Thailand

Personal Data Protection Act B.E. 2562 (2019), section 5: the Act applies to any controller or processor located in Thailand wherever the processing happens, and to a controller or processor outside Thailand where the activity is (1) offering goods or services to data subjects in Thailand, whether or not payment is made, or (2) monitoring the behaviour of data subjects that takes place in Thailand. Section 37(5) requires a controller caught by the second paragraph of section 5 to appoint a written representative located in the Kingdom, authorised to act on the controller's behalf 'without any limitation of liability'. Section 38 carves out only two groups: state agencies designated by the Committee, and controllers whose business does not involve sensitive data and does not involve personal data at the scale the Committee prescribes under section 41(2). Separately, the Royal Decree on Digital Platform Services deems a foreign platform to be serving Thai users if it displays in Thai, uses a .th or .ไทย domain, accepts Thai baht, or specifies Thai governing law; those operators must notify the Electronic Transactions Development Agency before starting and appoint a written point of contact located in Thailand.

Section 28 of the Personal Data Protection Act says the destination country or international organisation must have an adequate personal data protection standard, judged against criteria the Personal Data Protection Committee publishes under section 16(5). Six exceptions let you transfer anyway: compliance with law; consent where the person has been told the destination's protection is not adequate; necessity for a contract with the person or pre-contract steps; a contract made with someone else for the person's benefit; protection of life, body or health where consent cannot be given; and necessary performance of an important public-interest mission. Section 29 adds two more routes that bypass section 28 entirely: (a) an intra-group personal data protection policy — binding corporate rules — reviewed and certified by the Office, and (b) 'appropriate safeguards' that make the data subject's rights enforceable and provide effective legal remedies, in accordance with rules the Committee publishes. SECTOR OVERRIDES. (1) Banking and payments: the Payment Systems Act B.E. 2560 (2017) section 24 gives the Bank of Thailand express power to set binding rules on a regulated payment operator's use of outsourced service providers and on the retention and disclosure of users' personal data; section 25 requires operators to keep records, accounts and evidence on the Bank's terms so it can inspect them. In practice this converts an offshore cloud or offshore processing decision into a supervisory conversation with the Bank. Rating: data can leave with the right paperwork. (2) Government: state bodies are steered onto domestic government data-centre and cloud arrangements under the Act on Government Administration and Service Delivery in Digital Format B.E. 2562 (2019) and Cabinet-level digital-government policy. Rating: data can leave with the right paperwork, in practice close to onshore-by-default. (3) Telecommunications and any 'service provider': the Computer Crime Act obliges retention of computer traffic data for at least 90 days in a form officials can obtain, which is a practical pull toward onshore or dual-held logs even though it is not written as a residency rule. (4) Banking plus telecoms together: the technological-crime emergency decree forces both to disclose and exchange customer account and transaction data through a central system operated under the Ministry of Digital Economy and Society — that data flows inward, not outward. (5) Health, insurance, securities and mapping: we looked for hard localisation rules and did not find one we could verify from a government source during this run; see the 'unconfirmed' list rather than treating that as a finding of no rule.

The model is best described as case-by-case self-assessment with a residual regulator decision. Section 28 paragraph two says that where there is a question about whether a destination's standard is adequate, the matter is put to the Personal Data Protection Committee to decide, and the decision may be revisited on new evidence. There is no prior-approval requirement for an ordinary transfer, no filing, and no registry. The only pre-approval mechanism is the binding corporate rules route in section 29 paragraph one, where the Office reviews and certifies an intra-group policy. Section 29 paragraph three is the workhorse: where there is no Committee decision on the destination and no certified group policy, the controller or processor may transfer if it has put in place appropriate safeguards under rules and methods the Committee publishes. IMPORTANT GAP: the Committee has issued subordinate notifications fleshing out sections 28 and 29, but we could not open the regulator's own website during this run because it is behind a bot-challenge, and we could not locate a government-hosted copy of those notifications. Treat their detail — not their existence — as unverified here; see 'unconfirmed'. Penalties for getting the route wrong are graded: up to three million baht for ordinary personal data, up to five million baht where sensitive data is involved.

Enforcement rating: active, on the following observable evidence verified on 18 August 2026. The Ministry's own newsroom of 17 August 2026 names Pol. Col. Surapong Plengkham as Secretary-General of the Office of the Personal Data Protection Committee, records that the Office already runs public service centres in five provinces and is expanding to eight during 2026 across all five regions, and records a Cabinet resolution of 11 August 2026 approving a government-wide approach to preventing personal data leakage from leaked login credentials using multi-factor authentication. That is an agency with a chair, a budget, a field presence and a policy mandate, not a paper body. Under sections 72 and 90 of the Act, the Expert Committee handles complaints, may attempt mediation, may order rectification or prohibition, and may impose administrative fines directly, taking into account the seriousness of the conduct and the size of the business; unpaid fines are enforced under the administrative procedure law. HONEST LIMIT: we could not reach the regulator's own website during this run because it sits behind a bot challenge, so we could not count or quote individual enforcement decisions. The 'active' rating rests on institutional evidence, not on a verified decision list.

FLOOR. Computer-Related Crime Act B.E. 2550 (2007), section 26: a service provider must keep computer traffic data for at least ninety days from the date the data enters the computer system, and where necessary a competent official may order a particular provider to keep traffic data for longer than ninety days but not exceeding two years. Failure carries a fine of up to five hundred thousand baht (about 15,000 US dollars). 'Service provider' is defined broadly enough to catch businesses that merely provide internet access to others, which is why hotels, co-working spaces and offices with guest wi-fi get caught. CEILING. Personal Data Protection Act section 37(3): the controller must put in place an examination system to erase or destroy personal data when the retention period ends, when the data is no longer relevant or is beyond what the purpose requires, when the person asks, or when consent is withdrawn — with exceptions for freedom of expression, the public-interest and research grounds in sections 24(1), 24(4) and 26(5), for establishing, exercising or defending legal claims, and for compliance with law. Section 39 separately requires the record of processing activities to state the retention period for each category. NOT VERIFIED THIS RUN: the general commercial floors — five years of accounting records under the Accounting Act and five years of tax documents under the Revenue Code — are widely relied on in Thailand but we did not open a government copy of either during this run; see 'unconfirmed'.

Clock 1 — Personal Data Protection Act section 37(4): notify the Office without delay and where feasible within seventy-two hours of becoming aware, unless the breach is unlikely to result in a risk to the rights and freedoms of persons; where there is a high risk, also notify the data subject together with remedial measures without delay. The detail of the notification and its exceptions is set by Committee notification. Clock 2 — Cybersecurity Act B.E. 2562 (2019) section 57: on a significant cyber threat to a critical information infrastructure organisation's systems, that organisation must report to the Office of the National Cyber Security Committee and to its regulating or supervising body and must carry out the response measures; failing to report without reasonable cause is punishable by a fine of up to two hundred thousand baht (about 6,000 US dollars). Clock 3 — Emergency Decree on Measures for the Prevention and Suppression of Technological Crimes B.E. 2566 (2023) section 4, as amended in 2025: where there is reasonable suspicion of technological crime, financial institutions and business operators have a duty to disclose or exchange customer account and transaction data among themselves through a disclosure or exchange system operated under the Ministry of Digital Economy and Society. The three regimes have different triggers, different addressees and different deadlines, and an incident can start all three at once.

TRAP 1 — children. Section 20 of the Personal Data Protection Act: where the data subject is a minor who has not reached majority by marriage and is not treated as of age under section 27 of the Civil and Commercial Code, consent must also be obtained from the person with parental power unless the act is one the minor may consent to alone under sections 22, 23 or 24 of that Code; and where the minor is not over ten years old, consent must be obtained from the person with parental power. Majority in Thailand is twenty, so the practical population needing a parental check is far wider than the thirteen-or-sixteen thresholds most global products are built for. The same rule applies to withdrawal of consent, notices, rights requests and complaints. TRAP 2 — criminal, not just administrative. Section 79: unlawfully disclosing sensitive data, or transferring it abroad in breach of section 28, in a way likely to cause another person damage, loss of reputation, insult, hatred or humiliation, is punishable by up to six months' imprisonment or a fine of up to five hundred thousand baht (about 15,000 US dollars) or both; if done to obtain an unlawful benefit for oneself or another, up to one year's imprisonment or a fine of up to one million baht (about 30,000 US dollars) or both. The offence is compoundable, which changes how it is negotiated in practice. TRAP 3 — strict liability plus punitive damages. Section 77: the controller or processor must compensate a data subject for damage caused by breaching the Act 'whether the act was intentional or negligent or not', with only two defences — force majeure or the subject's own act, and acting on the lawful order of an official. Section 78: the court may award punitive damages on top of actual damages, up to twice the actual amount. The claim is time-barred three years after the injured person knows of the damage and of who is responsible. TRAP 4 — the in-country representative. Section 37(5) requires a foreign controller caught by section 5 paragraph two to appoint, in writing, a representative located in Thailand, authorised to act 'without any limitation of liability'. Section 38's exemptions are narrow: designated state agencies, and businesses that do not handle sensitive data and are not large-scale on criteria the Committee sets. This is not a mailbox function. TRAP 5 — who counts as a 'service provider' for logs. The 90-day traffic data duty in section 26 of the Computer-Related Crime Act attaches to providers of computer service to other persons, not only to telecoms carriers, and carries a fine of up to five hundred thousand baht. Hotels, landlords, clinics and offices with guest networks are routinely inside it. TRAP 6 — digital platforms are reached by look-and-feel. Under the Royal Decree on Digital Platform Services, a platform run entirely from abroad is deemed to serve users in Thailand if it merely displays in Thai, or uses a .th or .ไทย domain, or accepts payment in Thai baht, or names Thai law as the governing law. Prior notification to the Electronic Transactions Development Agency then bites at revenue above 1.8 million baht a year for an individual (about 55,000 US dollars) or 50 million baht for a company (about 1.5 million US dollars), or above 5,000 average monthly users.

LANDING IN THE NEXT TWELVE MONTHS. (1) Expansion of the Personal Data Protection Committee Office's regional PDPA Centers from five provinces to eight during 2026, covering all five regions, announced by the Deputy Minister on 17 August 2026 with the Office's Secretary-General present. (2) Implementation of the Cabinet resolution of 11 August 2026 on preventing personal data leakage arising from leaked authentication credentials, using multi-factor authentication, together with the Minister's stated plan to raise personal data protection and cyber-risk measures across all twenty ministries. DORMANT SWITCHES — powers already in hand that can change the picture with no consultation. (a) Section 28 read with section 16(5): the Committee sets the criteria for judging whether a destination country's protection is adequate, and decides contested cases. A single decision that a widely used destination is not adequate would invalidate transfers that rely on adequacy overnight; conversely the criteria could be relaxed the same way. (b) Section 26 of the Computer-Related Crime Act: a competent official may order any named service provider to keep traffic data for longer than ninety days, up to two years, case by case, with no rule-making needed. (c) The Royal Decree on Digital Platform Services lets the Electronic Transactions Commission and the Agency add named platforms to the heavier duty tiers by notification; notifications 4/2568, 6/2568 and 7/2568 have already been used to name marketplace platforms, and 2/2568 to name ride-hailing platforms, so the mechanism is live and in regular use. (d) The technological-crime regime is an emergency decree, which the executive can amend without going through Parliament first — it already was, in April 2025 — so bank and telecoms data-sharing duties can be widened quickly. (e) Sections 38 and 41 let the Committee define, by notification, which businesses are 'large scale' and therefore must appoint a data protection officer and a representative; moving that line moves thousands of companies in or out of scope. WE COULD NOT VERIFY: whether any bill amending the Personal Data Protection Act is before Parliament, and whether Thailand has taken any further step toward the Global Cross-Border Privacy Rules system. See 'unconfirmed'.