Thailand PDPA Compliance: A Guide for Businesses

1. Consent Requirements

General Consent

• Specific consent is required from the data subject prior to or at the time of collection, use, or disclosure

• Consent must be in writing or via electronic means

• Data subjects may withdraw consent at any time

• Consent withdrawal must be as easy as giving consent

Consent for Sensitive Personal Data

• Explicit consent is required for Sensitive Personal Data

• Exceptions apply where:

  • Preventing or suppressing danger to life, body, or health

  • The data subject is incapable of giving consent

Consent for Direct Marketing

• Separate, explicit consent required for direct marketing activities

• Data subjects have the right to object to direct marketing at any time

• Organizations must provide an easy opt-out mechanism

Consent Withdrawal Method

• Data controllers must publicize a consent withdrawal method

• Data subjects must be notified of their right to withdraw consent

• This applies to personal data collected before June 1, 2022

2. Collection of Personal Data

Lawful Purpose

• Collection must be for a lawful purpose

• Must be directly relevant and necessary for the activities of the data controller

Notification Requirements

Data controllers must inform data subjects prior to or at the time of collection of:

1. The purpose of collection, use, or disclosure

2. Whether data supply is mandatory or voluntary (and consequences if not provided)

3. The personal data to be collected

4. The retention period (or criteria for determining it)

5. Categories of persons/entities to whom data may be disclosed

6. Contact details of the data controller and DPO (if applicable)

7. The rights of the data subject under the PDPA

Direct Collection

• Personal data must typically be collected directly from the data subject

• Exceptions apply under limited circumstances

Sensitive Personal Data

• Collection is prohibited without explicit consent

• Exceptions are strictly limited (e.g., life-saving situations)

3. Rights of Data Subjects

The PDPA grants data subjects comprehensive rights:

Note on Data Portability

• Data subjects can request personal data in machine-readable formats

• Can request data controllers to send data to another data controller

• Right to data portability is similar to GDPR Article 20

Right to Be Informed

• Data subjects have the right to be informed about:

  • What data is being collected

  • Why it is being collected

  • The retention period

  • Who it will be shared with

  • Their rights under the PDPA

4. Cross-Border Data Transfers

Adequacy Requirement

• Personal data may only be transferred to a destination country or international organization with adequate data protection standards

• Standards are prescribed by the PDPC

Exceptions (Transfer Permitted Without Adequacy)

1. Transfer is made pursuant to applicable laws

2. Consent is obtained from data subjects (informed of inadequate protection measures)

3. Transfer is necessary for performance of a contract

4. Transfer is necessary for compliance with a contract between data controllers for data subject interests

5. Transfer is to prevent/suppress danger to life, body, or health (data subject incapable of giving consent)

6. Transfer is necessary for substantial public interest

Mechanisms for Compliant Cross-Border Transfers

• Binding Corporate Rules (BCRs): For intra-group transfers

• Standard Contractual Clauses (SCCs): For transfers to third parties

• Adequacy Decisions: Where PDPC deems a country has adequate protection

5. Data Protection Officer (DPO) Appointment

A DPO must be appointed in the following cases:

DPO Responsibilities

1. Advising on PDPA compliance

2. Investigating compliance with the PDPA

3. Coordinating with regulatory authorities

4. Maintaining confidentiality regarding acquired personal data

5. Acting as a contact person for data subjects

Penalties for Non-Appointment

• Administrative fine not exceeding THB 1 million

6. Security Requirements

Data controllers must implement appropriate security measures to protect personal data from unauthorized access, use, disclosure, alteration, or destruction.

Security Measures Should Include:

• Organizational Measures: Policies, procedures, training

• Technical Measures: Encryption, access controls, monitoring

• Physical Measures: Secure facilities, access restrictions

Acceptable Security Frameworks

• Thailand’s Ministry of Digital Economy and Society accepts ISO 27001 as sufficient evidence of compliance with minimum security standards

• Other industry-specific frameworks may also be acceptable

Security Risk Assessments

• Required when technology changes

• When necessary to maintain suitable security and safety requirements

7. Data Breach Notification

Notification Timeline

• Data controllers must notify the PDPC of a data breach within 72 hours of becoming aware

• Notification must be made without delay if the breach is likely to result in a risk to the rights and freedoms of data subjects

Breach Notification Requirements

1. Nature of the incident

2. Contact details of the contact person or DPO

3. Possible consequences

4. Measures taken or to be taken to mitigate adverse effects

Notification to Data Subjects

• If a breach is likely to result in critical threats to rights and freedoms:

  • Notify the PDPC and data subjects without delay

• For breaches involving several data subjects:

  • Notify each subject specifically, or

  • Notify the public via media, social media, or other accessible means

Notification from Data Processors

• Data processors must notify the data controller without undue delay upon discovering a breach

Case Example: August 2024

A major private company received Thailand’s first PDPA administrative fine:

• Amount: THB 7 million (maximum fine)

• Reasons:

  • Failure to appoint a DPO (THB 1 million)

  • Inadequate security measures (Section 37(1))

  • Failure to report data breaches (Section 37(4))

• Remedial Actions Ordered:

  • Enhance security measures

  • Train staff

  • Report improvements to PDPC within 7 days

8. Record of Processing Activities (RoPA)

General Requirement

• Data controllers and data processors must keep full records of personal data processing activities

• Ensures preparedness for inspection by or submission to the PDPC

SME Exemption

• Small and Medium-Sized Enterprises (SMEs) are exempt from RoPA requirements

• Definition: Organizations qualifying under the Small and Medium-Sized Enterprise Promotions Act

• Exception: Some SMEs must still prepare RoPA if their data processing poses a risk to data subject rights and freedoms

9. Vendor Privacy Contracts

Contractual Requirements

• Data controllers and data processors must enter into contractual agreements

• Contracts must require both parties to comply with all PDPA requirements

Types of Agreements:

• Data Processing Agreement (DPA): When vendors act as data processors

• Data Sharing/Transfer Agreement: When vendors act as data controllers

Key Contractual Elements:

• Clear definition of roles (controller vs. processor)

• Security measures to be implemented

• Breach notification procedures

• Sub-processing restrictions

• Data deletion requirements

10. Grandfathering Provisions

Personal Data Collected Before June 1, 2022

Data controllers may continue to use personal data collected before the PDPA came into force, provided:

1. Same Purpose: Data is only used for the same purpose for which it was originally collected

2. Consent Withdrawal Method: The data controller prepares and publicizes a consent withdrawal method

3. Notice: Data subjects are notified of their right to withdraw consent

Expanded Processing

• If data is used or disclosed beyond the original purpose:

  • New explicit consent is required for each separate purpose

Banking, Financial Services & Insurance (BFSI)

BFSI organizations handle highly sensitive financial data and are prime targets for cyberattacks. The PDPA imposes strict requirements for consent, security, and breach notification.

How LOGON Can Help:

• Application Security Testing: Comprehensive web and mobile application penetration testing to identify vulnerabilities before they are exploited
• Data Loss Prevention (DLP): Preventing unauthorized disclosure of sensitive financial and customer data
• Identity & Access Management (IAM): Implementing IAM solutions with least privilege access and multi-factor authentication
• Security Monitoring & SOC: 24/7 monitoring to detect and respond to threats
• Data Classification: Automatically discovering and classifying sensitive personal data
• Vendor Risk Management: Ensuring third-party processors meet PDPA security standards

Healthcare & Pharmaceuticals

Healthcare data qualifies as Sensitive Personal Data under the PDPA, requiring explicit consent and enhanced security measures. Data breaches in healthcare can result in severe harm to patients.

How LOGON Can Help:

• Data Discovery & Classification: Identifying and securing sensitive health data across IT environments
• Encryption: Implementing strong encryption for data at rest and in transit
• Secure Data Sharing: Platforms for sharing medical data between healthcare providers while maintaining compliance
• Incident Response: Breach response frameworks to ensure timely notification within 72 hours
• ISO 27001 Compliance: Supporting certification to demonstrate compliance with PDPA security standards
• DPO Support: Assisting with DPO appointment and responsibilities

E-commerce, Retail & Consumer Goods

Retail businesses process vast amounts of customer data for marketing, loyalty programs, and personalization. Direct marketing consent and data subject rights management are key compliance areas.

How LOGON Can Help:

• Consent Management Platforms: Technologies to capture, manage, and maintain auditable consent records
• DSAR Automation: Automating the receipt, verification, and response to data subject access requests
• Lifecycle Management: Automated data retention and deletion policies
• Data Mapping: Understanding personal data flows across systems
• Web Application Security: Testing online storefronts to prevent data breaches

Technology & IT Services

Tech companies process massive volumes of personal data across complex, multi-cloud environments with extensive third-party integrations and are often subject to extraterritorial application.

How LOGON Can Help:

• Attack Surface Management: Inventorying and continuously monitoring internet-facing applications and assets
• Automated Security Testing: DAST and manual penetration testing to meet security requirements
• Cloud Security: Securing cloud environments and ensuring compliance with PDPA cross-border transfer requirements
• Vendor Risk Management: Ensuring third-party processors comply with PDPA requirements
• Binding Corporate Rules (BCRs): Assisting in implementing BCRs for intra-group transfers
• DPO Services: Assisting with DPO appointment and responsibilities

SMEs & Small Businesses

SMEs must comply with the PDPA but may have limited resources. Exemptions exist for RoPA, but other obligations remain.

How LOGON Can Help:

• Tiered Compliance Solutions: Scalable solutions based on business size and data processing volume
• DPO Outsourcing: Cost-effective outsourced DPO services
• Consent Management: Simple, affordable consent management solutions
• Security Assessments: Basic security assessments to identify and address risks