Thailand's Personal Data Protection Act B.E. 2562 (2019) makes security failures expensive: the regulator has now fined controllers and their processors for weak passwords, missing data processing agreements, absent data protection officers and late breach reports. The Act has been fully enforceable since June 2022, and the Personal Data Protection Committee (PDPC) has filled in the detail through binding notifications on security measures, breach notification, DPO appointment and cross-border transfers. This guide covers scope, the obligations that land on security and engineering teams, the notification timeline, the enforcement record to date, and what the Act means for AI agents and machine credentials. It is written for security, privacy and platform leads at organisations that process personal data of people in Thailand, including foreign companies that sell to or monitor them.
Key takeaways
- Section 37 carries the security and breach duties: controllers must provide appropriate security measures and notify the PDPC Office of a breach within 72 hours of becoming aware of it where feasible, unless the breach is unlikely to risk individuals' rights and freedoms.
- The 72-hour clock has a fallback: the PDPC clarified in 2025 that if the deadline is missed, notice must still be given as soon as possible and no later than 15 days after awareness, with reasons for the delay.
- Processors are fined too: section 40 binds processors to security and breach duties, and in 2025 a processor received a THB 3 million fine, six times its controller's, for failing to notify and contain a breach.
- A DPO is required at 100,000 data subjects: the 2023 DPO notification treats processing of 100,000 or more data subjects in a core activity as large scale, and the first major fine cited a missing DPO.
- The PDPC has issued AI guidance: its October 2026 guidelines, advisory rather than binding, bring agentic AI into scope and recommend limiting the permissions granted to AI agents.
Scope: who and what is covered
The PDPA applies to controllers and processors in Thailand, whether or not the processing takes place in Thailand. Under section 5 it also reaches controllers and processors outside Thailand that process personal data of data subjects in Thailand when they offer goods or services to those people, whether or not payment is made, or monitor their behaviour taking place in Thailand. A foreign controller caught by section 5(2) must designate a representative in Thailand (section 37(5)).
| Element | PDPA position | Section |
|---|---|---|
| Data controller | Person or juristic person with authority to make decisions on collection, use or disclosure | s6 |
| Data processor | Processes on the controller's orders or on its behalf, under a written agreement | s6, s40 |
| Sensitive data | Racial or ethnic origin, political opinions, beliefs, sexual behaviour, criminal records, health, disability, trade union membership, genetic and biometric data | s26 |
| Extraterritorial reach | Offering goods or services to, or monitoring the behaviour of, people in Thailand | s5 |
| Main exemptions | Personal or household use, national security bodies, certain mass media, fine arts and literature, Parliament, courts, credit bureau operations | s4 |
Lawful bases: consent under section 19 must be explicit, in writing or electronic form, as easy to withdraw as to give, and not a condition of a contract where it is unnecessary. Section 24 lists the alternatives (research and statistics with safeguards, vital interests, contract, public task, legitimate interests, legal obligation). A draft amendment bill opened for consultation from 16 July to 15 August 2026 would recast section 24 as seven coequal bases closer to the GDPR model; it had not been enacted at the time of writing.
Key obligations
Controller and processor duties
| Duty | Who | Source | What it means for security teams |
|---|---|---|---|
| Appropriate security measures | Controller | s37(1); Security Measures Notification B.E. 2565 | Organisational and technical measures, plus physical where necessary, proportionate to risk, protecting confidentiality, integrity and availability |
| Prevent unauthorised use by recipients | Controller | s37(2) | Contractual and technical controls on anyone you disclose data to |
| Erasure and retention system | Controller | s37(3) | A working process to delete or destroy data after the retention period or on request |
| Breach notification | Controller | s37(4); Breach Notification of 15 Dec 2022 | PDPC Office within 72 hours; data subjects without undue delay where risk is high |
| Records of processing | Controller and processor | s39, s40(3) | Includes the security measures applied; small businesses are partly exempt |
| Act only on instructions, secure and notify | Processor | s40 | Processor must keep security measures and notify the controller of breaches |
| Data protection officer | Controller and processor | s41-42; DPO Notification 2023 | DPO involved in incident response and the contact point for the PDPC Office |
The Security Measures Notification
The Notification of the PDPC Re: Security Measures of the Data Controller B.E. 2565 (2022) was published on 20 June 2022 and took effect on 21 June 2022, replacing the earlier Ministry of Digital Economy and Society security standard. It applies to personal data in any form and, for electronic data, to servers, clients, storage systems and devices, and software. The measures listed include:
- Access control: limit access to personal data and to the systems that hold it.
- User access management: authorise access by role and need, and remove it when no longer needed.
- User responsibilities: make users accountable for preventing unauthorised access, disclosure and copying.
- Audit trails: be able to trace who accessed, changed, deleted or disclosed personal data.
- Awareness: build privacy and security awareness among personnel and users.
- Review: review measures when necessary, when technology changes or after a breach.
- Processor requirements: set security requirements for data processors.
The Notification is principle based rather than a control catalogue, so organisations usually map it to an existing framework. See the GDPR Compliance Guide for a comparable risk-based approach.
Data subject rights
Sections 30 to 34 give rights of access and copy, data portability (section 31), objection, erasure or anonymisation, and restriction. Engineering teams need export and deletion paths that cover backups, logs and analytics stores.
Cross-border transfers
Section 28 permits transfers to a destination with adequate protection standards, with exceptions such as legal compliance and contract performance. Section 29 allows transfers under intra-group policies reviewed and certified by the PDPC Office, or under appropriate safeguards. Two PDPC notifications issued on 25 December 2023 and effective on 24 March 2024 set the detail: adequacy is judged on the destination's laws and on the existence of an enforcing authority, and safeguards can take the form of binding corporate rules, standard contractual clauses (a Thai model and an overseas model are accepted), certification, or binding agreements between state agencies. See the International Data Transfers Map and the Standard Contractual Clauses (SCCs) Guide.
Data protection officers
Section 41 requires a DPO where the controller or processor is a public authority, where core activities require regular monitoring of personal data on a large scale, or where the core activity is processing sensitive data. The DPO notification, gazetted on 14 September 2023 and effective on 13 December 2023, sets large scale at 100,000 or more data subjects, alongside factors such as data volume, duration and geographic scope. Only core activities count: supporting functions such as HR and IT do not trigger the duty on their own. Regular monitoring covers tracking, analysing or predicting behaviour, for example credit scoring, fraud prevention and behavioural advertising. Section 42 protects the DPO from dismissal for performing the role.
Timeline and current status
| Date | Event | Status |
|---|---|---|
| 27 May 2019 | PDPA published in the Government Gazette | In force; main duties postponed |
| 1 June 2022 | Full enforcement after postponement to 31 May 2022 | In force |
| 20 to 21 June 2022 | First subordinate notifications: security measures, ROPA exemption for small businesses, administrative penalties | In force |
| 15 December 2022 | Breach Notification and non-binding breach assessment guidelines | In force |
| 13 December 2023 | DPO appointment notification effective | In force |
| 24 March 2024 | Cross-border transfer notifications under sections 28 and 29 effective | In force |
| 21 August 2024 | First major administrative fine, THB 7 million | Decided |
| February 2025 | PDPC clarification on the 72-hour clock and the 15-day fallback | Guidance |
| 1 August 2025 | Eight fines across five cases announced | Decided |
| July to August 2026 | Draft PDPA amendment bill in public consultation | Draft, not enacted |
| October 2026 | PDPA Guidelines on Personal Data Protection in the Development and Use of AI | Advisory |
Breach notification in practice
- Verify: the Breach Notification expects the controller to check the credibility of the report, investigate the facts, review its own and its processors' security measures, and decide whether there are reasonable grounds to believe a breach occurred. The PDPC says the clock starts at that point, judged case by case: a misdirected email is evident immediately, a cyberattack may take longer to confirm.
- Assess risk: weigh the nature of the breach, the type and volume of data, the status of data subjects (minors, vulnerable people), severity and the effect of mitigations, wider business or public impact, the storage system and its security, and the controller's legal status.
- Notify the PDPC Office: within 72 hours, giving the nature of the breach, types and volume of records, DPO contact details, likely impact and remedial actions. Phased notification is accepted. If the 72 hours are missed, notify no later than 15 days after awareness and explain why.
- Notify data subjects: without undue delay where the risk is high, individually or by public notice where individual notice is not feasible.
- Record: keep the assessment even when you conclude there is no risk; the PDPC may ask for it in a complaint or inspection. An encrypted, lost USB drive is the PDPC's example of a no-risk breach.
See the Breach Notification Laws by Country Guide for how Thailand's clock compares with other jurisdictions. For comparable regimes, see the Philippines Data Privacy Act Guide and the Turkey KVKK Guide.
Enforcement and penalties
| Liability | Maximum | Section |
|---|---|---|
| Administrative fine, lower tier | THB 1 million | ss82, 85, 88 |
| Administrative fine, middle tier | THB 3 million | ss83, 86 |
| Administrative fine, upper tier (includes sensitive data violations) | THB 5 million | ss84, 87 |
| Failure to follow Expert Committee orders or information requests | THB 500,000 | s89 |
| Criminal offences involving sensitive data | 6 months and/or THB 500,000; 1 year and/or THB 1 million where for unlawful gain | s79 |
| Civil damages | Actual damages, plus punitive damages up to twice the actual compensation | ss77-78 |
Fines for separate violations can be combined, which is how the August 2024 decision reached THB 7 million. Published cases show what the Expert Committee looks for:
- August 2024, online IT retailer, THB 7 million: no DPO despite more than 100,000 customers, inadequate security that let data reach call-centre fraud gangs, and delayed breach reporting. The company was also ordered to improve security and training and report back within 7 days.
- August 2025, government agency and its software developer, about THB 153,000 each: a cyberattack exposed data of about 200,000 people; findings included weak passwords and password management, no risk assessment, no access control or privacy by design at the developer, and no data processing agreement.
- August 2025, toy company THB 500,000 and its processor THB 3 million: an online reservation system breach affecting about 200,000 records; the processor did not notify the controller or contain the incident promptly.
- August 2025, private hospital about THB 1.2 million: patient records mishandled by a destruction contractor, inadequate supervision and the breach not reported.
Total fines since enforcement began were reported as exceeding THB 21 million by October 2025.
What it means for AI agents and non-human identities
The enforcement record is mostly about access: weak passwords, missing access control and processors with uncontrolled reach into personal data. Service accounts, API keys and AI agents are where that access now concentrates, and the Security Measures Notification's requirements on access control, user access management and audit trails apply to them just as they apply to staff.
- Agents are in scope of PDPC guidance: the October 2026 AI guidelines cover analytic, generative and agentic AI across the lifecycle, recommend least-privilege access, guardrails, masking, encryption, logging and limits on agent permissions, and say prompts, usage logs, embeddings and identifying outputs may be personal data. See the AI Agent Authorisation Guide.
- DPIAs before high-risk AI: the guidelines expect an impact assessment before automated decisions with significant effects, large-scale sensitive or children's data, and profiling. See the DPIA Guide.
- Roles follow decisions: a provider fine-tuning a model on the client's instructions is a processor; one that trains its own models on client data becomes a controller for that use. Map this before signing the section 40 agreement.
- Machine credentials are the audit trail: shared service accounts make it impossible to show who accessed records. Give each workload and agent its own identity, scope it to the data it needs, and log its access. See the Service Account Security Guide.
- Processor access is the weak link: inventory the API keys and accounts processors hold in your systems, and revoke them at contract end.
Compliance steps
Framework mapping
| PDPA requirement | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|
| Legal obligations understood (s5, s37) | GV.OC-03 | PT-2, PT-3 | A.5.31, A.5.34 |
| Access control and user access management | PR.AA-05 | AC-6, IA-5 | A.5.15, A.5.18, A.8.2 |
| Audit trails | PR.DS-01 | AU-2 | A.8.15 |
| Breach notification (s37(4)) | RS.CO-02, RS.CO-03 | IR-6 | A.5.24, A.5.26 |
| Processor agreements (s40) | GV.SC-05 | SA-9, SR-3 | A.5.19, A.5.20 |
| Records and retention (s37(3), s39) | ID.AM-07 | SI-12 | A.5.33, A.8.10 |
| AI DPIAs (PDPC AI guidelines) | GV.OC-03 | RA-8 | A.5.34 |
Phased rollout
- Scope (weeks 1 to 4): confirm whether section 5(2) applies, appoint a Thai representative if needed, build the records of processing, and test DPO triggers against the 100,000 data subject threshold and your core activities.
- Close the access gaps (months 1 to 3): enforce MFA and password policy on every system holding personal data, remove shared accounts, inventory service accounts, API keys and agent identities, and switch on audit logging for read access to personal data stores.
- Contracts (months 2 to 4): put section 40 terms into every processor agreement, including a contractual 72-hour breach notice to you, security requirements, and credential return at exit. Choose the transfer mechanism for each foreign recipient.
- Breach readiness (month 3): write the verify, assess, notify and record steps into the incident response plan, pre-draft the PDPC notice fields, and run a tabletop that includes a processor-caused breach. See the Incident Response Plan Template.
- AI and ongoing review (month 4 onwards): run DPIAs on high-risk AI use, cap agent permissions, and review security measures after every incident or significant technology change, as the Notification requires. Keep the previous control set documented so a failed change can be rolled back while the review is completed.
Decision guidance
- Small organisations: SMEs and similar bodies are exempt from most of the ROPA duty unless processing is regular or risky, but not from security, breach notification or the record of rejected rights requests. An outsourced DPO is a common choice where the threshold is met.
- Large or multinational groups: binding corporate rules under section 29 suit regular intra-group flows; standard contractual clauses suit vendor transfers. Align the Thai 72-hour process with GDPR so one team runs both.
Detection and measurement
- Median time from incident detection to the PDPC breach decision, against the 72-hour target.
- Percentage of processors with a signed section 40 agreement that includes a breach notice deadline.
- Percentage of systems holding personal data with read-access audit logging enabled.
- Number of shared or ownerless service accounts and API keys with access to personal data, trending to zero.
- Data subject rights requests completed within your internal deadline, including portability exports.
- Percentage of high-risk AI deployments with a completed DPIA.
Common failure patterns
- No DPO where one is due: the THB 7 million case shows the Expert Committee treats a missing DPO as aggravating, not as a paperwork gap.
- Processors with no agreement: the 2025 government agency case fined both the agency and its developer because there was no data processing agreement.
- Processors that stay silent: a processor that does not notify its controller can be fined more heavily than the controller.
- Weak credentials: poor password management features in several decisions; it is the cheapest finding to avoid.
- Destruction left unsupervised: the hospital case shows that paper and media disposal by contractors is part of the security duty. See the Data Retention and Secure Deletion Guide.
- No record of no-risk decisions: deciding not to notify without keeping the assessment leaves no defence in an inspection.
Practitioner checklist
- Confirm whether section 5(2) applies and, if so, appoint a representative in Thailand.
- Test DPO triggers against the 100,000 data subject threshold and appoint or outsource a DPO.
- Map the Security Measures Notification to your control framework and close access control and audit trail gaps.
- Give every service account, API key and AI agent an owner, a scope and logged access.
- Put section 40 terms, including a 72-hour notice to you, into every processor agreement.
- Document the verify, assess, notify and record steps, with the 72-hour and 15-day deadlines.
- Keep risk assessments for breaches you decide not to report.
- Assign a transfer mechanism to every cross-border recipient.
- Run a DPIA before high-risk AI use and cap agent permissions.
- Track the draft PDPA amendment bill and new PDPC notifications.
Standards and references
- Personal Data Protection Act B.E. 2562 (2019), unofficial English translation
- Conventus Law: First set of subordinate regulations enacted for Thailand's PDPA (Security Measures Notification B.E. 2565)
- Tilleke and Gibbins: Thailand PDPC Notification on Data Breaches
- DLA Piper: Thailand PDPC's clarification on personal data breach notification
- Tilleke and Gibbins: Thailand releases notification on data protection officer appointment
- Tilleke and Gibbins: Thailand unveils regulations for cross-border personal data transfer
- Tilleke and Gibbins: Eight serious fines imposed in Thai data protection cases
- Tilleke and Gibbins: Thailand issues personal data protection guidelines for AI systems
This guide summarises Thailand's Personal Data Protection Act B.E. 2562 (2019) and the PDPC's notifications and guidance as of October 2026 and is not legal advice. Related NHI Mgmt Group resources: Global Privacy Regulatory Map · Malaysia PDPA Guide · International Data Transfers Map · Breach Notification Laws by Country Guide