PDPA (Thailand) · Personal Data Protection Act B.E. 2562 (2019)
Thailand PDPA compliance and requirements, with consent, rights and breach handling you can evidence.
Thailand's Personal Data Protection Act requires every data controller to justify, secure and account for the personal data it holds. Sterling's expert and experienced consultants turn those duties into working notices, records, contracts and procedures with your legal, HR and technology teams, in 60+ countries. We help our clients put it into practice and prove it.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced data protection consultants, building privacy programmes across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not certify; no certificate exists under the Act
8,100+ client engagements in 60+ countries.
Data protection client experience
What it is
What is the Thailand PDPA and what is it used for?
The Personal Data Protection Act, B.E. 2562 (2019) is Thailand's general data protection law. It governs how a data controller, the party that decides why and how personal data is handled, and a data processor, the party acting on its instructions, collect, use and disclose information about identifiable people. It is administered by the Personal Data Protection Committee and its Office.
In practice the Act requires whether you can show why you hold each piece of personal data, that the person was told, that it is safe, and that you respond properly to requests and incidents. This page covers Thailand only; Singapore's law of the same abbreviation is a separate statute with its own regulator.
Current text. The Act was published in the Government Gazette on 27 May 2019. Section 2 brought the Committee provisions into force the next day and set the operative chapters, including controller duties, data subject rights, complaints, civil liability and penalties, to follow one year after publication. The Committee has since issued notifications under the Act, among them criteria for transferring personal data abroad under section 29, issued in B.E. 2566 (2023).
Who it is for
Who needs Thailand PDPA compliance?
Any organisation that handles personal data in Thailand, whatever its size, is inside the Act, and so is a business abroad that sells to people in Thailand or tracks their behaviour there. Organisations usually come to Sterling for one of four reasons:
- Customers want proof before they share data. Enterprise clients send privacy questionnaires and ask for your records of processing and breach procedure before they sign.
- A tender or partner agreement names the Act. Procurement and outsourcing contracts make compliance a condition, often with audit rights.
- A complaint, request or incident exposed a gap. Someone asked for a copy of their data or a vendor lost a file, and nobody knew who should act.
- Group companies need one approach. A regional or global group wants its Thai entity aligned with the GDPR or other privacy laws it already follows, without two sets of paperwork.
Requirements
What are the main Thailand PDPA requirements?
The Act is arranged in seven chapters: the Committee, personal data protection, the rights of the data subject, the Office, complaints, civil liability and penalties. The list below summarises them in plain language; your programme is checked against the Act's own text and the Committee's notifications, and we work alongside your legal advisers on interpretation.
- Consent (section 19): collect, use or disclose personal data only with consent, unless another basis in the Act applies, and let people withdraw it.
- Notice to data subjects (section 23): tell people the purpose, retention period, recipients and their rights.
- Other lawful bases (section 24): contract, legal obligation, legitimate interests, vital interests, public tasks and research, each recorded against the activity it supports.
- Sensitive personal data (section 26): categories such as health, biometric, genetic and criminal record data need explicit consent or a listed exception.
- Transfers abroad (sections 28 and 29): send data out of Thailand only to adequate protection or under the Act's exceptions and safeguards, including group policies.
- Data subject rights (sections 30 to 36): access, portability, objection, erasure or anonymisation, restriction and rectification, handled within a working procedure.
- Controller duties (section 37): appropriate security, erasure when retention ends, breach notice to the Office without delay and, where feasible, within 72 hours, notice to people when the risk is high, and a Thai representative for controllers abroad.
- Records, processors and DPO (sections 39 to 41): records of processing, processors acting on instructions, and a data protection officer where the Act's triggers apply.
What does useful Thailand PDPA evidence look like?
A record of processing that matches the systems in use, with the basis for each purpose; privacy notices for customers, staff and applicants; consent and withdrawal records; processor agreements; a retention schedule with erasure logs; a breach register showing how each incident was assessed and whether the Office was told; a rights request log; and training records. We build these from your real processing in Effivity.
Compliance route
How do you become Thailand PDPA compliant?
There is no application, registration of the programme or certificate at the end. Compliance is something you operate every day and show when a customer, a data subject or the Office asks. The route we follow has five steps.
- 01Map the personal data and your role.List entities, systems and activities, decide where you act as controller or processor, and confirm whether section 5 reaches you from abroad.
- 02Gap analysis: measure current practice against the Act.Test current practice against each duty, keep what works and agree actions, owners and dates.
- 03Build and run the controls.Rewrite notices, record bases, fix consent capture, sign processor terms, set retention and erasure, write the breach and rights procedures and train staff.
- 04Audit and review.An internal audit against the Act and a management review test whether the controls operate; findings are raised by us first and closed with evidence.
- 05Answer checks and keep it current.Respond to customer due diligence and data subject requests from existing evidence, track new Committee notifications and repeat the audit each year.
Check the route before you sign. Nothing in the Act issues or recognises a "PDPA certificate", so treat any offer of one as a warning. If your customers want an audited certificate, the credible option is ISO/IEC 27701 from a certification body whose accreditation you can verify with the accreditation body; accreditation recognition runs through the Global ACI arrangement. The certification buyer's checklist
Cost
How much does Thailand PDPA compliance cost?
The cost follows the amount of personal data you handle and how far current practice is from the Act. Every Sterling proposal shows each component and one all-inclusive proposal.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | Processing activities to map, notices and consent journeys to rebuild, vendors to contract, entities in scope and whether your team takes the lead (Design™) or we do (Drive™) |
| Independent review | None is required by the Act; any ISO/IEC 27701 certification body you choose is quoted separately, and customer audits cost time rather than fees |
| Internal resources and legal | Time from process owners, the DPO or privacy lead, IT effort for security, logging and erasure, training hours and your legal advisers' review |
| Software and learning | Included in a Sterling engagement: Effivity to run the programme and Sterling Academy access for your people, with users, courses and access period confirmed in the proposal |
| Continued support | Annual internal audits, tracking of Committee notifications, refresher learning and updates under Sustain™ |
What moves the price
- Volume and sensitivity of the data, especially health, biometric or children's data
- Number of entities, sites and languages for notices
- How many vendors and cross-border transfers need contracts
- Whether consent and erasure need system changes
- Whether other privacy laws apply in the same group
What a Sterling proposal always shows
- Deliverables, responsibilities, assumptions and exclusions, in writing
- Any certification-body fees for ISO/IEC 27701 identified separately
- Effivity, training and Academy access itemised at no additional cost
- Payment milestones linked to deliverables
- One all-inclusive proposal, agreed before work starts
Timeline
How long does Thailand PDPA compliance take?
Our planning estimate is three to nine months, confirmed for each client after the gap analysis. It runs shorter where an ISO/IEC 27001 system, a data inventory and vendor contracts already exist, and longer where apps, websites or HR systems must be changed to capture consent or erase data.
| Phase | What determines the pace |
|---|---|
| Mapping and gap analysis | Access to system owners, vendor lists, current notices and HR files |
| Build and implementation | Decisions on bases and retention, system changes, contract negotiation and training |
| Evidence and review | Procedures operating long enough to produce records, a breach exercise, internal audit and management review |
| External checks | Customer due diligence and, if you choose it, the ISO/IEC 27701 certification body's schedule |
Your engagement
What your Thailand PDPA engagement includes
Sterling does not certify, and no one can certify compliance with the Act; we build and prove the programme, and the Committee and its Office remain the authority. The engagement follows Sterling OS™. You choose one support level: Design™, where we guide and your team does the work, or Drive™, where we manage and deliver it with you. Sustain™ keeps the programme running after go-live, and Automate™ is Effivity, where the whole programme lives.
Data map, gap analysis and plan
Controller and processor roles, bases and priorities agreed before work starts.
Notices, procedures and contracts
Privacy notices, consent wording, rights and breach procedures and processor terms, built with your teams and legal advisers.
Effivity ISO & GRC software
Records of processing, registers and logs in Effivity, included with the engagement at no additional cost.
Training for everyone
Internal auditor training, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Internal audit and management review
An audit against the Act, a review with leadership and findings closed with evidence.
Readiness for external checks
An evidence package for customer due diligence and, if wanted, preparation for ISO/IEC 27701.
No certificate exists under the Act; compliance is overseen by the Personal Data Protection Committee and its Office.
Often combined with
Standards organisations pair with PDPA (Thailand)
- ADGM Data Protection Regulations 2021ADGM data protection compliance for entities under the 2021 Regulations: lawful bases, DPO, impact assessments, 72-hour breach notice and transfers, all-inclusive proposal.
- APEC CBPRAPEC CBPR certification and requirements explained: Global CBPR and PRP, Accountability Agent review, annual renewal and how Sterling prepares your team.
- APPI (Japan)APPI compliance for Japan's Act on the Protection of Personal Information: the requirements, PPC breach reporting, cross-border rules and an all-inclusive programme.
- Bahrain PDPLBahrain PDPL compliance and requirements explained: consent, notification to the Authority, transfers abroad, 72-hour breach reporting, rights, cost and timing.
- CCPA / CPRACCPA compliance and requirements under the CPRA: notices, consumer rights, opt-outs, risk assessments, cybersecurity audits and ADMT, in an all-inclusive programme.
- Cyber and Data Protection Act (Zimbabwe)Zimbabwe's Cyber and Data Protection Act [Chapter 12:07]: POTRAZ licensing, lawful processing, security and transfers, built into a programme.
Effivity · privacy programme software, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of the Thailand PDPA.
Every Sterling Thailand PDPA engagement includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant sets up the workspace within the agreed scope, so the record of processing, consents, rights requests, breaches, vendors, training and reviews sit in one place and your team works the programme instead of chasing spreadsheets. Sterling consulting clients get their Effivity subscription included with the engagement, at no additional cost.
Entities, systems and controller or processor roles
Which companies, systems and activities are in scope and the role each plays, kept in one register that changes when the business does.
Notices and consent records
Notice versions by audience, the consent wording used and when it changed, with withdrawals recorded and acted on.
Record of processing
Each activity with its purpose, basis, data categories, recipients and retention, so the answer to "why do we hold this?" is on screen.
Requests from start to close
Access, portability, objection, erasure, restriction and correction requests logged, assigned, answered and evidenced.
Incidents and breach decisions
Each incident assessed for risk, with the decision on telling the Office and the people affected, and the clock visible to the owner.
Vendors, contracts and transfers
Processors with signed terms and review dates, and every transfer out of Thailand linked to its safeguard or exception.
Internal audit and management review
Audit plans, findings, corrective actions and review minutes, with owners and dates tracked to closure.
Your own forms and reports
Forms, workflows and reports adapted to how your teams work, without code, including legal requirements linked to the processes they affect.
What this means when someone checks
A customer's privacy assessor or a data subject's complaint asks for the same things: the record of processing, the notice that applied, the consent, the request log, the breach decision. In Effivity each is a screen with dates, owners and evidence attached. Under Sustain™ the same workspace carries the annual audit and review, so the programme keeps running between checks.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Existing registers and records migrated, not retyped
- Admin and user training for your team
- Modules for EMS, OHSMS, ISMS, FSMS and more when you integrate other standards
Sterling Academy · data protection e-learning
Train everyone who touches personal data in Thailand.
Sterling Academy offers e-learning with video lessons, practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online. Sterling consulting clients benefit from preferential Sterling Academy course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- Awareness for every employee who collects, views or shares personal data
- Deeper learning for HR, marketing, IT and the privacy lead
- Internal auditor training for your audit team, as applicable to your standard, as part of the engagement
- Progress by department, ready for a customer's due diligence
- New joiners trained as they arrive, so records stay current
Where we work
Where Sterling delivers PDPA (Thailand)
Keep exploring
Explore more about PDPA (Thailand)
Why Sterling
Why choose Sterling for Thailand PDPA compliance?
Most groups with Thai operations also answer to other privacy laws and to customers with their own questionnaires. Sterling builds one programme with a Thai layer where the Act differs, so your people follow one set of procedures and the evidence answers every audience.
60+ countries since 2003
Management systems and compliance programmes for organisations in every region we serve, with offices in 21 countries and one engagement team across all of yours.
All-inclusive proposal
Consulting, Effivity, training and Academy access in one proposal, with any certification-body fees shown on their own line.
Built around real processing
Notices, records and procedures written from how your systems and teams actually handle data, not from a generic pack.
Expert and experienced consultants
Consultants who have built privacy and information security programmes across sectors and countries, and who work alongside your legal advisers rather than replacing them.
The Sterling Promise
What the Sterling Promise means for your Thailand PDPA programme
We stay with you until your agreed Thailand PDPA programme outcome is achieved, supporting implementation, preparation for customer checks and the closure of audit findings. Clear explanations, practical delivery, included software and employee learning turn the investment into lasting capability.
The engagement identifies the law, scope, outcome and responsibilities. Your organisation supplies accurate information and puts the agreed controls into use. The Personal Data Protection Committee and its Office retain their authority over compliance, and your legal advisers give legal advice. Our commitment concerns the agreed programme support, not a promise about any future complaint, incident or regulatory decision.
FAQs
Frequently asked questions about the Thailand PDPA
Does the Thailand PDPA apply to companies outside Thailand?
Yes, in two situations set out in section 5: when a company abroad offers goods or services to people in Thailand or monitors their behaviour taking place in Thailand. A controller caught this way must also appoint a representative in Thailand under section 37. Controllers and processors based in Thailand are covered wherever the processing takes place.
Do we need a Data Protection Officer under the Thailand PDPA?
Only if one of three triggers in section 41 applies: you are a public authority announced by the Committee, your activities need regular monitoring because of a large amount of personal data as announced by the Committee, or your core activity is processing sensitive data.
Who enforces the Thailand PDPA?
The Personal Data Protection Committee, with the Office of the Personal Data Protection Committee as its operational arm. Complaints go to expert committees, which can investigate and order a controller or processor to correct what it is doing. The Act also provides for civil liability to people harmed and for criminal and administrative penalties.
Can we transfer personal data out of Thailand?
Yes, where the destination has an adequate standard of protection under the Committee's rules, or where one of the Act's exceptions or safeguards applies, such as a group data protection policy under section 29. The Committee issued criteria for section 29 transfers in B.E. 2566 (2023).
How is the Thailand PDPA different from the GDPR?
The two share much of their design: controllers and processors, several lawful bases, a set of individual rights, a 72-hour window for breach notice where feasible and triggers for a data protection officer. The Thai Act has its own wording, regulator, notifications and penalty regime, so a GDPR programme is a strong starting point but needs a Thai review of notices, bases, transfers and breach handling.
Keep exploring
More on PDPA (Thailand) and related standards
More in Privacy & data protection
Talk to a consultant
Plan your Thailand PDPA compliance programme with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice