Share on LinkedInShare on LinkedIn

ARTICLE · 07 AUGUST 2026

More Clarity, More Compliance: Thailand's New Personal Data Access Rights Notification

Herbert Smith Freehills Kramer LLP
Herbert Smith Freehills Kramer LLP
Contributor
Herbert Smith Freehills Kramer LLP

Herbert Smith Freehills Kramer LLP

We have one of the largest Southeast Asia international law practices, working across the region...

View firm profile
Explore more from Herbert Smith Freehills Kramer LLP

On 6 July 2026, the Personal Data Protection Committee of Thailand (PDPC) issued a new Notification, setting out detailed requirements for handling requests by data subjects to access and obtain copies of their personal data, as well as requests for information on the source of personal data collected without consent.

ThailandPrivacy
Supadith Palungteapin
Supadith Palungteapin
Author LinkedIn connections

Data subject access requests are about to become more procedural and compliance intensive.  

On 6 July 2026, the Personal Data Protection Committee of Thailand (PDPC) issued a new Notification1, setting out detailed requirements for handling requests by data subjects to access and obtain copies of their personal data, as well as requests for information on the source of personal data collected without consent.

Effective from 14 September 2026, the Notification introduces specific requirements relating to, among others, request procedures, identity verification, response timelines, grounds for refusal, fees and record keeping obligations.  

What does this Notification mean for businesses and data subjects? 

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

Thailand Releases New Draft PDPA Guidance On Lawful Bases And Marketing

Thailand's data protection regulator has published draft guidance on lawful bases for processing personal data and marketing practices under the PDPA. The guidance introduces a five-step process for selecting lawful bases, emphasizes separating marketing consent from core services, and addresses AI-driven marketing transparency. Organizations processing personal data in Thailand face new expectations around accountability, consent management, and documentation of compliance efforts.
ThailandPrivacy
Tilleke & Gibbins
Tilleke & Gibbins