Thailand’s PDPA closely follows the GDPR, with lawful bases, rights, DPO and breach duties and extraterritorial reach. The regulator has issued numerous subordinate rules and has begun issuing administrative fines.
Digital platforms serving Thai users may also need to notify the Electronic Transactions Development Agency under the digital platform services decree.
- Core data law
- Personal Data Protection Act B.E. 2562 (2019)
- In force
- 1 Jun 2022
- Regulator
- Personal Data Protection Committee (PDPC)
- Breach notice
- Within 72 hours to the regulator
- Platforms
- Digital Platform Services Decree (ETDA)
- Penalties
- Administrative fines up to THB 5 million; civil and criminal liability
Who needs to comply
Startups processing personal data of people in Thailand
The PDPA applies to processing in Thailand and to offshore controllers offering goods or services to, or monitoring, people in Thailand.
Digital platforms
Platform operators serving Thai users may need to notify ETDA and meet transparency duties.
The laws, in detail
01Personal Data Protection Act (PDPA)
Lawful bases, consent, rights, DPOs, records, breach notification and transfers.
When it applies
Processing in Thailand, or offshore processing targeting or monitoring people in Thailand.
What you must do
- Lawful basis and clear privacy notice
- Explicit consent for sensitive data
- Breach notification to the PDPC within 72 hours
- DPO for large-scale or sensitive processing
- Local representative for offshore controllers
- Transfer safeguards for data leaving Thailand
Regulator
Personal Data Protection Committee
Penalties
Administrative fines up to THB 5 million, punitive civil damages and criminal penalties.
02Digital Platform Services Decree
Notification and transparency for digital platform operators.
When it applies
Platforms serving users in Thailand above thresholds.
What you must do
- Notify ETDA
- Publish terms and complaint handling
- Local coordinator for some foreign platforms
Regulator
ETDA
Penalties
Fines and orders.
03Cybersecurity Act 2019
Cyber threat prevention and duties for critical information infrastructure.
When it applies
CII organisations and organisations under regulatory authorities.
What you must do
- Cybersecurity codes of practice and risk assessments
- Report cyber threats
- Cooperate with the NCSA
Regulator
National Cyber Security Agency (NCSA)
Penalties
Fines and orders.
04Computer Crime Act
Computer offences and service provider log retention.
When it applies
Service providers in Thailand, including online platforms.
What you must do
- Retain computer traffic data for at least 90 days
- Remove unlawful content on court orders
Regulator
Ministry of Digital Economy and Society
Penalties
Fines and imprisonment.
05Digital Asset Business Emergency Decree 2018
Licensing of digital asset exchanges, brokers, dealers and ICO portals.
When it applies
Digital asset businesses serving Thailand, including some offshore providers.
What you must do
- Obtain an SEC licence
- Investor protection and custody rules
- AML/KYC compliance
Regulator
Securities and Exchange Commission Thailand
Penalties
Criminal penalties for unlicensed business.
Compliance checklist
01 · Before you launch
- Thai-language privacy notice
- Local representative if offshore
- Check ETDA platform notification
02 · At launch
- 72-hour breach process
- Records of processing
- Consent for sensitive data
03 · As you scale
- Appoint a DPO when thresholds are met
- Transfer safeguards and BCRs where useful
Key dates
- 1 Jun 2022PDPA fully in force
- Aug 2023Digital Platform Services Decree in force
Common mistakes
- No local representative for offshore controllers
- English-only notices
- Missing the 72-hour breach window
FAQs
Is Thailand’s PDPA like the GDPR?
Broadly yes: similar bases, rights and extraterritorial reach, with Thai-specific subordinate rules.
Sources
Reviewed 12 October 2026. General information, simplified for planning; not legal advice. Check current law before relying on any requirement, and get advice for your facts. For markets outside India, advice is coordinated with locally qualified counsel.