Thailand. Comprehensive data protection. Act
PDPA (Thailand)Personal Data Protection Act B.E. 2562 (2019)
In force
§1Summary
- Synopsis
Thailand's GDPR-inspired law covering lawful bases, rights, DPOs, breach notification, records of processing and transfers. It applies extraterritorially to offshore controllers targeting or monitoring people in Thailand.
- Key themes
- Unique features
Criminal penalties and punitive damages of up to twice actual damages alongside administrative fines.
- SaaS relevance
Offshore SaaS offering services to or monitoring people in Thailand must comply and appoint a local representative.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- Regulator without undue delay, within 72h where feasible; individuals if high risk
- DPO
- Conditional
- Cross-border transfers
- Adequacy, appropriate safeguards (SCCs/BCRs) or exemptions
- Maximum penalty
- Administrative THB 5m; criminal up to 1 year/THB 1m; punitive damages 2x
§3Dates
- Key dates
- Adopted
- In force
- Published 2019-05-27/28; enforcement postponed twice; fully effective 2022-06-01; PDPC established Jan 2022
§4Text and authority
- Text
- Authoritative text ratchakitcha.soc.go.th
- English text cc.kmutt.ac.th
- Authority
- Personal Data Protection Committee / Office of the PDPC (PDPC)
§5Where it applies
- Domestic law of
- Thailand
§6Sources and verification
- Verification
High confidence.
Criminal penalty figures from general knowledge. [Link: official Thai Royal Gazette vol.136 pt.69A (site blocks bots, not directly verified); English = unofficial translation hosted by KMUTT (public university); pdpc.or.th unreachable]