Table of Contents
- What is PDPA? — Thailand's Personal Data Protection Act B.E. 2562
- When Did PDPA Come Into Effect?
- Who Must Comply with PDPA?
- The 6 Lawful Bases for Data Processing
- 8 Data Subject Rights Under PDPA
- Key Compliance Requirements
- Cross-Border Data Transfer Under PDPA
- PDPA Penalties and Enforcement
- Step-by-Step PDPA Compliance Checklist (14 Steps)
- How LAS Helps with PDPA Compliance
- Frequently Asked Questions
- References
1. What is PDPA? Thailand's Personal Data Protection Act B.E. 2562 (2019)
The Personal Data Protection Act B.E. 2562 (2019), commonly known as PDPA, is Thailand's first comprehensive data protection legislation. Often compared to the European Union's General Data Protection Regulation (GDPR), the PDPA establishes a legal framework governing the collection, use, disclosure, and transfer of personal data by organizations operating in or targeting individuals within the Kingdom of Thailand.
The PDPA was enacted to address growing concerns about data privacy in Thailand's rapidly digitalizing economy. Before PDPA, data protection obligations were scattered across sector-specific regulations — including the Computer Crime Act B.E. 2550 (2007), the Credit Information Business Act, and various notifications from the National Broadcasting and Telecommunications Commission (NBTC). The PDPA consolidated and strengthened these protections into a single, unified law with extraterritorial reach.
Official Thai Name: พระราชบัญญัติคุ้มครองข้อมูลส่วนบุคคล พ.ศ. 2562
Administered by: Personal Data Protection Committee (PDPC) and Office of the Personal Data Protection Committee (OPDPC)
Scope: Any organization collecting, using, or disclosing personal data of individuals in Thailand
The PDPA defines "personal data" broadly as any information relating to a person that enables the identification of that person, whether directly or indirectly — but not including information of a deceased person. This includes names, identification numbers, addresses, phone numbers, email addresses, photographs, biometric data, IP addresses, cookie identifiers, location data, and any other information that can identify a natural person.
The law further recognizes a special category of "sensitive personal data" (Section 26), which includes data relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, criminal records, trade union membership, genetic data, biometric data used for identification, health data, disability, sexual orientation, and any other data prescribed by the PDPC. Sensitive data is subject to heightened protection requirements and generally cannot be processed without explicit consent.
1.1 Key Roles Under PDPA
| Role | PDPA Definition | Examples |
|---|---|---|
| Data Subject | A natural person whose personal data is collected, used, or disclosed | Customers, employees, website visitors, patients |
| Data Controller | A person or entity that determines the purposes and means of personal data processing (Section 6) | Employers, hospitals, e-commerce platforms, banks |
| Data Processor | A person or entity that processes personal data on behalf of and under the instructions of the data controller (Section 6) | Cloud service providers, payroll vendors, marketing agencies |
| Data Protection Officer (DPO) | A designated officer responsible for monitoring and advising on PDPA compliance (Sections 41–42) | Internal compliance officer, external DPO-as-a-service provider |
2. When Did PDPA Come Into Effect? Enforcement Timeline and Key Milestones
The PDPA's path to full enforcement was marked by several postponements, largely due to the COVID-19 pandemic. Understanding this timeline is important for organizations assessing their compliance obligations and potential liability exposure.
| Date | Event |
|---|---|
| May 27, 2019 | PDPA published in the Royal Gazette (enacted) |
| May 28, 2019 | Certain provisions take immediate effect (establishment of PDPC, appointment of Secretary-General) |
| May 27, 2020 | Original date for full enforcement of all provisions |
| May 2020 | First Royal Decree postpones full enforcement by 1 year due to COVID-19 |
| May 2021 | Second Royal Decree postpones full enforcement by another year |
| June 1, 2022 | Full enforcement begins — all provisions of PDPA are in effect |
| 2022–2023 | PDPC issues subordinate regulations, guidelines, and notifications clarifying compliance requirements |
| 2024–2026 | PDPC continues issuing sector-specific guidelines and increasing enforcement activity; first enforcement actions reported |
Since June 1, 2022, all provisions of the PDPA are fully enforceable. Organizations that have not yet achieved compliance face potential administrative fines of up to 5 million THB per violation, criminal penalties, and civil liability for damages.
3. Who Must Comply with PDPA? Scope of Application — Territorial and Extraterritorial Reach
The PDPA has a broad scope of application. It applies to the collection, use, and disclosure of personal data by data controllers and data processors in the following circumstances:
- Organizations located in Thailand — Any company, partnership, foundation, association, or governmental body that collects, uses, or discloses personal data within the Kingdom of Thailand.
- Organizations outside Thailand (extraterritorial scope) — The PDPA applies to foreign organizations if they: (a) offer goods or services to data subjects in Thailand, regardless of whether payment is required; or (b) monitor the behavior of data subjects in Thailand.
3.1 Entities Subject to PDPA
| Entity Type | Example Obligations |
|---|---|
| Private companies (Thai and foreign) | Customer data privacy notices, employee data policies, vendor DPAs |
| SMEs and startups | Simplified but mandatory compliance — privacy notice, consent where required, data security |
| Multinational corporations | Full compliance plus cross-border data transfer mechanisms |
| E-commerce and digital platforms | Cookie consent, privacy policy, data subject rights portal |
| Healthcare providers | Heightened obligations for sensitive health data, explicit consent |
| Financial institutions | Additional sector-specific regulations alongside PDPA |
| Government agencies | Subject to PDPA with certain exemptions for national security and law enforcement |
| Non-profit organizations | Subject to PDPA when processing personal data of members, donors, or beneficiaries |
3.2 Exemptions (Section 4)
The PDPA provides limited exemptions, including:
- Personal or household activities with no commercial connection
- Operations of public media in accordance with professional ethics
- Activities of the House of Representatives, Senate, and Parliament
- Court proceedings and judicial activities
- Credit bureau operations already governed by specific legislation
These exemptions are narrowly construed. Most organizations — regardless of size, industry, or nationality — must comply with PDPA if they process personal data of individuals in Thailand. When in doubt, treat your organization as subject to PDPA and seek qualified legal advice.
4. The 6 Lawful Bases for Data Processing PDPA Section 24 — Conditions for Lawful Collection and Use
Under PDPA Section 24, a data controller may not collect personal data without the consent of the data subject, unless one of the other lawful bases applies. This "consent by default" framework is one of the key features of the PDPA that organizations must understand and apply correctly for each processing activity.
| # | Lawful Basis | PDPA Section | Description | Examples |
|---|---|---|---|---|
| 1 | Consent | Section 19 | The data subject has given explicit consent. Consent must be freely given, specific, informed, and unambiguous. It must be clearly distinguishable from other matters and presented in an easily accessible form using clear and plain language. | Marketing emails, cookie tracking, sharing data with third-party partners |
| 2 | Contract | Section 24(3) | Processing is necessary for the performance of a contract to which the data subject is a party, or for taking steps at the data subject's request prior to entering into a contract. | Processing delivery address for an online purchase, salary payment for employees |
| 3 | Legal Obligation | Section 24(6) | Processing is necessary for compliance with a law to which the data controller is subject. | Tax reporting, anti-money laundering requirements, labor law compliance |
| 4 | Vital Interest | Section 24(2) | Processing is necessary to prevent or suppress a danger to the life, body, or health of a person. | Emergency medical treatment, disaster response |
| 5 | Public Interest / Official Authority | Section 24(4) | Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority. | Public health surveillance, national statistics, census data |
| 6 | Legitimate Interest | Section 24(5) | Processing is necessary for the legitimate interests of the data controller or a third party, unless overridden by the fundamental rights of the data subject. Requires a balancing test. | Fraud prevention, network security, internal analytics, direct marketing to existing customers (with opt-out) |
Many Thai organizations over-rely on consent as their sole lawful basis. This creates operational risk because consent can be withdrawn at any time (Section 19, paragraph 5). Where possible, identify and document an alternative lawful basis — particularly contract performance and legitimate interest — to build a more resilient data processing framework.
4.1 Special Rules for Sensitive Personal Data (Section 26)
For sensitive personal data, the PDPA imposes stricter requirements. Processing of sensitive data is generally prohibited unless:
- The data subject has given explicit consent (not merely implied)
- Processing is necessary to protect the vital interests of the data subject who is incapable of giving consent
- Processing relates to data manifestly made public by the data subject
- Processing is necessary for the establishment, exercise, or defense of legal claims
- Processing is necessary for compliance with a law (e.g., occupational health requirements)
- Processing is carried out by a non-profit body for its members, with appropriate safeguards
5. 8 Data Subject Rights Under PDPA Rights Guaranteed to Individuals — 30-Day Response Requirement
The PDPA grants data subjects eight fundamental rights regarding their personal data. Organizations must establish internal processes to handle these rights requests and respond within 30 days of receiving a valid request.
Right to Be Informed
Data subjects have the right to be informed about the collection and processing of their personal data before or at the time of collection. Fulfilled through privacy notices.
Right of Access
Data subjects may request access to their personal data held by the data controller and obtain a copy of such data. The controller must respond within 30 days.
Right to Data Portability
Data subjects may request that the data controller transmit their personal data in a commonly used, machine-readable format to another data controller, where technically feasible.
Right to Object
Data subjects may object to the collection, use, or disclosure of their personal data, particularly when processing is based on legitimate interest or public interest.
Right to Erasure
Data subjects may request deletion or destruction of personal data when it is no longer necessary, when consent is withdrawn, or when processing is unlawful.
Right to Restrict Processing
Data subjects may request that the controller restrict processing of their personal data in certain circumstances, such as when accuracy is contested.
Right to Rectification
Data subjects may request that inaccurate or incomplete personal data be corrected, updated, or supplemented.
Right to Withdraw Consent
Where processing is based on consent, data subjects may withdraw consent at any time. Withdrawal must be as easy as giving consent and does not affect prior lawful processing.
Failure to respond to data subject rights requests within the statutory 30-day period, or refusing requests without legitimate grounds, may result in complaints to the PDPC and subsequent administrative sanctions. Organizations should establish a documented intake and response process, ideally with a dedicated email address or web form for rights requests.
6. Key Compliance Requirements Operational Obligations for Data Controllers and Processors
Beyond understanding lawful bases and data subject rights, organizations must implement several operational compliance measures under the PDPA. This section covers the five most critical requirements that every data controller and data processor must address.
6.1 Privacy Notice (Section 23)
Data controllers must provide a privacy notice to data subjects before or at the time of data collection. The privacy notice must include:
- The purpose of collecting, using, or disclosing personal data
- The categories of personal data collected
- The period of data retention (or the criteria used to determine that period)
- The categories of persons or entities to whom personal data may be disclosed
- Contact details of the data controller and, where applicable, the DPO
- The rights of the data subject
- If applicable, consequences of refusing to provide personal data
6.2 Consent Management (Sections 19–20)
Where consent is the lawful basis for processing, the PDPA imposes specific requirements:
- Consent must be freely given, specific, informed, and unambiguous
- The request for consent must be clearly distinguishable from other matters
- Consent for sensitive data must be explicit
- Pre-ticked boxes or silence do not constitute valid consent
- Consent must be as easy to withdraw as it was to give
- The data controller bears the burden of proving that valid consent was obtained
- Consent obtained through deception or misleading the data subject is void
6.3 Data Processing Agreement (Section 40)
When a data controller engages a data processor (e.g., a cloud service provider, payroll vendor, or marketing platform), the controller must enter into a written Data Processing Agreement (DPA) that specifies:
- The scope and purpose of data processing
- Instructions from the controller to the processor
- Data security measures the processor must implement
- Obligations regarding sub-processing
- Data breach notification obligations
- Data return or destruction upon termination of the agreement
6.4 Data Protection Officer (Sections 41–42)
A Data Protection Officer (DPO) must be appointed in the following situations:
- The data controller or processor is a public authority
- Core activities require regular and systematic monitoring of data subjects on a large scale
- Core activities involve large-scale processing of sensitive personal data
The DPO's responsibilities include:
- Advising the data controller or processor on PDPA compliance
- Monitoring data processing operations for compliance
- Cooperating with the PDPC and serving as the contact point for the PDPC
- Maintaining confidentiality in performing their duties
The DPO can be an internal employee or an external service provider. The data controller must ensure the DPO has sufficient independence, resources, and access to carry out their functions without interference. The DPO's contact details must be published and communicated to the PDPC. Even where a DPO is not legally required, appointing one is considered best practice.
6.5 Data Breach Notification (Section 37(4))
In the event of a personal data breach, the data controller must notify the PDPC within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of the data subject. If the breach is likely to result in high risk to the rights and freedoms of the data subject, the controller must also notify the affected data subjects without undue delay.
The breach notification to the PDPC must include:
- The nature of the personal data breach, including categories and approximate number of affected data subjects
- The name and contact details of the DPO or relevant contact point
- The likely consequences of the breach
- The measures taken or proposed to address the breach and mitigate adverse effects
7. Cross-Border Data Transfer Under PDPA Sections 28–29 — International Data Transfer Rules
Sections 28 and 29 of the PDPA regulate the transfer of personal data to foreign countries. This is particularly relevant for multinational companies, organizations using cloud services hosted abroad, and businesses that share data with overseas partners.
7.1 General Rule
A data controller may transfer personal data to a foreign country only if the destination country has adequate data protection standards as prescribed by the PDPC. As of April 2026, the PDPC has not yet published a definitive list of countries deemed to have adequate standards, though guidance is evolving.
7.2 Exceptions Allowing Cross-Border Transfer
Even without an adequacy determination, cross-border transfers are permitted in the following circumstances:
| # | Exception | Description |
|---|---|---|
| 1 | Compliance with law | The transfer is necessary to comply with a legal obligation |
| 2 | Consent | The data subject has been informed of the inadequate standards and has given consent |
| 3 | Contract performance | The transfer is necessary for the performance of a contract between the data subject and the data controller |
| 4 | Pre-contractual measures | The transfer is necessary at the data subject's request prior to entering into a contract |
| 5 | Vital interests | The transfer is necessary to protect the vital interests of the data subject or another person |
| 6 | Important public interest | The transfer is necessary for an important reason of public interest |
| 7 | Legal claims | The transfer is necessary for the establishment, exercise, or defense of legal claims |
| 8 | Binding Corporate Rules (BCRs) | Intra-group transfers under BCRs that provide appropriate safeguards, as approved by the PDPC |
Organizations using major cloud platforms (AWS, Google Cloud, Microsoft Azure) with servers located outside Thailand should conduct a transfer impact assessment and, where appropriate, implement Standard Contractual Clauses or BCRs. A PDPA lawyer can help structure these mechanisms to comply with Thai law while maintaining operational flexibility.
8. PDPA Penalties and Enforcement Administrative, Criminal, and Civil Liability
The PDPA imposes three categories of penalties for non-compliance: administrative, criminal, and civil. These can be imposed concurrently, meaning an organization could face all three types of liability for a single violation.
8.1 Administrative Penalties
| Violation | Maximum Penalty | Risk Level |
|---|---|---|
| Failure to comply with data controller/processor obligations | Up to 5,000,000 THB per violation | HIGH |
| Failure to appoint a DPO when required | Up to 3,000,000 THB | HIGH |
| Failure to comply with orders of the Expert Committee | Up to 5,000,000 THB | HIGH |
| Failure to maintain records of data processing activities | Up to 1,000,000 THB | MEDIUM |
| Non-compliance with cross-border transfer restrictions | Up to 5,000,000 THB | HIGH |
8.2 Criminal Penalties
| Offense | Imprisonment | Fine |
|---|---|---|
| Unauthorized use or disclosure of sensitive personal data | Up to 6 months | Up to 500,000 THB |
| Use or disclosure causing damage, reputational harm, or unfair advantage | Up to 6 months | Up to 500,000 THB |
| Unauthorized disclosure of personal data obtained in performance of PDPA duties | Up to 6 months | Up to 500,000 THB |
| If committed by a data controller with intent to cause damage | Up to 1 year | Up to 1,000,000 THB |
If a legal entity commits an offense under the PDPA, and the offense was committed by the order, by the action, or with the knowledge and consent of a director, manager, or person responsible for the operations of that legal entity, such person shall also be liable to the same penalty as the legal entity. This personal liability provision makes PDPA compliance a board-level concern.
8.3 Civil Liability (Sections 77–78)
- A data controller or processor who violates the PDPA and causes damage to a data subject is liable for actual damages
- The court may award punitive damages of up to twice the actual damages
- The burden of proof is on the data controller/processor to demonstrate they were not negligent (reverse burden of proof)
- Data subjects may file complaints with the PDPC or bring civil lawsuits directly
- Class actions are possible under the Thai Class Action Procedure
9. Step-by-Step PDPA Compliance Checklist 14-Step Methodology Used by LAS in Client Engagements
The following checklist provides a structured, practical roadmap for organizations seeking to achieve and maintain PDPA compliance. This is the methodology used by Legal Advance Solution (LAS) in advising clients across industries.
Appoint a PDPA Project Lead or DPO
Designate a responsible person or team to oversee PDPA compliance. Appoint a DPO if legally required (public authority, large-scale monitoring, or large-scale sensitive data processing). Key deliverables: DPO appointment letter; PDPC notification; published contact details. CRITICAL
Conduct Data Mapping & Inventory
Identify all personal data collected, used, stored, disclosed, and transferred. Document data flows, storage locations, retention periods, and third-party sharing. Key deliverables: data inventory register; data flow diagrams; Records of Processing Activities (ROPA). CRITICAL
Perform Gap Analysis
Compare current data processing practices against PDPA requirements. Identify gaps in policies, procedures, contracts, and technical controls. Key deliverables: gap analysis report; risk assessment matrix; remediation roadmap. CRITICAL
Identify Lawful Bases for Each Processing Activity
For each data processing activity, determine and document the appropriate lawful basis under PDPA Section 24. Minimize reliance on consent where other bases apply. Key deliverables: lawful basis register; processing purpose documentation. HIGH
Draft and Publish Privacy Notices
Create comprehensive privacy notices for each stakeholder group (customers, employees, vendors, website visitors). Key deliverables: external privacy notice; employee privacy notice; website privacy policy; cookie notice. CRITICAL
Implement Consent Mechanisms
Deploy compliant consent collection tools with clear opt-in, purpose specification, and easy withdrawal mechanisms. Key deliverables: consent forms; cookie consent platform; consent database/log. HIGH
Execute Data Processing Agreements (DPAs)
Enter into written agreements with all third-party data processors. Review existing vendor contracts for PDPA compliance. Key deliverables: DPA template; vendor compliance assessment; contract addenda. HIGH
Establish Data Subject Rights Procedures
Create workflows to receive, verify, and respond to data subject rights requests within the 30-day statutory timeframe. Key deliverables: rights request form; internal SOP; response templates; tracking log. HIGH
Implement Data Security Measures
Deploy appropriate technical and organizational security controls — access controls, encryption, pseudonymization, regular testing. Key deliverables: information security policy; access control matrix; encryption standards; security audit reports. CRITICAL
Create a Data Breach Response Plan
Establish procedures for detecting, containing, assessing, and reporting data breaches. Ensure PDPC notification within 72 hours. Key deliverables: breach response plan; notification templates; incident log; escalation procedures. CRITICAL
Review Cross-Border Data Transfers
Identify all transfers of personal data outside Thailand. Implement appropriate safeguards (BCRs, contractual clauses, or consent). Key deliverables: transfer impact assessment; BCRs or SCCs; data transfer register. HIGH
Conduct Data Protection Impact Assessments (DPIAs)
Perform DPIAs for high-risk processing activities including large-scale profiling, automated decision-making, and systematic monitoring. Key deliverables: DPIA reports; risk mitigation measures; PDPC consultation (if required). MEDIUM
Employee Training and Awareness
Conduct PDPA training for all employees, with specialized training for HR, IT, marketing, and customer-facing teams. Key deliverables: training materials; attendance records; knowledge assessments. HIGH
Ongoing Monitoring and Review
Establish a regular review cycle (at least annually) to update policies, procedures, and technical measures in response to regulatory changes and organizational developments. Key deliverables: annual compliance review report; updated ROPA; regulatory change log. ONGOING
PDPA compliance is not a one-time project — it is a continuous obligation. Organizations should treat data protection as an integral part of their governance, risk, and compliance (GRC) framework. Regular audits, employee training refreshers, and policy updates are essential to maintaining compliance as the PDPC issues new guidelines and enforcement activity increases.
10. How LAS Helps with PDPA Compliance End-to-End PDPA Advisory Services by Legal Advance Solution Co., Ltd.
Legal Advance Solution Co., Ltd. (LAS), founded by Thundthornthep Yamoutai, Ph.D., provides comprehensive PDPA advisory services that combine over 20 years of legal practice expertise with cutting-edge AI-powered legal technology.
LAS PDPA Advisory Services Include:
- PDPA Gap Analysis and Compliance Assessment — Comprehensive review of current data processing practices against PDPA requirements, with a prioritized remediation roadmap
- Privacy Notice and Policy Drafting — Preparation of legally compliant privacy notices, cookie policies, and internal data protection policies tailored to your business
- Consent Management Advisory — Design and implementation of consent collection mechanisms that meet PDPA standards
- Data Processing Agreement (DPA) Drafting and Review — Preparation of DPAs for vendor relationships and review of existing contracts for PDPA compliance
- DPO-as-a-Service — Outsourced Data Protection Officer services for organizations that need a DPO but prefer external expertise
- Data Breach Response Planning — Development of breach notification procedures and templates to meet the 72-hour PDPC notification requirement
- Cross-Border Data Transfer Advisory — Assessment and structuring of international data transfers using appropriate legal mechanisms
- Employee PDPA Training — Customized training programs for management, HR, IT, marketing, and operational teams
- Data Protection Impact Assessments (DPIAs) — Risk assessments for high-risk processing activities
- Ongoing Compliance Monitoring — Regular reviews and updates to ensure continued compliance as regulations evolve
- Deep Legal Expertise: Thundthornthep Yamoutai, Ph.D. brings 20+ years of practicing law in Thailand, with specialized knowledge of PDPA, corporate law, and regulatory compliance
- AI-Powered Efficiency: LAS uses its NIA-funded AI legal research system to accelerate compliance analysis, ensuring thorough and cost-effective advisory services
- Academic Rigor: As a lecturer at three major Thai universities and an ACI-published researcher, Thundthornthep Yamoutai, Ph.D. brings academic precision to practical legal solutions
- Full-Service Approach: From initial assessment through implementation, training, and ongoing monitoring — LAS provides end-to-end PDPA compliance support
Contact LAS for PDPA Advisory: Visit laslegal.co.th for more details.
11. Frequently Asked Questions FAQ — PDPA Compliance in Thailand
Q1: What is PDPA and when did it come into full effect in Thailand?
PDPA stands for the Personal Data Protection Act B.E. 2562 (2019), Thailand's comprehensive data protection law. It was enacted in May 2019 and came into full enforcement on June 1, 2022, after multiple postponements due to the COVID-19 pandemic. The law is administered by the Personal Data Protection Committee (PDPC) and the Office of the Personal Data Protection Committee (OPDPC). It applies to any organization that collects, uses, or discloses personal data of individuals in Thailand, regardless of whether the organization is based in the country.
Q2: What are the penalties for PDPA non-compliance in Thailand?
PDPA imposes three types of penalties: (1) Administrative fines of up to 5 million THB per violation, issued by the Expert Committee; (2) Criminal penalties including imprisonment of up to 1 year and/or fines of up to 1 million THB for certain offenses such as unauthorized use of sensitive data; and (3) Civil liability including actual damages, with punitive damages of up to twice the actual damages awarded by the court. Directors and officers can be held personally liable if the violation occurred by their order or with their knowledge and consent.
Q3: Do I need a Data Protection Officer (DPO) under Thailand's PDPA?
Under Section 41 of the PDPA, a DPO must be appointed when: (1) the data controller or processor is a public authority; (2) the organization's core activities require regular and systematic monitoring of data subjects on a large scale; or (3) the organization's core activities involve large-scale processing of sensitive personal data. The DPO can be an employee or an external service provider, and their contact details must be published and communicated to the PDPC. Even when not legally required, appointing a DPO is considered best practice.
Q4: Can personal data be transferred outside Thailand under PDPA?
Yes, but cross-border data transfers are restricted under PDPA Sections 28–29. The receiving country must have adequate data protection standards as determined by the PDPC, or the transfer must fall under specific exceptions: compliance with law, consent of the data subject (after being informed of inadequate standards), performance of a contract, vital interests, important public interest, or legal claims. Organizations can also use Binding Corporate Rules (BCRs) or Standard Contractual Clauses approved by the PDPC for intra-group or third-party transfers.
Q5: How can a PDPA lawyer help my business achieve compliance in Thailand?
A specialized PDPA lawyer helps businesses achieve compliance through: data mapping and gap analysis; drafting compliant privacy notices, consent forms, and data processing agreements; advising on lawful bases; establishing breach notification procedures (72-hour rule); setting up data subject rights request workflows; advising on cross-border transfer mechanisms; conducting DPIAs; training staff; and acting as or supporting the DPO. Thundthornthep Yamoutai, Ph.D. and Legal Advance Solution (LAS) provide end-to-end PDPA advisory services leveraging AI-powered legal research tools.
References
- Personal Data Protection Act B.E. 2562 (2019) (พระราชบัญญัติคุ้มครองข้อมูลส่วนบุคคล พ.ศ. 2562)
- Personal Data Protection Committee (PDPC) — Subordinate Regulations, Guidelines, and Notifications (2022–2026)
- Office of the Personal Data Protection Committee (OPDPC) — www.pdpc.go.th
- Computer Crime Act B.E. 2550 (2007) (พระราชบัญญัติว่าด้วยการกระทำความผิดเกี่ยวกับคอมพิวเตอร์ พ.ศ. 2550)
- National Broadcasting and Telecommunications Commission (NBTC) — Personal Data Protection Notifications
- Thundthornthep Yamoutai, Ph.D. — LAS PDPA Compliance Framework (NIA-funded AI Legal Research, 2026)
- EU General Data Protection Regulation (GDPR) 2016/679 — Comparative Reference
- Department of Business Development (DBD) — www.dbd.go.th
Legal Disclaimer
English: This article is prepared solely for academic and general informational purposes. It does not constitute legal advice for any specific matter or organization. The PDPA and related PDPC regulations are subject to ongoing development and revision; readers should verify current requirements directly with the PDPC at www.pdpc.go.th before making compliance decisions. The author, Thundthornthep Yamoutai, Ph.D., and Legal Advance Solution Co., Ltd. disclaim all liability for any loss or damage arising from reliance on the contents of this article without professional legal consultation.
© 2026 Thundthornthep Yamoutai, Ph.D. — Legal Advance Solution Co., Ltd. (LAS) — All Rights Reserved.