Data protection & privacy law in Thailand (2026)

Legal framework

Personal Data Protection Act B.E. 2562 (2019) ("PDPA"), supervised by the Personal Data Protection Committee / Office of the PDPC

Key points: data & privacy in Thailand

1. 01Comprehensive omnibus law

   The PDPA (B.E. 2562/2019) is a single, economy-wide personal-data law modeled on the EU GDPR. Enacted 28 May 2019, its main operative provisions took full effect on 1 June 2022 after repeated extensions.

   nortonrosefulbright.com data.thailand.opendevelopmentmekong.net

2. 02Supervisory authority (PDPC)

   The Personal Data Protection Committee and its Office (the PDPC) is the regulator. It was formally established in January 2022, issues subordinate regulations and guidelines, and is chaired/structured with government and honorary expert members. Official portal: pdpc.or.th.

   pdpc.or.th tilleke.com

3. 03Core controller obligations

   Controllers must establish a lawful basis (often consent) and notify data subjects of purpose, implement appropriate security measures, keep records of processing, appoint a Data Protection Officer where core activities involve large-scale processing (DPO rules effective Dec 2023), and notify the PDPC of breaches within 72 hours.

   dlapiperdataprotection.com iapp.org

4. 04Data subject rights

   The PDPA grants rights to be informed, access, rectification, erasure/de-identification, restriction, objection, withdrawal of consent, data portability, and the right to lodge complaints with the PDPC, closely tracking GDPR rights.

   dlapiperdataprotection.com nortonrosefulbright.com

5. 05Cross-border transfer rules

   Section 29 transfer rules (PDPC Notification of 2023, effective March 2024) require destinations to have adequate protection or be safeguarded by approved mechanisms such as Binding Corporate Rules or Standard Contractual Clauses. As of 2025 no adequacy list has been published, so transfers generally require these safeguards.

   pdpc.or.th fosrlaw.com

6. 06Penalties and active enforcement

   The PDPA carries administrative fines up to THB 5 million, civil/punitive damages, and criminal penalties (up to one year imprisonment and/or THB 1 million fine) for certain offences. In August 2025 the PDPC issued eight fines across five cases totaling about THB 21.5 million, marking a shift to active enforcement.

   hoganlovells.com hsfkramer.com

Timeline of decisions

1. 14 Nov 2025Enforcement
   PDPC Orders Worldcoin/World to Halt Iris Scanning and Delete 1.2 Million Biometric Records

   Thailand's PDPC ordered Tools for Humanity (Worldcoin/World) to suspend iris-scan biometric enrollment and delete approximately 1.2 million Thais' iris records, finding violations of PDPA sensitive-data consent rules and cross-border transfer requirements. It was the first major PDPC enforcement action specifically targeting biometric data.

   Bangkok Post

2. 1 Aug 2025Enforcement
   PDPC Issues Eight New Administrative Fines Across Five Cases; Cumulative Penalties Exceed THB 21.5 Million

   The PDPC announced eight orders in five cases (public and private sector) totalling THB 14.5 million, including a hospital fined after a contractor used patient records as sweet wrapping, and a collectibles company whose processor faced THB 3 million in fines. Running cumulative fines since 2022 surpassed THB 21.5 million, marking a clear escalation in enforcement intensity.

   Tilleke & Gibbins

3. 21 Aug 2024Enforcement
   PDPC Issues First Administrative Penalty Under the PDPA, 7 Million Baht Fine

   Thailand's Personal Data Protection Committee imposed the maximum 7 million Baht administrative fine on an undisclosed major e-commerce platform for failing to appoint a Data Protection Officer, maintaining inadequate security measures that caused data leaks to call-centre scammers, and failing to report breaches, the first enforcement action since the PDPA's full entry into force in 2022.

   IAPP

4. 21 Aug 2024Enforcement
   PDPC Issues First-Ever PDPA Administrative Penalty, JIB Computer Group Fined Statutory Maximum THB 7 Million

   Two years after full enforcement began, the PDPC imposed its inaugural administrative fine (the statutory maximum of THB 7 million) on IT retailer JIB Computer Group for a data breach enabling call-centre fraud, failure to appoint a DPO, inadequate security measures, and missing the 72-hour breach-notification deadline. The case set the enforcement benchmark for all subsequent PDPA actions.

   Nishimura & Asahi

5. 24 Mar 2024Law · official
   Cross-Border Personal Data Transfer Regulations Enter Force

   Two subordinate regulations gazetted in December 2023 (Whitelist Adequacy Notification under s.28 and BCR/Appropriate-Safeguards Notification under s.29) became legally effective, requiring Thai data controllers to verify that destination countries meet adequacy standards or to use SCCs or BCRs before sending personal data abroad. No country has yet been placed on the whitelist.

   PDPC Thailand

6. 24 Nov 2023Enforcement
   PDPC Announces First-Ever Enforcement Action Under PDPA Against Insurance Company

   Thailand's Personal Data Protection Committee publicly confirmed it was taking enforcement action for the first time since full PDPA implementation, targeting a Thai insurer for non-compliant handling of children's and parents' personal data in marketing activities, signaling the start of active enforcement.

   Herbert Smith Freehills

7. 1 Jun 2022Law · official
   PDPA Enters Full Force; PDPC Becomes Operational

   After two consecutive one-year postponements, all substantive chapters of the Personal Data Protection Act B.E. 2562 (2019), including data-subject rights, lawful-basis obligations, and the administrative penalty regime, became fully enforceable on 1 June 2022. The Personal Data Protection Committee had been formally constituted in January 2022, providing the independent regulatory authority the Act required.

   Ministry of Digital Economy and Society (Thailand)

8. 1 Jun 2022Law · official
   PDPA Fully Enters into Force After Two-Year COVID Deferral

   Thailand's Personal Data Protection Act B.E. 2562 became fully enforceable on 1 June 2022 after pandemic-related delays. Modelled on GDPR, the PDPA immediately imposed consent, data-minimisation, DPIA, and cross-border transfer obligations on all AI systems processing personal data, with administrative fines up to THB 5 million per violation and criminal fines up to THB 1 million.

   PDPC Thailand (official)

9. 1 Jun 2022Law · official
   Personal Data Protection Act (PDPA) Enters Full Enforcement

   Thailand's PDPA, enacted in 2019 but enforcement-deferred, became fully operative in June 2022, imposing GDPR-style consent, breach-notification, and data-minimisation obligations with fines up to THB 5 million. It directly affects fintech KYC flows, biometric onboarding, and payment-data sharing between providers.

   U.S. International Trade Administration

10. 1 Jun 2022Law · official
    Personal Data Protection Act Enters Full Force After Two-Year Delay

    After successive one-year postponements following enactment in May 2019, and following the establishment of the Personal Data Protection Committee in January 2022, the PDPA came into full effect on 1 June 2022, imposing mandatory cybersecurity safeguards, breach notification duties, and DPO appointment requirements on all organizations processing personal data of Thai residents.

    U.S. International Trade Administration

11. 8 May 2021Law
    Second Royal Decree Postponement Defers Full PDPA Enforcement to June 2022

    A second amendment to the postponement Royal Decree, published 8 May 2021, extended the compliance deferral by another year to 1 June 2022, citing the PDPC's incomplete constitution and businesses' need for further preparation time. The two back-to-back deferrals meant the PDPA's substantive provisions remained unenforced for three years after royal assent.

    Tilleke & Gibbins

12. 21 May 2020Law
    First Royal Decree Postponement Delays PDPA Enforcement to May 2021

    A Royal Decree published 21 May 2020 exempted most organisations from PDPA data-subject-rights and controller obligations until 31 May 2021, citing the PDPC's incomplete formation and the need for stakeholder readiness. It was Thailand's first of two successive one-year deferrals of the landmark law.

    Norton Rose Fulbright

Sources

1. 1.pdpc.or.th/en/home/
2. 2.pdpc.or.th/en/10547/
3. 3.data.thailand.opendevelopmentmekong.net/en/laws_record/2562/resource/ec616be5-9fbf-4071-b4b5-cb1f3e46e826
4. 4.nortonrosefulbright.com/en/knowledge/publications/e29d223d/overview-of-thailand-personal-data
5. 5.dlapiperdataprotection.com/index.html?t=law&c=TH
6. 6.tilleke.com/insights/thailand-establishes-personal-data-protection-commission/
7. 7.iapp.org/news/a/key-developments-in-thailands-pdpa-regulations
8. 8.hoganlovells.com/en/publications/thailand-ramps-up-data-protection-enforcement
9. 9.hsfkramer.com/notes/data/2025-posts/pdpa-fines-and-firsts-a-6-year-timeline-of-thai
10. 10.fosrlaw.com/2025/thailand-pdpa-compliance-enforcement-cross-border-transfers/