Thailand

Personal Data Protection Act B.E. 2562 (2019), section 5. The Act applies to any company in Thailand that decides how personal data is used, or that handles data for someone else. That is true wherever the data is actually handled. It also applies to a company outside Thailand in two cases. One, you offer goods or services to people in Thailand, whether or not they pay. Two, you monitor the behaviour of people in Thailand. Section 37(5) applies if the second paragraph of section 5 catches you. You must appoint a written representative located in the Kingdom, authorised to act for you 'without any limitation of liability'. Section 38 exempts only two groups. State agencies named by the Committee. And companies whose business does not involve sensitive data and does not handle personal data at the scale the Committee sets under section 41(2). Separately, the Royal Decree on Digital Platform Services treats a foreign platform as serving Thai users in four cases. If it displays in Thai. If it uses a .th or .ไทย domain. If it accepts Thai baht. Or if it names Thai law as the governing law. Those operators must tell the Electronic Transactions Development Agency before they start. They must also appoint a written point of contact located in Thailand.

Section 28 of the Personal Data Protection Act says the destination country or international organisation must have an adequate personal data protection standard. That is judged against criteria the Personal Data Protection Committee publishes under section 16(5). Six exceptions let you transfer anyway. Complying with a law. Consent, where you have told the person the destination's protection is not adequate. Necessity for a contract with the person, or for steps before a contract. A contract made with someone else for the person's benefit. Protecting life, body or health where the person cannot give consent. And carrying out an important public-interest task. Section 29 adds two more routes that skip section 28 entirely. First, a group-wide personal data protection policy, reviewed and certified by the Office. Second, 'appropriate safeguards' that make the person's rights enforceable and give them real legal remedies, following rules the Committee publishes. INDUSTRY RULES ON TOP. (1) Banking and payments. Section 24 of the Payment Systems Act B.E. 2560 (2017) gives the Bank of Thailand express power to set binding rules on a payment operator's outsourced service providers. It can also set rules on how users' personal data is kept and disclosed. Section 25 makes operators keep records, accounts and evidence on the Bank's terms so it can inspect them. So a decision to use an offshore cloud turns into a conversation with the Bank. Rating: data can leave only if conditions are met (2) Government. State bodies are steered onto Thai government data-centre and cloud arrangements. That comes from the Act on Government Administration and Service Delivery in Digital Format B.E. 2562 (2019) and from Cabinet-level digital-government policy. Rating: data can leave only if conditions are met, close to Thai hosting by default. (3) Telecoms and any 'service provider'. The Computer Crime Act makes you keep computer traffic data for at least 90 days, in a form officials can get at. That pulls logs into Thailand, or at least into two places at once. It is not written as a rule about where data must be stored. (4) Banking and telecoms together. The technological-crime emergency decree makes both disclose and exchange customer account and transaction data. That happens through a central system run under the Ministry of Digital Economy and Society. That data flows inward, not outward. (5) Health, insurance, securities and mapping. We looked for firm rules on where data must stay and found none we could verify from a government source. See the 'unconfirmed' list. Do not read that as a finding that no rule exists.

The model is case-by-case self-assessment, with the regulator deciding the hard cases. Section 28 paragraph two says this. Where there is a question about whether a destination's standard is adequate, the Personal Data Protection Committee decides. It can revisit that decision on new evidence. You do not need approval before an ordinary transfer. There is no filing and no register. The only route that needs approval first is the group-wide rules route in section 29 paragraph one. There, the Office reviews and certifies a group policy. Section 29 paragraph three does most of the work. Where there is no Committee decision on the destination and no certified group policy, you may still transfer. You need appropriate safeguards in place, following rules and methods the Committee publishes. IMPORTANT GAP. The Committee has issued further notifications filling out sections 28 and 29. We could not open the regulator's own website, because it blocks automated access. We could not find a government-hosted copy of those notifications. So we confirm that they exist, but not what they say. See 'unconfirmed'. Penalties for picking the wrong route are graded. Up to three million baht for ordinary personal data. Up to five million baht where sensitive data is involved.

We rate enforcement as active, on the following evidence, verified on 18 August 2026. The Ministry's own newsroom of 17 August 2026 names Pol. Col. Surapong Plengkham as Secretary-General of the Office of the Personal Data Protection Committee. It records that the Office already runs public service centres in five provinces, expanding to eight during 2026 across all five regions. It also records a Cabinet decision of 11 August 2026. That approved a government-wide approach to stopping personal data leaks caused by stolen login details, using multi-factor authentication. So this is an agency with a chair, a budget, offices around the country and a policy job. It is not a paper body. Under sections 72 and 90 of the Act, the Expert Committee handles complaints. It can try mediation. It can order you to fix something or to stop. It can impose fines directly, taking into account how serious the conduct was and how big your business is. Unpaid fines are collected under the administrative procedure law. HONEST LIMIT. We could not reach the regulator's own website, because it blocks automated access. So we could not count or quote individual enforcement decisions. The 'active' rating rests on evidence about the institution, not on a verified list of decisions.

MINIMUM. Computer-Related Crime Act B.E. 2550 (2007), section 26. A service provider must keep computer traffic data for at least ninety days from the date the data enters the computer system. Where necessary, an official may order a particular provider to keep traffic data for longer than ninety days, up to a maximum of two years. Getting this wrong carries a fine of up to five hundred thousand baht (about 15,000 US dollars). 'Service provider' is defined broadly. It catches businesses that merely give other people internet access. That is why hotels, co-working spaces and offices with guest wi-fi are caught. MAXIMUM. Personal Data Protection Act section 37(3). You must put in place a system that checks and then erases or destroys personal data. That happens when the keeping period ends. Or when the data is no longer relevant or goes beyond what you need it for. Or when the person asks, or withdraws consent. There are exceptions. They cover freedom of expression, the public-interest and research grounds in sections 24(1), 24(4) and 26(5), establishing, exercising or defending legal claims, and complying with law. Section 39 separately makes your record of data uses state the keeping period for each category. NOT VERIFIED. Two general business minimums are widely relied on in Thailand. Five years of accounting records under the Accounting Act. Five years of tax documents under the Revenue Code. We did not open a government copy of either. See 'unconfirmed'.

DEADLINE 1 - Personal Data Protection Act section 37(4). Tell the Office without delay, and where possible within seventy-two hours of finding out. You can skip this if the breach is unlikely to risk people's rights and freedoms. Where the risk is high, also tell the person affected, without delay, along with what you are doing to put it right. The detail of the notice and its exceptions is set by Committee notification. DEADLINE 2 - Cybersecurity Act B.E. 2562 (2019) section 57. If a significant cyber threat hits a critical information infrastructure organisation's systems, that organisation must report it. The report goes to the Office of the National Cyber Security Committee and to its own regulator or supervisor. It must also carry out the required response steps. Failing to report without a reasonable excuse carries a fine of up to two hundred thousand baht (about 6,000 US dollars). DEADLINE 3 - Emergency Decree on Measures for the Prevention and Suppression of Technological Crimes B.E. 2566 (2023) section 4, as amended in 2025. Where there is reasonable suspicion of technology crime, financial institutions and business operators must disclose or exchange customer account and transaction data among themselves. That goes through a system run under the Ministry of Digital Economy and Society. The three sets of rules have different triggers, different recipients and different deadlines. One incident can start all three at once.

TRAP 1 - children. Section 20 of the Personal Data Protection Act. This covers a minor who has not reached majority by marriage. It also has to be someone not treated as of age under section 27 of the Civil and Commercial Code. For them, you also need consent from the person with parental power. The exception is where the minor may consent alone under sections 22, 23 or 24 of that Code. And where the minor is not over ten years old, you must get consent from the person with parental power. Majority in Thailand is twenty. So the group needing a parental check is far wider than the thirteen or sixteen most global products are built for. The same rule applies to withdrawing consent, to notices, to rights requests and to complaints. TRAP 2 - criminal, not just a fine from the regulator. Section 79. It is an offence to disclose sensitive data unlawfully, or to send it abroad in breach of section 28. That is if you do it in a way likely to cause another person damage, loss of reputation, insult, hatred or humiliation. The penalty is up to six months in prison, or a fine of up to five hundred thousand baht (about 15,000 US dollars), or both. It rises if you did it to get an unlawful benefit for yourself or someone else. Then it is up to one year in prison, or a fine of up to one million baht (about 30,000 US dollars), or both. The offence can be settled, which changes how it gets negotiated. TRAP 3 - you pay even if you were careful, and a court can double it. Section 77. You must compensate a person for damage caused by breaking the Act, 'whether the act was intentional or negligent or not'. There are only two defences. Force majeure or the person's own act. And acting on an official's lawful order. Section 78 lets the court award punitive damages on top, up to twice the actual amount. The claim runs out three years after the injured person learns of the damage and of who is responsible. TRAP 4 - the in-country representative. Section 37(5) applies to a foreign company caught by section 5 paragraph two. You must appoint, in writing, a representative located in Thailand, authorised to act 'without any limitation of liability'. The exemptions in section 38 are narrow. They cover named state agencies, and businesses that do not handle sensitive data and are not large-scale on criteria the Committee sets. This is not a mailbox job. TRAP 5 - who counts as a 'service provider' for logs. The 90-day traffic data duty in section 26 of the Computer-Related Crime Act applies to anyone providing computer service to other people. It is not just telecoms carriers. The fine reaches five hundred thousand baht. Hotels, landlords, clinics and offices with guest networks are routinely caught. TRAP 6 - digital platforms are caught by look and feel. Under the Royal Decree on Digital Platform Services, a platform run entirely from abroad is treated as serving users in Thailand in four cases. If it displays in Thai. If it uses a .th or .ไทย domain. If it accepts payment in Thai baht. Or if it names Thai law as governing. Advance notice to the Electronic Transactions Development Agency then kicks in above certain sizes. For an individual that is revenue above 1.8 million baht a year (about 55,000 US dollars). For a company it is 50 million baht (about 1.5 million US dollars). It also kicks in above 5,000 average monthly users.

LANDING IN THE NEXT TWELVE MONTHS. (1) The Personal Data Protection Committee Office is expanding its regional PDPA Centers from five provinces to eight during 2026, covering all five regions. The Deputy Minister announced this on 17 August 2026, with the Office's Secretary-General present. (2) The Cabinet decision of 11 August 2026 is being put into effect. It covers preventing personal data leaks caused by stolen login details, using multi-factor authentication. The Minister has also said he plans to raise personal data protection and cyber-risk measures across all twenty ministries. POWERS ALREADY HELD THAT COULD CHANGE THINGS WITH NO CONSULTATION. (a) Section 28 read with section 16(5). The Committee sets the criteria for judging whether a destination country's protection is good enough, and decides disputed cases. One decision that a widely used destination is not good enough would kill transfers relying on that route overnight. The criteria could also be relaxed the same way. (b) Section 26 of the Computer-Related Crime Act. An official may order any named service provider to keep traffic data for longer than ninety days, up to two years. That is case by case, with no rule-making needed. (c) The Royal Decree on Digital Platform Services. It lets the Electronic Transactions Commission and the Agency add named platforms to the heavier duty tiers by notification. Notifications 4/2568, 6/2568 and 7/2568 have already named marketplace platforms, and 2/2568 named ride-hailing platforms. So the mechanism is live and in regular use. (d) The technology-crime rules sit in an emergency decree. The executive can amend that without going through Parliament first. It already did, in April 2025. So bank and telecoms data-sharing duties can be widened quickly. (e) Sections 38 and 41. The Committee can define by notification which businesses are 'large scale' and so must appoint a data protection officer and a representative. Moving that line moves thousands of companies in or out. WE COULD NOT VERIFY: whether any bill amending the Personal Data Protection Act is before Parliament. Nor whether Thailand has taken any further step toward the Global Cross-Border Privacy Rules system. See 'unconfirmed'.