← Global Privacy Laws Research Library
Personal Data Protection Act B.E. 2562 (2019)
Personal Data Protection Act B.E. 2562 (2019): Thailand
Prepared by Shubhank Suman · Last reviewed
CURRENT / SUBSTANTIVE REGIME OPERATIVE SINCE 1 JUNE 2022
- Legal character
- National statute
- Region
- Asia-Pacific
What it covers
The Thai PDPA governs:
- collection
- use
- disclosure
- consent
- alternative lawful bases
- sensitive personal data
- data-subject rights
- controllers
- processors
- DPOs
- security
- breach notification
- records
- international transfers
- enforcement.
AI, privacy and cybersecurity relevance
- AI: High
- Privacy: Very High
- Cyber: Very High
AI
HIGH
Thailand's PDPA is not an AI statute, but it explicitly contains a data-subject right relating to certain automated decisionmaking.
It is relevant to:
- AI profiling
- automated decisions
- biometric AI
- health AI
- behavioural analytics.
Cybersecurity
VERY HIGH
Section 37 requires appropriate security and breach-management measures.
Applicability
The Act has territorial reach, including specified processing by organisations outside Thailand when they offer goods/services to Thai residents or monitor behaviour in Thailand.
Current validity
CURRENT.
Read first
Sections 19–26 → Sections 28–29 → Sections 30–36 → Sections 37–41 → enforcement.
Provisions / sections covered
Section 19: Consent
Requires consent to be:
- explicit
- freely given
- specific
- informed
- understandable.
The controller must explain the purpose when requesting consent. (Thailand Law Forum)
Section 21: Purpose limitation
Processing should remain consistent with the disclosed collection purpose.
Section 22: Data minimisation
Collection should be limited to what is necessary.
Section 23: Transparency
Requires information concerning:
- purposes
- categories
- retention
- recipients
- controller contact
- rights.
Section 24: Alternative lawful bases
Provides non-consent bases for ordinary personal data, including:
- contract
- legal obligation
- vital interests
- public task
- legitimate interests.
Section 26: Sensitive personal data
Covers:
- racial/ethnic origin
- political views
- religion
- sexual behaviour
- criminal records
- health
- disability
- trade union information
- genetic data
- biometric data.
Explicit consent is generally required subject to statutory exceptions. (Thailand Law Forum)
Sections 30–36: Data-subject rights
Include:
- access
- portability
- objection
- erasure
- restriction
- rectification
- rights relating to automated processing.
Section 37: Controller obligations
Requires security measures and includes breach notification obligations.
Section 40: Processor
Sets processor duties and controller instructions.
Section 41: DPO
Requires a DPO in specified circumstances.
International transfers
Sections 28–29 and the subsequent PDPC transfer framework establish adequacy/safeguard mechanisms.
Subject-matter tags
- Consent
- Sensitive data
- Data subject rights
- Erasure and deletion
- Data portability
- Profiling
- Automated decision-making
- Data breach
- Security
- Cross-border transfers
- Data protection officer
- Controller and processor
- Biometrics
- Government data
- Retention
- Enforcement and penalties
- Transparency
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.