Thailand PDPA Compliance
Overview
Thailand's Personal Data Protection Act B.E. 2562 (PDPA), published in the Royal Gazette on 27 May 2019, became fully effective on 1 June 2022 after two postponements from the original 2020 effective date. The PDPA applies to the collection, use, and disclosure of personal data by data controllers and data processors in Thailand, and extraterritorially where activities target data subjects in Thailand (Section 5).
The Personal Data Protection Committee (PDPC, คณะกรรมการคุ้มครองข้อมูลส่วนบุคคล) is the supervisory authority established under Section 8. The Office of the Personal Data Protection Committee (OPDPC) serves as the operational secretariat.
Lawful Bases for Processing (Section 24)
| Basis |
Section |
Detail |
| Consent |
Section 19 |
Explicit consent; freely given, specific, informed; written or electronic; may be withdrawn at any time |
| Contract performance |
Section 24(3) |
Necessary for performance of a contract to which the data subject is a party |
| Vital interests |
Section 24(4) |
Necessary to prevent or suppress danger to life, body, or health |
| Public task |
Section 24(4) |
Necessary for public interest tasks or exercise of official authority |
| Legitimate interest |
Section 24(5) |
Legitimate interests of the controller or third party, balanced against data subject's fundamental rights |
| Legal obligation |
Section 24(6) |
Compliance with a law to which the controller is subject |
| Archiving/research |
Section 24(1) |
Necessary for archiving, research, or statistics in the public interest with appropriate safeguards |
Sensitive Data (Section 26)
Sensitive data categories: racial or ethnic origin, political opinions, religious or philosophical beliefs, criminal records, trade union membership, genetic data, biometric data, health data, disability data, sexual orientation, and any other data prescribed by the PDPC.
Processing requires explicit consent unless:
- Necessary to prevent or suppress danger to life, body, or health (Section 26(1))
- Relating to lawful activities of non-profit organisations regarding members (Section 26(2))
- Personal data manifestly made public by the data subject (Section 26(3))
- Necessary for legal claims (Section 26(4))
- Necessary for compliance with employment law (Section 26(5))
Consent Framework
Consent Requirements (Section 19)
| Requirement |
Detail |
| Explicit |
Must be an express statement or conduct clearly indicating agreement |
| Freely given |
Must not be a condition of service where unnecessary; no bundling with T&Cs (Section 19(4)) |
| Specific |
Consent per purpose; blanket consent is invalid |
| Informed |
Full disclosure of purpose, data items, recipients, retention period |
| Written or electronic |
Written request for consent must be clear, not misleading, easily accessible |
| Withdrawal |
Data subject may withdraw at any time; withdrawal must be as easy as giving consent (Section 19(5)) |
| Children |
Under 10 years: consent from parent/legal guardian; 10 years and above: may consent if age-appropriate understanding demonstrated |
Implementation at Zenith Global Enterprises
| Processing Activity |
Consent Type |
Mechanism |
| Customer freight services |
Contract performance (Section 24(3)) — consent not required |
N/A |
| Marketing communications |
Explicit consent (Section 19) |
Opt-in checkbox in Thai and English |
| Employee health data processing |
Explicit consent for sensitive data (Section 26) |
Written consent form at onboarding |
| Cross-border transfer to EU HQ |
Explicit consent with transfer disclosure (Section 28) |
Dedicated transfer consent form |
DPO Requirements (Section 41-42)
When DPO Appointment is Required
The PDPC Notification on DPO Appointment Criteria (2022) requires a DPO when:
- The data controller or processor is a public authority (except courts acting in judicial capacity)
- Core activities require regular and systematic monitoring of data subjects on a large scale
- Core activities consist of processing sensitive data or criminal records on a large scale
DPO Responsibilities (Section 42)
| Responsibility |
Detail |
| Advise on compliance |
Advise the controller/processor on PDPA compliance obligations |
| Monitor compliance |
Monitor compliance with the PDPA and internal policies |
| Audit coordination |
Cooperate with the OPDPC; act as the contact point for the OPDPC |
| Confidentiality |
Maintain confidentiality of personal data accessed in the course of duties |
| Independence |
Must be able to perform duties independently; no dismissal for performing duties |
Zenith Global Enterprises DPO
| Element |
Detail |
| DPO (Thailand) |
Siriporn Chaiyaporn, Compliance Manager — Bangkok office |
| Contact |
dpo-thailand@zenithglobal.co.th |
| Reporting line |
Reports to Chief Privacy Officer; independent reporting access to Board of Directors |
Cross-Border Transfer (Section 28)
Transfer Conditions
Personal data may be transferred to a foreign country or international organisation only if:
| Condition |
Section |
Detail |
| Adequate protection |
Section 28(1) |
Destination has adequate personal data protection standards as determined by the PDPC |
| Compliance with group rules |
Section 28(3) |
Transfer within a group of undertakings conducting business together, with appropriate data protection policies inspected and certified by the OPDPC (BCR equivalent) |
| Contract necessity |
Section 28(4)(a) |
Necessary for contract performance with the data subject |
| Consent |
Section 28(4)(b) |
Data subject's consent after being informed of inadequate standards |
| Vital interests |
Section 28(4)(c) |
Necessary to prevent or suppress danger to life, body, or health |
| Legal obligation |
Section 28(4)(d) |
Necessary for important reasons of public interest |
| Legal claims |
Section 28(4)(e) |
Necessary for establishing, exercising, or defending legal claims |
| Appropriate safeguards |
Section 28(2) |
Appropriate protection measures prescribed by the PDPC are in place |
PDPC Adequacy Determinations
As of March 2026, the PDPC has not published a formal list of adequate countries. Transfers primarily rely on consent, contract necessity, or appropriate safeguards.
Data Subject Rights (Sections 30-36)
| Right |
Section |
Response Deadline |
Implementation |
| Right of access |
Section 30 |
Within 30 days |
Privacy portal in Thai and English |
| Right to data portability |
Section 31 |
Within 30 days |
Structured format (JSON/CSV) |
| Right to object |
Section 32 |
Without unreasonable delay |
Objection mechanism in customer portal |
| Right to erasure |
Section 33 |
Without unreasonable delay |
Automated deletion with legal hold check |
| Right to restriction |
Section 34 |
Without unreasonable delay |
Processing flagging system |
| Right to rectification |
Section 35 |
Without unreasonable delay |
Self-service correction in portal |
| Right to withdraw consent |
Section 19(5) |
Without unreasonable delay |
One-click withdrawal mechanism |
Breach Notification (Section 37(4))
| Element |
Requirement |
| OPDPC notification |
Within 72 hours of becoming aware of the breach |
| Data subject notification |
Without delay if the breach is likely to affect rights and freedoms |
| Content |
Nature of breach, DPO contact, likely consequences, remedial measures |
| Cross-border |
Notify the OPDPC even if the breach occurred outside Thailand if Thai data subjects are affected |
Enforcement (Sections 90-91)
Administrative Fines
- Up to THB 5 million (approximately USD 140,000) per violation
Criminal Penalties
- Imprisonment up to 1 year and/or fine up to THB 1 million for certain violations (Section 90)
- Apply to natural persons responsible for the violation
Punitive Damages
- Court may award punitive damages up to double the actual damages (Section 78)
Notable PDPC Actions
- The PDPC has issued multiple compliance guidance documents since 2022
- Enforcement focus initially on education and compliance guidance, transitioning to formal enforcement from 2024
- Sectoral guidance published for: financial services, telecommunications, healthcare, e-commerce
Compliance Programme
| Component |
Detail |
| DPO |
Siriporn Chaiyaporn, Bangkok office |
| Privacy notice |
Published at zenithglobal.co.th/privacy in Thai and English |
| Consent management |
Platform with Thai language support; separate consent per purpose |
| ROPA |
Processing activities register maintained per Section 39 |
| Breach notification |
72-hour workflow to OPDPC; data subject notification procedure |
| Cross-border safeguards |
Consent-based transfers with disclosure; intra-group policy for headquarters transfers |
| Employee training |
Annual PDPA training for all Thailand employees |
| Data subject rights |
30-day response workflow via privacy portal |
1---2name: thailand-pdpa3description: Guides compliance with Thailand's Personal Data Protection Act B.E. 2562 (2019). Covers consent framework, DPO requirements, PDPC enforcement, lawful bases for processing, cross-border transfer mechanisms, and data subject rights under the PDPA. Keywords: Thailand PDPA, PDPC, consent, DPO, cross-border transfers, data subject rights.4license: Apache-2.05---67# Thailand PDPA Compliance89## Overview1011Thailand's Personal Data Protection Act B.E. 2562 (PDPA), published in the Royal Gazette on 27 May 2019, became fully effective on 1 June 2022 after two postponements from the original 2020 effective date. The PDPA applies to the collection, use, and disclosure of personal data by data controllers and data processors in Thailand, and extraterritorially where activities target data subjects in Thailand (Section 5).1213The Personal Data Protection Committee (PDPC, คณะกรรมการคุ้มครองข้อมูลส่วนบุคคล) is the supervisory authority established under Section 8. The Office of the Personal Data Protection Committee (OPDPC) serves as the operational secretariat.1415## Lawful Bases for Processing (Section 24)1617| Basis | Section | Detail |18|-------|---------|--------|19| Consent | Section 19 | Explicit consent; freely given, specific, informed; written or electronic; may be withdrawn at any time |20| Contract performance | Section 24(3) | Necessary for performance of a contract to which the data subject is a party |21| Vital interests | Section 24(4) | Necessary to prevent or suppress danger to life, body, or health |22| Public task | Section 24(4) | Necessary for public interest tasks or exercise of official authority |23| Legitimate interest | Section 24(5) | Legitimate interests of the controller or third party, balanced against data subject's fundamental rights |24| Legal obligation | Section 24(6) | Compliance with a law to which the controller is subject |25| Archiving/research | Section 24(1) | Necessary for archiving, research, or statistics in the public interest with appropriate safeguards |2627### Sensitive Data (Section 26)2829Sensitive data categories: racial or ethnic origin, political opinions, religious or philosophical beliefs, criminal records, trade union membership, genetic data, biometric data, health data, disability data, sexual orientation, and any other data prescribed by the PDPC.3031Processing requires explicit consent unless:32- Necessary to prevent or suppress danger to life, body, or health (Section 26(1))33- Relating to lawful activities of non-profit organisations regarding members (Section 26(2))34- Personal data manifestly made public by the data subject (Section 26(3))35- Necessary for legal claims (Section 26(4))36- Necessary for compliance with employment law (Section 26(5))3738## Consent Framework3940### Consent Requirements (Section 19)4142| Requirement | Detail |43|-------------|--------|44| Explicit | Must be an express statement or conduct clearly indicating agreement |45| Freely given | Must not be a condition of service where unnecessary; no bundling with T&Cs (Section 19(4)) |46| Specific | Consent per purpose; blanket consent is invalid |47| Informed | Full disclosure of purpose, data items, recipients, retention period |48| Written or electronic | Written request for consent must be clear, not misleading, easily accessible |49| Withdrawal | Data subject may withdraw at any time; withdrawal must be as easy as giving consent (Section 19(5)) |50| Children | Under 10 years: consent from parent/legal guardian; 10 years and above: may consent if age-appropriate understanding demonstrated |5152### Implementation at Zenith Global Enterprises5354| Processing Activity | Consent Type | Mechanism |55|--------------------|-------------|-----------|56| Customer freight services | Contract performance (Section 24(3)) — consent not required | N/A |57| Marketing communications | Explicit consent (Section 19) | Opt-in checkbox in Thai and English |58| Employee health data processing | Explicit consent for sensitive data (Section 26) | Written consent form at onboarding |59| Cross-border transfer to EU HQ | Explicit consent with transfer disclosure (Section 28) | Dedicated transfer consent form |6061## DPO Requirements (Section 41-42)6263### When DPO Appointment is Required6465The PDPC Notification on DPO Appointment Criteria (2022) requires a DPO when:66- The data controller or processor is a public authority (except courts acting in judicial capacity)67- Core activities require regular and systematic monitoring of data subjects on a large scale68- Core activities consist of processing sensitive data or criminal records on a large scale6970### DPO Responsibilities (Section 42)7172| Responsibility | Detail |73|---------------|--------|74| Advise on compliance | Advise the controller/processor on PDPA compliance obligations |75| Monitor compliance | Monitor compliance with the PDPA and internal policies |76| Audit coordination | Cooperate with the OPDPC; act as the contact point for the OPDPC |77| Confidentiality | Maintain confidentiality of personal data accessed in the course of duties |78| Independence | Must be able to perform duties independently; no dismissal for performing duties |7980### Zenith Global Enterprises DPO8182| Element | Detail |83|---------|--------|84| DPO (Thailand) | Siriporn Chaiyaporn, Compliance Manager — Bangkok office |85| Contact | dpo-thailand@zenithglobal.co.th |86| Reporting line | Reports to Chief Privacy Officer; independent reporting access to Board of Directors |8788## Cross-Border Transfer (Section 28)8990### Transfer Conditions9192Personal data may be transferred to a foreign country or international organisation only if:9394| Condition | Section | Detail |95|-----------|---------|--------|96| Adequate protection | Section 28(1) | Destination has adequate personal data protection standards as determined by the PDPC |97| Compliance with group rules | Section 28(3) | Transfer within a group of undertakings conducting business together, with appropriate data protection policies inspected and certified by the OPDPC (BCR equivalent) |98| Contract necessity | Section 28(4)(a) | Necessary for contract performance with the data subject |99| Consent | Section 28(4)(b) | Data subject's consent after being informed of inadequate standards |100| Vital interests | Section 28(4)(c) | Necessary to prevent or suppress danger to life, body, or health |101| Legal obligation | Section 28(4)(d) | Necessary for important reasons of public interest |102| Legal claims | Section 28(4)(e) | Necessary for establishing, exercising, or defending legal claims |103| Appropriate safeguards | Section 28(2) | Appropriate protection measures prescribed by the PDPC are in place |104105### PDPC Adequacy Determinations106As of March 2026, the PDPC has not published a formal list of adequate countries. Transfers primarily rely on consent, contract necessity, or appropriate safeguards.107108## Data Subject Rights (Sections 30-36)109110| Right | Section | Response Deadline | Implementation |111|-------|---------|-------------------|----------------|112| Right of access | Section 30 | Within 30 days | Privacy portal in Thai and English |113| Right to data portability | Section 31 | Within 30 days | Structured format (JSON/CSV) |114| Right to object | Section 32 | Without unreasonable delay | Objection mechanism in customer portal |115| Right to erasure | Section 33 | Without unreasonable delay | Automated deletion with legal hold check |116| Right to restriction | Section 34 | Without unreasonable delay | Processing flagging system |117| Right to rectification | Section 35 | Without unreasonable delay | Self-service correction in portal |118| Right to withdraw consent | Section 19(5) | Without unreasonable delay | One-click withdrawal mechanism |119120## Breach Notification (Section 37(4))121122| Element | Requirement |123|---------|-------------|124| OPDPC notification | Within 72 hours of becoming aware of the breach |125| Data subject notification | Without delay if the breach is likely to affect rights and freedoms |126| Content | Nature of breach, DPO contact, likely consequences, remedial measures |127| Cross-border | Notify the OPDPC even if the breach occurred outside Thailand if Thai data subjects are affected |128129## Enforcement (Sections 90-91)130131### Administrative Fines132- Up to THB 5 million (approximately USD 140,000) per violation133134### Criminal Penalties135- Imprisonment up to 1 year and/or fine up to THB 1 million for certain violations (Section 90)136- Apply to natural persons responsible for the violation137138### Punitive Damages139- Court may award punitive damages up to double the actual damages (Section 78)140141### Notable PDPC Actions142- The PDPC has issued multiple compliance guidance documents since 2022143- Enforcement focus initially on education and compliance guidance, transitioning to formal enforcement from 2024144- Sectoral guidance published for: financial services, telecommunications, healthcare, e-commerce145146## Compliance Programme147148| Component | Detail |149|-----------|--------|150| DPO | Siriporn Chaiyaporn, Bangkok office |151| Privacy notice | Published at zenithglobal.co.th/privacy in Thai and English |152| Consent management | Platform with Thai language support; separate consent per purpose |153| ROPA | Processing activities register maintained per Section 39 |154| Breach notification | 72-hour workflow to OPDPC; data subject notification procedure |155| Cross-border safeguards | Consent-based transfers with disclosure; intra-group policy for headquarters transfers |156| Employee training | Annual PDPA training for all Thailand employees |157| Data subject rights | 30-day response workflow via privacy portal |
mukul975