Reviewed by ThaiLawOnline, a licensed Thai law firm practising in Thailand since 2006. Thai lawyer of record: Wichuda Atthamethakon, LL.M., Thai Bar Licence 3149/2556.
Last updated on
The PDPA (พระราชบัญญัติคุ้มครองข้อมูลส่วนบุคคล พ.ศ. 2562, the Personal Data Protection Act B.E. 2562 (2019), sometimes written Thai PDPA or Thailand PDPA) is Thailand’s general data protection law, modelled on the European GDPR and fully in force since 1 June 2022. It regulates anyone who collects, uses or discloses information about an identifiable living person, requires a lawful basis for doing so, gives the individual rights over the data, and backs those rules with fines, damages and, for sensitive data, prison. A foreigner meets it as a business owner, an employer, a landlord and as the person whose passport is being photocopied.
Table of Contents
What the Act requires of a data controller
Scope. The Act binds a data controller (who decides why and how data is used) and a data processor (who handles it on the controller’s instructions) established in Thailand, and by Section 5 also those abroad who offer goods or services to people in Thailand or monitor their behaviour. Purely personal or household use is outside it.
Lawful basis and sensitive data. Personal data may be collected only with consent or on another basis the Act lists: performance of a contract, a legal obligation, vital interests, a public task or the controller’s legitimate interests. Section 26 treats data on race, ethnicity, political opinion, religion, sexual behaviour, criminal record, health, disability, trade union membership, genetic and biometric data as sensitive, needing explicit consent unless a narrow exception applies. Controllers must tell people what is collected and why, keep it secure, notify the regulator of a breach within 72 hours, and honour requests to access, correct, delete or port the data.
Where a foreigner meets the PDPA in practice
Running a business. A Thai company with customers, staff or a website needs a privacy notice, consent wording for marketing, a record of processing (small businesses are partly exempt), contracts with processors such as payroll providers, and a data protection officer if it monitors people on a large scale or handles sensitive data as a core activity. Under Section 28, transfers abroad, including to a foreign head office, need a destination with adequate protection unless an exception applies, such as consent, performance of a contract or a legal obligation; Section 29 also allows transfers under certified binding corporate rules or other appropriate safeguards.
As a landlord, host or condominium. Copying a tenant’s passport to file a TM30 rests on a legal obligation and needs no consent, but keeping the copy for years, or a condominium juristic person sharing CCTV footage or resident lists, does not. The regulator is the Personal Data Protection Committee under the Ministry of Digital Economy and Society.
Penalties and how the PDPA differs from other laws
Administrative fines are imposed in three tiers of up to 1,000,000, 3,000,000 and 5,000,000 baht, the highest for breaches involving sensitive data (Sections 82 to 84). Civil claims by the person affected allow the court to award punitive damages of up to twice the actual damage. Criminal liability under Section 79 attaches to unlawful use or disclosure of sensitive data: up to 6 months’ imprisonment, a fine of up to 500,000 baht, or both, where it is likely to cause damage or humiliation, and up to 1 year, 1,000,000 baht, or both, where it is done for unlawful gain; the offence is compoundable. Where a company commits an offence, a director, manager or other responsible person is liable only if it resulted from that person’s order or act, or from a failure to order or act where they had a duty to do so (Section 81); there is no presumption against a director.
The PDPA is not the Computer Crime Act, which punishes hacking and false content online, and it is not defamation, which concerns reputation. A leaked customer list is a PDPA matter; a false post about a customer is defamation; breaking into the database is computer crime.
Last reviewed: 29 September 2026. Personal Data Protection Act B.E. 2562 sections 5, 37, 78, 79, 81 and 82 to 84 were read in Thai. The lawful-basis list, the sensitive-data list, the record-of-processing relief and the TM30 example are stated as commonly described and were not re-read section by section in this review.
Frequently asked questions
Does the PDPA apply to a small business or a foreign company in Thailand?
Yes to both. Any business in Thailand that holds personal data about customers or staff is a data controller, and Section 5 extends the Act to foreign companies that sell to or monitor people in Thailand. Small businesses get limited relief, mainly from the duty to keep a record of processing, not from the Act itself.
What are the penalties under the Thai PDPA?
Administrative fines of up to 5,000,000 baht per breach, civil damages including punitive damages of up to twice the actual loss, and for unlawful use or disclosure of sensitive data up to 6 months and 500,000 baht, or up to 1 year and 1,000,000 baht where it is done for unlawful gain. A director is personally liable for a company’s offence only where it resulted from the director’s own order, act or failure to act.
Can a landlord in Thailand keep a copy of my passport under the PDPA?
The landlord may copy the passport to meet legal obligations such as the TM30 notification and to perform the lease, without separate consent. Keeping it beyond that purpose, sharing it or using it for anything else needs a lawful basis, and the tenant can ask what is held and request its deletion once the purpose has ended.
See also: Computer Crime Act, Defamation, TM30, Director, corporate criminal liability in Thailand and business law in Thailand.
Thai Law Updates, free by email
Plain-English updates on Thai law changes that affect foreigners: property, visas, marriage, business and wills. One short email a month from a firm practicing since 2006. No spam, unsubscribe anytime.