Cyber Security Law was proposed which attracted widespread criticism.

The Personal Data Protection Act BE 2562 (PDPA), published in the Government Gazette on May 27, 2019

Thailand’s Electronic Transactions Development Agency (ETDA) released a new version of the draft Act on Artificial Intelligence on July 2, 2026, for a public hearing period expected to be approximately 30 days.

The Notification on the Criteria and Procedures for Handling Personal Data Breaches (the "Notification") was issued by the Personal Data Protection Committee ("PDPC") of Thailand and enacted...

On 6 July 2026, the Personal Data Protection Committee of Thailand (PDPC) issued a new Notification, setting out detailed requirements for handling requests by data subjects to access and obtain copies of their personal data, as well as requests for information on the source of personal data collected without consent.