{"text_format":"2","workbook":"xlsx","n_sheets":2,"sheets":["Coversheet","Global Data Privacy Guide"],"not_rendered":{"charts":0,"images":1,"macros":0,"external_links":0,"defined_names":0,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"run_cost":"one","rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Coversheet","index":0,"n_rows":12,"n_cols":3,"rows_kept":12,"cut":false,"hidden":false,"merged":[]}
[]
[]
[null,"Prepared By:","Contributors:"]
[null,"Tilleke & Gibbins"]
[]
[]
[]
["Global Data Privacy Guide"]
[]
["Report Generated: 11/19/2025"]
[]
["View your report results on next tab"]

{"sheet":"Global Data Privacy Guide","index":1,"n_rows":29,"n_cols":2,"rows_kept":29,"cut":false,"hidden":false,"merged":[]}
["Question","Thailand"]
["Key Legislation Overview"]
["1. What is the key legislation?","The key personal data protection legislation in Thailand is the \nPersonal Data Protection Act B.E. 2562 (2019) (“\nPDPA”), which became fully effective and enforceable on June 1, 2022. \n"]
["2. What are the key decisions applying that legislation?","In August 2024, the Personal Data Protection Committee (“\nPDPC”) announced the imposition of an administrative fine on the retail company for the first time in the amount of THB 7 million for failure to (a) appoint a data protection officer, (b) implement adequate security measures, and (c) comply with the data breach notification obligation.\n"]
["Key Data Protection Provisions"]
["1. How are “personal data” and “sensitive data” defined?","The term “personal data” is defined under the \nPDPA as any data pertaining to a living individual that enables identification of said individual, whether directly or indirectly. There is no reference to the term “sensitive data” in the \nPDPA. However, Section 26 of the \nPDPA provides the list of personal data which is subject to different requirements in terms of legal bases, i.e. personal data pertaining to ethnicity, race, political opinions, doctrinal, religious or philosophical beliefs, sexual behavior, criminal records, health records, disability, labor union, genetic data, biometric data, or any other data which may affect the Data Subject in the same manner as prescribed by the \nPDPC.\n"]
["2. How is the defined data protected?","The \nPDPA imposes various obligations for the collection, use, disclosure, transfer, deletion, and/or otherwise processing of personal data. See Question 5 for more information. \n"]
["3. Who is subject to privacy obligations?","The\n PDPA imposes obligations on two main key players, which are data controller (i.e. a person or legal entity who/which having authority to make determination on the collection, use or disclosure of personal data) and data processor (i.e. a person or legal entity who/which collects, uses or discloses personal data for or on behalf of the data controller). \nData controllers and data processors located in Thailand must comply with the \nPDPA regardless of where the collection, use or disclosure of personal data takes place. The \nPDPA also has extraterritorial effect which means that data controllers and data processors in other jurisdictions will also be obligated to comply with the\n PDPA if they collect, use or disclose personal data of the data subject in Thailand to (a) offer him/her goods or services, irrespective of whether payment is made or not; or (b) monitor his/her behavior which takes place in Thailand. \nThe \nPDPA does provide exemptions from being subject to its provisions – for example, when the processing is for personal interest or household activity of that person, when the act is carried out by the government agencies responsible for maintaining state stability (including anti-money laundering and cybersecurity), and others.\n"]
["4. How is “data processing” defined?","The \nPDPA does not define nor refer to the term “data processing.” However, it could be referred to the collection, use, disclosure, transfer, retention, deletion, and/or otherwise processing of personal data. \n"]
["5. What are the principles applicable to personal data processing?","The principles applicable to personal data processing under the \nPDPA include data minimization, purpose limitation, accuracy, storage limitation, lawfulness, fairness, and transparency. These principles are not expressly indicated in the \nPDPA itself; however, these principles can be implied from the provisions of the \nPDPA.\n"]
["6. How is the processing of personal data regulated?","In general, the \nPDPA only permits the processing of personal data where the lawful basis can be identified – for example, consent, legitimate interest, contractual obligations, legal obligations, etc.\n"]
["7. How are storage, security and retention of personal data regulated?","The \nPDPA does not set out specific regulations for the storage of personal data. However, it does impose requirements on the security and retention of personal data.\nThe \nPDPA provides that the data controller must implement adequate personal data protection measures to prevent loss, unauthorized or unlawful access, use, modification, alteration, or disclosure of personal data, and to review such measures when necessary or when there is a change in technology. The security measures must at least satisfy the minimum standards prescribed by the \nPDPC.\nWith regard to the retention of personal data, the \nPDPA does not impose a specific period for which personal data is to be retained; however, it does impose an obligation on the data controller to implement a monitoring system (1) for the deletion or destruction of personal data at the end of its retention period; (2) when it is no longer necessary or relevant for the purposes for which it has been collected; (3) as requested by the data subjects; or (4) when the consent is withdrawn by data subject, unless otherwise exempted. \n"]
["8. What are the data subjects' rights under the data legislation?","Subject to the conditions of the \nPDPA, the data subjects are entitled to the right to access, right to data portability, right to erasure, right to object, right to suspension, right to rectification, right to withdraw consent and right to lodge a complaint to the authority. \n"]
["9. What are the consent requirements for data subjects?","For the consent to be valid and binding, consent request must be made in accordance with the requirements under the \nPDPA – for example, consent request must be made in writing or via electronic means, unless impossible by its nature; consent request must use plain language; consent request must not be conditional for the entering into contract or provision of service which is not relevant; consent request must be made prior to or at the time of collection, use or disclosure of personal data, etc. \n"]
["10. How is authorization for use of data handled?","To use personal data, there must be an appropriate lawful basis. Any use of personal data which does not rely on consent must be recorded in the record of processing activities (“\nRoPA”). The \nPDPA further stipulates that the use of personal data must also be limited to the scope of purposes which have been informed to the data subjects unless it is otherwise permitted by the \nPDPA.\nFurther to the above, any person or legal entity receiving personal data from the data controller must not use or disclose personal data for purposes other than those for which have been informed to the data controller to acquire such data. \nIt should also be noted that the \nPDPC’s Notification Re: Security Measures of the Data Controller B.E. 2565 (2022) stipulates that the security measures to be implemented in relation to the use of personal data must at least consist of access control, identity proofing and authentication, user access management, user responsibilities, audit trails, etc.\n"]
["11. Are cross-border data transfers regulated? If so, what are the restrictions on cross-border data transfers?","Yes, the \nPDPA regulates cross-border transfers by imposing restrictions and requirements. Generally, a cross-border transfer is permitted if the destination country or the international organization that receives the personal data has adequate personal data protection standards in place, or if the cross-border transfer falls within any of the permitted activities prescribed by the \nPDPA – for example, when the data subject has been informed of the inadequacy of the personal protection standards of the destination country or the international organization and has granted consent to the cross-border transfer, or when an intra-group policy has been implemented for the cross-border transfer of personal data among group companies and has been examined and certified by the Office of the \nPDPC, or when the contractual clause is entered into.\n"]
["12. How are data \"incidents\" and \"breaches\" defined?","According to the \nPDPC’s Notification Re: the Rules and Procedures For Personal Data Breach Notification B.E. 2565 (2022), \"personal data breach\" is defined as \"any breach of security that leads to loss, or unauthorized or unlawful access, use, change, alteration, or disclosure of personal data, whether such breach occurs intentionally, willfully, by negligence, without authorization or unlawfully, computer crime, cyber threat, any mistake, accident, or any other reasons.\n"]
["13. Are there any notification requirements for incidents and/or data breaches?"," Yes, there are notification requirements for data breaches under the PDPA: \n \n Data controllers must notify the Office of the PDPC of a data breach without delay and within 72 hours upon becoming aware of the breach, unless such a breach has no risk of affecting the rights and freedoms of an individual. If the risk is high, apart from notifying the Office of the  PDPC , the data controller must also notify the data subject of said breach, together with remedial action, without delay.  \n The data processor must notify the data controller of a data breach without delay and within 72 hours upon becoming aware of the breach. \n "]
["14. Who is/are the privacy regulator(s)?","The Office of the \nPDPC is the regulator under the \nPDPA. \n"]
["15. What are the consequences of a data breach?","A data breach occurs from inadequate security measures. Failure to implement adequate security measures that at least meet the minimum standards set forth by the \nPDPA could result in liabilities and penalties. See Question 22 for more information. \n"]
["16. How is electronic marketing regulated?","From the \nPDPA perspective, similar requirements and obligations apply to the processing of personal data for the electronic marketing purpose.\nApart from the \nPDPA, it should be noted that sending electronic marketing is regarded as an offence under the \nComputer Crimes Act B.E. 2550 (2007) for causing disturbance to the recipient. Sending such electronic marketing will not be considered an offense if (a) consent has been obtained from the recipient; and (b) each electronic marketing communication contains marks, details and procedures for which the recipient can easily opt out/unsubscribe from receiving such communication.\n"]
["17.\tAre there sector-specific or industry-specific privacy requirements?","Yes, apart from the \nPDPA, other industry-specific legislations are prescribing personal data protection requirements and obligations – for example, the \nNational Health Act B.E. 2550 (2007) and the \nMental Health Act B.E. 2551 (2008) which apply to the healthcare industry, the \nNotification of the National Broadcasting and Telecommunications Commission Re: Measures to Protect Telecommunications Service Users’ Rights Regarding Personal Data, Privacy Rights, and Freedom of Telecommunications which was issued by virtue of the \nTelecommunications Business Act B.E. 2544 (2001) which applies to the telecommunication business industry, and the \nCredit Business Information Business Act B.E. 2545 (2002) which applies to financial industry. \n"]
["18.\tWhat are the requirements for appointing Data Protection Officers or similar roles?"," Obligation to appoint a DPO becomes mandatory under any of the following circumstances:  \n \n The data controller or data processor is a state agency as prescribed by the PDPC ;  \n The activities of the data controller or data processor in relation to the processing of the personal data require “regular monitoring of the personal data or the system” by reason of “having large-scale personal data;” or  \n The core activity of the data controller or data processor is related to the processing of sensitive personal data (i.e., the categories of personal data listed in Section 26 of the PDPA ). \n "]
["19.\tWhat are the record-keeping and documentation obligations?","The \nPDPA imposes obligations on the data controllers and data processors to maintain the \nRoPA, either in written or electronic form. The \nRoPA must at least contain the information required by the \nPDPA. \nCertain data controllers and data processors may be exempted from the \nRoPA requirement – for example, if they are small or medium-sized businesses in accordance with the law on the small and medium-sized enterprise promotion. However, the exemptions are subject to further conditions prescribed by the \nPDPA. \n"]
["20.\tWhat are the requirements for conducting Data Protection Impact Assessments (DPIAs)?","The \nPDPA does not impose requirements for conducting \nDPIAs.\n"]
["21.\tWhat are the requirements for third-party vendor management and data sharing?","Where the data controller will disclose personal data to a third party, the \nPDPA imposes obligations on the data controller to ensure that such third party will not use or disclose the received personal data unlawfully or without authorization. \nApart from the above, for the relationship between data controller and data processor, the \nPDPA requires that there must be an agreement between them to ensure that the data processor will process personal data in accordance with its obligations under the \nPDPA.\n"]
["22.\tWhat are the penalties and enforcement mechanisms for non-compliance?"," Non-compliance with, or violation of, the PDPA could result in the following penalties and/or liabilities:  \n \n Civil liabilities: Actual damages and, in certain cases, punitive damages not exceeding twice the amount of actual damages. \n Administrative Penalties: Fine not exceeding THB 5 million, depending on the offence committed. For a non-severe offense, an administrative order will first be imposed, e.g., a rectification order, suspension order, etc. In case of severe offense or failure to comply with the administrative order, an administrative fine will be imposed. \n Criminal Penalties: Imprisonment for a term not exceeding 1 year and/or a fine not exceeding THB 1 million. For a legal entity, if the offence is committed due to the act or omission of its director, manager, or person responsible for its operation, such person will also be subject to the same criminal penalties. \n "]
["23.\tWhat are the ongoing compliance and audit requirements?","Currently, the\n PDPA does not have specific provisions on the audit requirements. In relation to the ongoing compliance, the data controllers and data processors must ensure compliance with the obligations and requirements under the\n PDPA throughout the period that they are processing personal data. \n"]
["24. Are there any recent developments or expected reforms?","The \nPDPC now becomes highly active in enforcing the \nPDPA against the offender, particularly where there is a data breach incident. Hence, it is crucial for all businesses to reassess their operations and ensure that they remain in compliance with the \nPDPA.\nThere have been discussions that the \nPDPA might be revised in the near future. \n"]