What is PDPA B.E. 2562?

PDPA B.E. 2562 (2019) is Thailand's Personal Data Protection Act — the primary data protection law governing the collection, use, and disclosure of personal data in Thailand. It establishes six lawful bases for processing (consent, contract, legal obligation, vital interests, public interest, legitimate interests), eight data subject rights, mandatory breach notification within 72 hours to PDPC, and penalties up to THB 5 million in administrative fines and 1 year imprisonment. LAS provides full-cycle compliance advisory under this law.

พ.ร.บ.คุ้มครองข้อมูลส่วนบุคคล พ.ศ. 2562 คืออะไร?

พ.ร.บ.คุ้มครองข้อมูลส่วนบุคคล พ.ศ. 2562 (PDPA) เป็นกฎหมายหลักของประเทศไทยที่กำกับดูแลการเก็บรวบรวม ใช้ และเปิดเผยข้อมูลส่วนบุคคล กำหนดฐานทางกฎหมาย 6 ประเภท สิทธิเจ้าของข้อมูล 8 ประการ การแจ้งเหตุละเมิดภายใน 72 ชั่วโมง และโทษปรับสูงสุด 5 ล้านบาท โทษจำคุกสูงสุด 1 ปี LAS ให้บริการที่ปรึกษาการปฏิบัติตาม PDPA แบบครบวงจร โดย ธันย์ธรณ์เทพ แย้มอุทัย, Ph.D.

How does LAS combine PDPA with Due Diligence?

LAS integrates PDPA compliance into its signature Due Diligence and Conditions Precedent (CP) methodology. When screening counterparties or investment targets, LAS includes PDPA compliance assessment as a critical due diligence checkpoint — evaluating the target's data protection policies, consent mechanisms, DPO appointment, breach response capability, and cross-border transfer compliance. This ensures that data protection risks are identified and mitigated before any binding commitment, and that CP structures include PDPA compliance milestones that must be satisfied before transaction completion.

← Thundthornthep Yamoutai, Ph.D. — Main Profile | laslegal.co.th

LAS PDPA Compliance Advisory

Legal Advance Solution Co., Ltd. (LAS) provides full-cycle Personal Data Protection Act (PDPA B.E. 2562) compliance advisory services — from policy design and consent architecture to breach response and cross-border data transfer compliance. This capability is enhanced by the LAS AI-Powered Legal Research Advisory System, awarded R&D funding by the National Innovation Agency (NIA).

Led by Thundthornthep Yamoutai, Ph.D., with 20+ years of business law expertise.

PDPA Advisory Services

PDPA Policy & Privacy Notice Drafting Customised privacy policies, data collection notices, and consent forms aligned with PDPA Sections 19, 23, and PDPC Guidelines

Data Processing Agreement (DPA) Review Drafting and negotiation of DPAs for Controller-Processor relationships, including sub-processor management under Section 40

Data Protection Officer (DPO) Advisory DPO appointment assessment (Sections 41-42), role definition, reporting structure, and ongoing compliance support

Breach Notification & Incident Response 72-hour PDPC notification planning (Section 37(4)), incident response protocols, evidence preservation, and remediation frameworks

Cross-Border Data Transfer Compliance Adequacy assessment, Standard Contractual Clauses (SCCs), ASEAN Model Contractual Clauses, and safeguard documentation (Sections 28-29)

Consent Management System Design Architecting lawful consent mechanisms: freely given, specific, informed, unambiguous — with easy withdrawal (Section 19)

Sensitive Data & Biometric Handling Explicit consent protocols for health data, biometrics, criminal records, political opinions, and religious beliefs (Section 26)

PDPA Compliance Audit & Training Gap analysis, risk assessment, staff training programmes, and ongoing compliance monitoring

Data Subject Rights Implementation Systems for handling all 8 data subject rights: access, rectification, erasure, restriction, portability, objection, consent withdrawal, and complaint (Sections 30-35)

Due Diligence with PDPA Integration LAS Signature: PDPA compliance as a critical checkpoint in counterparty screening and investment target evaluation via the Due Diligence & Conditions Precedent (CP) methodology

LAS PDPA Knowledge Base

LAS maintains a comprehensive, professionally curated PDPA knowledge base covering:

Primary Legislation: Personal Data Protection Act B.E. 2562 (2019) — full text in Thai and English
PDPC Guidelines & Notifications: Official guidance from the Personal Data Protection Commission
Enforcement Cases: Administrative orders and case studies of PDPA enforcement actions
ASEAN Framework: ASEAN Framework on Personal Data Protection, ASEAN Data Management Framework, ASEAN Model Contractual Clauses for Cross-Border Data Flows
Related Legislation: Computer Crime Act B.E. 2550, Electronic Transactions Act B.E. 2544, Digital Platform Services Royal Decree B.E. 2565
LAS Internal Standards: LAS-STD-PDPA-POLICY, PDPA Contract Review Checklist (12-section framework), Compliance Analysis Report methodology
Practical Tools: Data breach report forms, DPO notification forms, training programme templates, risk assessment frameworks, SME compliance guides

The LAS Due Diligence & Conditions Precedent (CP) Approach to PDPA

Thundthornthep Yamoutai's signature methodology integrates PDPA compliance into the broader transactional due diligence framework:

Pre-Transaction PDPA Screening: Before any binding commitment, LAS evaluates the counterparty's data protection posture — policies, consent mechanisms, DPO status, breach history, and cross-border transfer practices
CP Milestone Design: PDPA compliance milestones are built into Conditions Precedent structures, requiring counterparties to achieve specific data protection standards before transaction completion
Ongoing Monitoring Mechanisms: Post-transaction compliance monitoring through contractual audit rights, periodic assessments, and reporting obligations
Risk-Based Approach: Classification of PDPA risks (HIGH / MEDIUM / LOW) with quantified impact analysis and tailored mitigation clauses

PDPA Penalty Summary

Type	Provision	Maximum Penalty
Administrative Fine	Section 90	THB 5,000,000
Criminal — Imprisonment	Section 79	1 year
Criminal — Fine	Section 79	THB 1,000,000
Civil — Punitive Damages	Sections 77-78	2x actual damages

Data Subject Rights under PDPA (8 Rights)

#	Right	PDPA Section
1	Right of Access	Section 30
2	Right to Data Portability	Section 31
3	Right to Object	Section 32
4	Right to Erasure	Section 33(5)
5	Right to Restriction of Processing	Section 34
6	Right to Rectification	Section 35
7	Right to Withdraw Consent	Section 19(5)
8	Right to Lodge a Complaint	Section 77

PDPA Advisory Team

Thundthornthep Yamoutai, Ph.D.

Founder & Managing Director

Business Lawyer & AI LegalTech Strategist
Designing Legal Frameworks to Protect, Structure & Scale Businesses — Sustainably

Ph.D. (DPA)
20+ years business law expertise
NIA-funded AI Legal Research developer
Due Diligence & CP methodology designer
University Lecturer (KU, BTU, SSRU)

Full Profile | LAS Team Page

ทนายหมิว Ms. Nanthanat Saengthong PDPA Lead LAS Legal Advance Solution

Ms. Nanthanat Saengthong (ทนายหมิว)

Corporate & Commercial Partner — PDPA Lead

LL.B. — Assumption University
LL.M. — University of Nottingham (UK)
LL.M. — University of Sheffield (UK)
Thai Bar Association certified
PDPA training delivered to 5,000+ employees across multiple organisations
Expertise: PDPA implementation, corporate structuring, employment law, M&A, joint ventures, foreign investment
Former: Bank legal advisory team, law firm advisor, guest lecturer on data protection law
Creator: BizLaw by ทนายหมิว — PDPA & business law content

LAS Team Page | Instagram | nanthanat@laslegal.co.th

PDPA Insights by ทนายหมิว — BizLaw by Mhew

Ms. Nanthanat สร้างสรรค์ content PDPA ผ่านช่อง BizLaw by ทนายหมิว ให้ความรู้กฎหมายเข้าใจง่ายสำหรับผู้ประกอบการและประชาชนทั่วไป:

ข้อมูลสุขภาพไม่ใช่คอนเทนต์

หลายคนเข้าใจว่า "ไม่ใส่ชื่อก็ไม่ผิด" แต่ความจริงแล้ว ภาพผู้ป่วยหรือข้อมูลการรักษาถือเป็น ข้อมูลส่วนบุคคลที่มีความอ่อนไหว ตาม PDPA กฎหมายกำหนดชัดเจนว่า ห้ามเก็บ ใช้ หรือเปิดเผย เว้นแต่จะได้รับ ความยินยอมโดยชัดแจ้ง แม้ไม่ระบุชื่อ แต่ถ้าสามารถระบุตัวบุคคลได้ ก็อาจเข้าข่ายความรับผิดทางแพ่ง ทางปกครอง และอาจมีโทษทางอาญา

— ทนายหมิว, Ms. Nanthanat Saengthong | BizLaw by ทนายหมิว

ติดตาม PDPA content เพิ่มเติม:

LAS Special Session: PDPA Excellence in Digital Workplace

LAS PDPA Workshop — Ms. Nanthanat Saengthong สอน PDPA ให้ IGLOO Studio

LAS, led by Ms. Nanthanat Saengthong, organised an interactive PDPA workshop for IGLOO Studio to enhance practical skills in Personal Data Protection Act compliance. The session focused on sharing knowledge and experiences for real-world workplace implementation.

LAS PDPA Training Session — การอบรม PDPA โดย Legal Advance Solution

PDPA Compliance Workshop — ที่ปรึกษา PDPA LAS Legal

LAS PDPA Excellence — อบรม PDPA สำหรับองค์กร

Contact LAS for PDPA Advisory
Legal Advance Solution Co., Ltd.
Unit 1405, 14th Floor, Abdulrahim Place, Bangkok 10500
Tel: +66 (0) 2 095 5635 | Email: info@laslegal.co.th
PDPA Lead: nanthanat@laslegal.co.th (Ms. Nanthanat Saengthong)
laslegal.co.th