Thailand PDPA
Thailand PDPA Compliance Services for International Businesses
From your first PDPA assessment to ongoing DPO support, Formiti runs your Thai data protection programme. Our in-country team works alongside global privacy specialists. As a result, you meet Thai law without building a local team.
- In-country office in Thailand
- Thai and English
- 120+ jurisdictions
Why Thailand PDPA Compliance Matters
Thailand's Personal Data Protection Act B.E. 2562 (2019) has been fully in force since 1 June 2022. The Personal Data Protection Committee (PDPC) enforces it. Moreover, enforcement has started in earnest.
The PDPA also reaches beyond Thailand. Under Section 5, it covers foreign businesses that serve people in Thailand. It also covers those that monitor behaviour there.
Administrative fines
Up to THB 5 million per breach.
Criminal penalties
Up to one year in prison and/or a fine of up to THB 1 million for certain offences.
Civil damages
Courts can award punitive damages of up to twice the actual damages.
Read our guide: Thailand PDPA compliance for foreign companies
Our Thailand PDPA Compliance Services
Choose a one-off assessment, or let us run your programme as PDPA managed services.
PDPA gap assessment
We review your processing, notices, contracts and security against the PDPA. Then you receive a prioritised remediation plan.
Thailand data protection officer services (Section 41)
Some organisations must appoint a DPO. We provide one, backed by our privacy, legal and operations teams.
Cross-border data transfer from Thailand
Sections 28 and 29 restrict transfers abroad. We map your transfers and put the right safeguards in place.
Local representative (Section 37(5))
Foreign businesses without a Thai presence may need a local representative. See our Thailand PDPA representative service.
Thai-language notices and policies
We localise privacy notices, consent wording and internal policies into Thai.
Records of processing
We build and maintain your records of processing activities.
DSAR handling
We run data subject requests within the PDPA's 30-day deadline. This includes high-volume apps, retail, gaming and fintech.
Breach response
We help you notify the PDPC within 72 hours where required. In addition, we guide communications with affected people.
Annual audit and AI review
We audit your programme every year. We also review AI and automated decision-making.
How Our PDPA Assessment Service Works
Scoping call
We confirm which entities, systems and data the PDPA covers.
Discovery
We interview your teams and review documents, contracts and systems.
Gap report
You receive a clear report with risks rated high, medium or low.
Remediation
We fix the gaps with you. Then we can run your programme on an ongoing basis.
Thailand PDPA vs GDPR: Key Differences
The PDPA is closely modelled on the GDPR. However, several details differ.
| Topic | Thailand PDPA | EU GDPR |
|---|---|---|
| Regulator | Personal Data Protection Committee (PDPC) | National supervisory authorities |
| Extra-territorial reach | Section 5 | Article 3(2) |
| Local representative | Section 37(5) | Article 27 |
| DPO requirement | Section 41 | Article 37 |
| Breach notification to regulator | Within 72 hours | Within 72 hours |
| Data subject request deadline | 30 days | One month |
| Maximum administrative fine | THB 5 million | €20 million or 4% of turnover |
| Criminal penalties | Yes | No (left to member states) |
Summary for orientation only. Always confirm current requirements.
PDPA Compliance by Sector
International schools
Schools handle children's and parents' data every day. See our PDPA toolkit for schools.
Hotels and hospitality
Guest data, CCTV and booking platforms all fall under the PDPA. See our PDPA toolkit for hotels.
Apps, gaming and e-commerce
High user volumes mean high DSAR volumes. Therefore, you need a repeatable request process.
AI and technology
AI raises consent, transparency and automated decision questions. See Thailand AI regulation for business.
Why Choose Formiti as Your PDPA Compliance Partner
In-country presence
Our team is based in Nakhon Sawan, Thailand.
Global depth
Thai expertise backed by privacy specialists in the UK, Ireland and Switzerland.
One partner for all your markets
We also cover the EU, UK and Switzerland, plus 120+ jurisdictions.
Fixed monthly pricing
Clear fixed fees, with no hourly billing.
Start With a PDPA Assessment
Find out where you stand in Thailand. Book a free call to scope your assessment.
Frequently asked questions
Thailand PDPA Compliance FAQs
Does the Thailand PDPA apply to foreign companies?
Yes. Under Section 5, it covers businesses outside Thailand that serve people in Thailand. It also covers those that monitor behaviour there.
What does a PDPA compliance service include?
Typically a gap assessment, Thai-language notices, records of processing, DSAR handling and breach response. Where needed, it also includes a DPO or local representative.
Who can be our PDPA representative in Thailand if we are based outside the country?
A person or organisation in Thailand appointed in writing to act for you. Formiti acts as Section 37(5) representative through its Thai office.
Do we need a DPO under the Thailand PDPA?
Section 41 requires a DPO in some cases. Examples include large-scale regular monitoring and processing sensitive data as a core activity. Formiti can provide an outsourced DPO.
How long do we have to answer a data subject request in Thailand?
Generally 30 days from receipt of the request.
When must a breach be reported to the PDPC?
Within 72 hours of becoming aware of it, unless it is unlikely to risk people's rights and freedoms.
What are the penalties for breaching the PDPA?
Administrative fines reach THB 5 million. In addition, certain offences carry criminal penalties, and courts can award up to twice the actual damages.
How do we choose among the top PDPA compliance consultants in Thailand?
Look for in-country presence, Thai-language capability, DPO and representative services, and experience in your sector. Fixed fees also make budgeting easier.