Thailand · Compliance
Thailand Personal Data Protection Act (PDPA) compliance in Thailand
Achieve Thailand Personal Data Protection Act (PDPA) compliance with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- Compliance, end to end
- Manila office team
- Effivity software included
- Academy training included
Who asks for Thailand Personal Data Protection Act (PDPA) in Thailand
Clients include
Thailand Personal Data Protection Act (PDPA) compliance in Thailand at a glance
Personal Data Protection Act, B.E. 2562 (2019) is the instrument itself: it applies to the organisations within its scope, and buyers and partners in Thailand ask for evidence that you meet it.
Thailand's Personal Data Protection Act, B.E. 2562 (2019), is overseen by the Personal Data Protection Committee and its Office, which publish the Act in English alongside subordinate legislation. One notification matters to any group with overseas affiliates or cloud providers: the PDPC's criteria for personal data sent or transferred to a foreign country, issued in B.E. 2566 (2023). There is no PDPA certificate. Compliance is evidenced through records of processing, privacy notices written for the people they address, contracts with processors, rights and breach procedures and security measures, and where a customer wants an outside benchmark the work can be aligned to ISO/IEC 27701 certification by an accredited certification body. Counsel should confirm how the Act's provisions apply to your own processing. Sterling's Manila office builds the compliance evidence for Thai clients, on site or remotely, with Effivity and Sterling Academy included in the engagement. Local questions are answered below.
Who needs Thailand Personal Data Protection Act (PDPA) in Thailand, and what happens without it
These are the organisations in Thailand that most often need to show Thailand Personal Data Protection Act (PDPA).
- Thai companies processing customer, patient or employee dataThe Act is Thailand's general personal data protection law and is overseen by the Personal Data Protection Committee.
- BPO, software and cloud providers acting as processors for othersProcessors take on obligations under the Act and are held to the controller's instructions and contracts.
- Groups that move personal data to other countriesThe PDPC has issued a notification on criteria for data sent or transferred to a foreign country.
Not sure which of these applies to you?Answer a short set of questions and your readiness report arrives by e-mail.
Take the free readiness checkThailand Personal Data Protection Act (PDPA) requirements in Thailand
Strip away the vocabulary and Thailand's PDPA asks a business to comply in six areas of personal data handling.
In Thailand these six sit alongside the local laws and regulations listed under drivers below; one system can evidence both. The detail is on the global hub: Thailand Personal Data Protection Act (PDPA) explained →
How to achieve Thailand Personal Data Protection Act (PDPA) compliance in Thailand
One team from the Manila office carries the work from scoping to sign-off. Clients across Thailand are served from Sterling's Manila office, on site where the work needs it and remotely otherwise.
- Discovery call and scopeEntities, locations, regulators and target date, agreed before any proposal.
- Gap assessment against Thailand Personal Data Protection Act (PDPA) and the Thai requirements that apply to youControls you already run for your regulators and customers are reused, not rebuilt.
- Your system built with your team in EffivityRisks, controls, evidence, incidents and reviews in one live system the auditor can see.
- Internal audit, management review and corrective actionsYour internal auditors trained by Sterling; the evidence proven before any external review.
- Reviews by regulators, customers and auditorsSterling supports the reviews your regulators, customers and auditors run.
- End to end, from one team
- Effivity ISO & GRC software
- Preferential Sterling Academy access, with complimentary awareness training for your people
- Internal auditor training for your audit team, as applicable to your standard
- Vulnerability assessment on ISMS engagements
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements.Sterling does not certify. Certification decisions stay with independent bodies.
How long does Thailand Personal Data Protection Act (PDPA) compliance take in Thailand?
There is no standard duration: it depends on your scope and on how much of the system already runs. In Thailand these are the factors that set the timeline.
- Number of systems and processing activities to map
- Number of group entities and vendors
- Cross-border transfer arrangements to review
Sterling agrees a dated plan with you on the discovery call, once the scope is known.
How much does Thailand Personal Data Protection Act (PDPA) compliance cost in Thailand?
The cost has two parts: the consulting work to build and prove the system, and any external assessor’s fees, which are quoted separately. In Thailand these factors move both.
- Volume and sensitivity of the personal data held
- Number of legal entities and processors involved
- Security and retention remediation found by the gap review
Sterling gives one customised, all-inclusive proposal after the discovery call, never before the scope is agreed.
Thailand Personal Data Protection Act (PDPA) consultants and assessors in Thailand
Two different organisations are involved. A consultant helps you build the system and prove it works; your regulators, customers and auditors then audits or assesses it and decides. Keeping the two separate is what makes the result credible to buyers and regulators.
- Check that the body’s accreditation or approval covers Thailand Personal Data Protection Act (PDPA) and your sector, and that its certificates can be verified online.
- Ask the consultant how the local requirements in Thailand are mapped into the same system, so nothing runs twice.
- Ask for client references in your sector; Sterling’s client letters are available on request.
- Agree who owns the evidence and the tool after the engagement; with Sterling the system stays yours, in Effivity.
Laws and regulations that drive Thailand Personal Data Protection Act (PDPA) in Thailand (2)
| Instrument | How it treats the standard |
|---|---|
| Personal Data Protection Act, B.E. 2562 (2019) | The instrument itself Personal data protection obligations; overseen by the Personal Data Protection Committee and its Office. |
| PDPC notification on criteria for personal data sent or transferred to a foreign country, B.E. 2566 (2023) | Subordinate legislation Transfers abroad under the Act's transfer provision; criteria not read in full. |
Accreditation, audit language and remote audits in Thailand
Compliance, not certification: there is no PDPA certificate. Evidence is the organisation's own records, notices, contracts, procedures and security measures. ISO/IEC 27701 certification by an accredited certification body is an optional external benchmark; it does not prove legal compliance. Edition and transition details: Thailand Personal Data Protection Act (PDPA) hub →
Audit language
Privacy notices should be written in the language of the people they address, which usually means Thai; internal records are often kept in English or Thai.
Remote and on-site
Data mapping and process workshops can be on site or remote; the Act does not prescribe an external audit.
Thailand Personal Data Protection Act (PDPA) in Thailand: questions clients ask
Who runs the PDPA in Thailand?
The Personal Data Protection Committee and its Office. The Act itself is the Personal Data Protection Act, B.E. 2562 (2019), and the PDPC publishes it in English with its subordinate legislation and notifications. Use the PDPC's own text as the reference for any obligation, and take advice from counsel for decisions about your specific processing.
Is there a PDPA certificate?
No. The PDPA does not create a certificate; compliance is shown through your records of processing, privacy notices, contracts with processors, rights procedures and security measures. An ISO/IEC 27701 certificate from an accredited body is an optional benchmark for customers who want one, not a legal safe harbour.
Do transfers of personal data abroad need special handling?
Yes, they need attention. The PDPC has issued a notification on criteria for the protection of personal data sent or transferred to a foreign country, made under Section 29 of the Act in B.E. 2566 (2023). Groups with overseas affiliates or cloud providers should map their transfers and read that notification with their counsel.
More on Thailand Personal Data Protection Act (PDPA) for Thai organisations
Other standards Thai businesses ask Sterling for
Organisations in Thailand often combine Thailand Personal Data Protection Act (PDPA) with one of these, under one management system where the scopes allow.
Start with a free discovery call from the Manila office
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Personal Data Protection Act, B.E. 2562 (2019) — pdpc.or.th (accessed 7 Oct 2026)
- PDPC notification on criteria for personal data sent or transferred to a foreign country, B.E. 2566 (2023) — pdpc.or.th (accessed 7 Oct 2026)
- Board of Investment (BOI) investment promotion — Investment Promotion Guide 2025 — osos.boi.go.th (accessed 7 Oct 2026)
Talk to a consultant
Plan your certification with the Manila team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
philippines@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice