ARTICLE · 19 MAY 2020

The Thai Personal Data Protection Act (PDPA)

Frank Legal & Tax

Explore more from Frank Legal & Tax

The Thailand Personal Data Protection Act (PDPA) is the latest piece of legislation which offers data protection regulations against the misuse of personal data that has been collected from individuals in Thailand.

ThailandPrivacy

Frank Legal & Tax

Author LinkedIn connections

The Thailand Personal Data Protection Act (PDPA) is the latest piece of legislation which offers data protection regulations against the misuse of personal data that has been collected from individuals in Thailand. The PDPA was greatly influenced by the European Union's General Data Protection Regulation (GDPR) which set a new standard for data protection regulations around the world.

Objectives of the PDPA

The objective of the PDPA is to protect all personal data, such as people's educational background, financial status, health records, criminal records, work records and other personal data such as fingerprints, voice, identification card number or numerical data of other documents. The law prevents people from using this data for any kind of benefit without express consent from the data subject.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

Related Articles

Thailand Issues Personal Data Protection Guidelines For AI Systems

ThailandPrivacy

Tilleke & Gibbins

Thailand Launches Public Consultation On Draft Data-Sharing Law

ThailandPrivacy

Tilleke & Gibbins

Thailand’s Draft Compliance Guidelines Position ROPA As Core Accountability Tool

ThailandPrivacy

Tilleke & Gibbins

More Clarity, More Compliance: Thailand's New Personal Data Access Rights Notification

ThailandPrivacy

Herbert Smith Freehills Kramer LLP

Thailand Proposes Significant Amendments To The Personal Data Protection Act

ThailandPrivacy

Tilleke & Gibbins

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Privacy
- Data Protection

Related Comparative Guides

Comparative Guide

Data Protection & Cybersecurity

See more popular content from

Privacy

Thailand's PDPC Signals Tougher Enforcement With Multi-Million Baht Fines

Thailand's Personal Data Protection Committee (PDPC) has made it clear that the era of warnings and gentle reminders is over. On 1 August 2025, the regulator announced eight administrative fines across...

ThailandPrivacy

Global Advertising Lawyers Alliance (GALA)

Thailand Releases New Draft PDPA Guidance On Lawful Bases And Marketing

Thailand's data protection regulator has published draft guidance on lawful bases for processing personal data and marketing practices under the PDPA. The guidance introduces a five-step process for selecting lawful bases, emphasizes separating marketing consent from core services, and addresses AI-driven marketing transparency. Organizations processing personal data in Thailand face new expectations around accountability, consent management, and documentation of compliance efforts.

ThailandPrivacy

Tilleke & Gibbins

Thailand Issues New Rules On Data Subject Access Requests

On July 16, 2026, Thailand’s Personal Data Protection Committee (PDPC) published a notification in the Government Gazette establishing detailed rules governing data subjects’ right of access under section 30...

ThailandPrivacy

Tilleke & Gibbins

Law Over Borders: Data Protection 2025 – Thailand

The Personal Data Protection Act B.E. 2562 (2019) (PDPA) was enacted in 2019 and became fully enforceable from June 1, 2022.

ThailandPrivacy

Tilleke & Gibbins

Thailand's Regulations For Cross-Border Personal Data Transfer Come Into Force

Two notifications on the cross-border transfer of personal data, issued by Thailand's Personal Data Protection Committee (PDPC), came into effect on March 24, 2024.

ThailandPrivacy

Tilleke & Gibbins

Thailand Issues Personal Data Protection Guidelines For AI Systems

Thailand's Personal Data Protection Committee has released its first comprehensive guidance on applying the Personal Data Protection Act to artificial intelligence systems. The guidelines expand the definition of personal data to include AI prompts, embeddings, and generated outputs, while establishing clear roles and responsibilities across the AI value chain.

ThailandPrivacy

Tilleke & Gibbins

More Than A Warning: Eight Serious Fines Imposed In Thai Data Protection Cases

Thailand's Personal Data Protection Committee (PDPC) announced to the press on August 1, 2025, that it had issued eight new administrative fines under Thailand's Personal Data Protection Act...

ThailandPrivacy

Tilleke & Gibbins

Thailand Issues Guidelines On PDPA Consent And Notification Requirements

Thailand's Personal Data Protection Committee (PDPC) has released separate guidelines for data controllers to follow in obtaining data subjects' consent and notifying data subjects of ...

ThailandPrivacy

Tilleke & Gibbins

AI Governance In Thailand: The PDPA Isn't Waiting. Neither Should You

Much of the discussion around artificial intelligence ("AI") regulation in Thailand focuses on future legislation. Less attention is paid to the obligations that already exist. For businesses deploying AI systems, Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA") is already engaged and, in practice, any system involving personal data falls within its scope

ThailandPrivacy

Herbert Smith Freehills Kramer LLP

Thailand Proposes Significant Amendments To The Personal Data Protection Act

Thailand's Personal Data Protection Act faces significant amendments that could reshape how government agencies and private organizations handle personal data. The proposed changes introduce new exemptions for anticorruption operations, clarify which entities qualify as government agencies, and fundamentally restructure the legal framework for data processing to align with international standards like the GDPR. These modifications would shift consent from a default requirement to one of seven equal lawful b

ThailandPrivacy

Tilleke & Gibbins