Thailand's Personal Data Protection Act (PDPA) gives people rights over how organisations collect and use their personal data, and it sets duties and penalties for those that fail to comply. The law has been fully in force since 1 June 2022. This guide covers what you can ask of a company, what organisations cannot do, what the law does not ban, and what happens when it is breached.
What the PDPA is and what it protects
The Personal Data Protection Act B.E. 2562 (2019) was published in the Royal Gazette on 27 May 2019. Its core idea is to give rights to the owner of the data and to require anyone who collects or uses data to do so to a proper standard and with transparency.
Personal data is any information that can identify a person, directly or indirectly. Examples include a name, address, phone number, email, bank account number, LINE ID or fingerprint. It covers paper records and electronic ones.
The law also sets stricter protection for sensitive data. This includes race, religious belief, health data, biometric data and criminal records.
Three roles under the law
- Data Subject: the person the data identifies.
- Data Controller: the person or organisation that decides how and why the data is collected and used. The main legal liability sits here.
- Data Processor: a party that handles data only on the controller's instructions.
What you can do as a data subject
The aim of the PDPA is to return control of data to its owner. The rights below can be used against any organisation that holds your data:
- The right to be informed, before or when data is collected, of the purpose (Section 23).
- The right to access and obtain a copy of your data (Section 30).
- The right to have your data transferred to another controller (Section 31).
- The right to object to processing (Section 32).
- The right to request deletion or destruction of your data (Section 33).
- The right to request that use of your data be suspended (Section 34).
- The right to withdraw consent at any time, and to have your data corrected so it is accurate and up to date.
You exercise these rights by submitting a request to the organisation holding the data. It must generally act on the request free of charge. If a request is vexatious or an excessive use of the right, the organisation may charge a reasonable fee.
What organisations cannot do
Many people think the PDPA is only a consent law. That is half right. Collecting and using data needs a legal basis, and consent is just one of those bases. An organisation cannot use data beyond the purposes it announced, and it cannot collect data without some legal basis.
The law allows data use without consent in some cases. These include complying with a law, serving the public interest, preventing danger to life, body or health, performing a contract, or using data that the owner voluntarily made public. These are set out in Sections 24 and 26. Sensitive data faces stricter conditions than ordinary data.
Common myths: what the PDPA does not ban
When the law took effect, many people believed it bans taking photos in public if other people appear in them, or bans posting any photo with other people on social media. That does not match the intent of the law. Taking photos or video in a public place where others appear by chance, without causing them harm, is generally not an offence under the PDPA.
The law also exempts collecting or using personal data purely for personal or household activity, such as keeping a friend's phone number in your own phone. The PDPA mainly regulates systematic data processing by organisations, not private everyday activity.
If your data is misused: complaints and penalties
If you believe your rights have been violated, you can file a complaint with the Personal Data Protection Committee Office (PDPC, in Thai สคส.), on paper or electronically. The law provides three kinds of penalty.
- Civil: victims can claim compensation. A court may order extra damages of up to twice the actual damages. The time limit is 3 years from the day you learn of the damage and who is liable, or 10 years from the day of the violation.
- Administrative: fines of up to 5 million baht for breaching duties under the law.
- Criminal: applies to the wrongful use or disclosure of sensitive data that harms others, damages their reputation, or is done to gain unlawful benefit.
In short, the PDPA gives people tools to know, check and control how their data is used. It also sets a framework for organisations to handle data responsibly. Knowing what the law actually allows and bans helps both consumers and businesses act correctly without needless alarm.
The Thai report does not say whether any of these rights or procedures differ for non-Thai nationals or for services in English. If you need to file a request or complaint, check with the organisation concerned or with the PDPC.
Source: Personal Data Protection Act B.E. 2562 (2019) and the Personal Data Protection Committee Office, as summarised in ViewNews' Thai-language report. This article is adapted from ViewNews' Thai-language report.
