does thailand's pdpa apply to your website? yes, almost always.

The base rule catches almost everyone. Section 5 paragraph one applies the Act to any collection, use or disclosure of personal data by a data controller or processor located in Thailand, regardless of where the actual processing takes place. If your company is registered or based in Thailand and you run a website that collects any personal data, you are inside the Act by default.

The extraterritorial test catches a foreign-run website too. If the controller or processor is outside Thailand, Section 5 paragraph two still applies the Act to their processing of a data subject who is in Thailand, if either they offer goods or services to that person in Thailand, paid or not, or they monitor that person's behaviour where it takes place in Thailand. This is the test that reaches a foreign-run website serving Thai visitors or customers. The consequence, under Section 37(5), is a duty to appoint a Thailand-based representative in writing, with no limitation of liability. A narrow exemption from that representative duty exists under Section 38, for a public authority or for a business that does not touch Section 26 sensitive data and does not hold a 'large amount' of personal data as defined in a separate Committee notification. We could not verify the exact numeric threshold for that 'large amount' test in our research, so we are not publishing a figure here; ask a lawyer to check it against your own data volumes.

There is no carve-out for a sole trader or a foreign-owned Thai company. The Act binds any natural person or juristic person acting as a controller or processor, on the same terms as any other Thailand-based entity. The one personal exemption, Section 4(1), covers collecting data 'for personal benefit or household activity' only, and that does not extend to a sole trader running a commercial website: that is business activity, not personal or household use.

There is no general small-business exemption either. The only real relief is a narrow exemption from keeping a formal Record of Processing Activities under Section 39 (and the mirrored processor duty in Section 40(3)), for a controller or processor that qualifies as a 'small organization' under a PDPC notification. That exemption does not apply if you are required to have a DPO, your processing risks data subjects' rights, your processing is not occasional, or you process Section 26 sensitive data. The exact employee and revenue bands for the 'small organization' test sit in a separate ministerial regulation that our research could not confirm precisely enough to publish as fact, so we are leaving the numbers out here rather than guessing; a lawyer can check your specific numbers against the regulation.

The first confirmed case, 21 August 2024, combined three violations. A private online retailer was fined THB 7,000,000 in total: no Data Protection Officer despite holding data on 100,000-plus customers (Section 41, via Section 82, up to THB 1,000,000), inadequate security that let a call-centre scam network exploit customer data (Section 37(1), via Section 83, up to THB 3,000,000), and failing to report the breach to the PDPC within the required window (also under Section 37, via Section 83, up to THB 3,000,000).

By 1 August 2025, a law firm bulletin reported at least five more cases in a single announcement, about THB 14.5 million that round, taking the running total of PDPC fines since enforcement began to beyond THB 21 million. Named cases included a government agency and its software vendor after a roughly 200,000-record breach caused by weak security and no data-processing agreement, a private hospital and its contractor over mishandled patient records and a delayed report, a cosmetics company fined THB 2.5 million after a leak exploited by scam operators, and a toy company and its processor fined a combined THB 3.5 million after a reservation-system breach exposing about 200,000 records. The smaller figures in that round are approximate, rounded in the reporting bulletin rather than confirmed against the PDPC's own published decision text.

The pattern across every confirmed case is the same: an actual breach with real harm, usually feeding scam or fraud, combined with a missing DPO, a late or missing breach report, or weak security. No confirmed case found in our research was a fine issued purely for a cookie-consent or privacy-notice wording problem, absent an underlying breach. Read that as where the real risk sits: security, DPO coverage and breach reporting, not banner copy.

Section 23 sets out exactly what has to be in your privacy notice, given to the data subject before or at the time you collect their data, unless they already know it. Six things, checkable against your own site right now:

• 01

  why you are collecting it. the purpose or purposes, including any purpose you rely on without consent under section 24.

• 02

  whether it is required. whether giving the data is required by law or contract, and what happens if the person does not provide it.

• 03

  what, and for how long. what data is collected, and the retention period, or the retention standard you apply if you cannot give a fixed period.

• 04

  who else sees it. the categories of people or organisations the data may be disclosed to.

• 05

  who to contact. your own contact details, plus your representative or dpo where you have one.

• 06

  their rights. a plain statement of the data subject's rights: withdrawal of consent, access, portability, objection, erasure, restriction, rectification, and complaint.

We read all 96 sections of the primary Act text directly for this page, and the word cookie never appears once. Thailand has no ePrivacy-style statute sitting next to the PDPA the way the EU does. Cookie compliance here is the Act's general consent and legitimate-interest rules applied to cookies, not a codified cookie regime with a mandated banner format.

Section 19 sets consent as the default: no collection, use or disclosure without the data subject's consent, unless another provision allows it. Section 24(5) is one of those provisions: it lets a controller skip consent when processing is 'necessary for legitimate interests,' unless overridden by the data subject's fundamental rights, structurally close to GDPR's Article 6(1)(f).

Whether ordinary analytics or ad pixels, Google Analytics or a Meta Pixel, can rely on Section 24(5), or need Section 19 consent instead, is genuinely not settled by the text, and we found no PDPC notification that answers it either way. Several cookie-consent vendors state flatly that only strictly necessary cookies can skip consent, but none of them cite a PDPC instrument saying so, and they sell the banner that answer implies you need. That is not proof they are wrong, it is a reason to treat it as a vendor's claim rather than settled law until a lawyer or the PDPC says otherwise.

A practical, cautious default while this stays unsettled: strictly functional or session cookies with no personal identifier are the lowest-risk case. Anything that ties browsing to an identifiable person, including through a third party like Google or Meta, is the higher-risk case, and asking for consent there is the conservative choice, not a house rule we are asserting as law. Ask a Thai data protection lawyer about your own setup before you decide either way.

Only two clocks in the Act carry an explicit day count. A valid access request under Section 30 must be answered within 30 days, and a refusal must be recorded with reasons. If you collected data from a source other than the data subject, Section 25 requires you to notify them within 30 days of collection, or at first contact or first disclosure if that comes sooner.

Every other right runs without a stated deadline. Objection, including to direct marketing (Section 32), requires you to segregate the data immediately once it is raised, but sets no day count for a full response. Erasure (Section 33) and restriction (Section 34) have no stated deadline either; if you ignore a valid request the remedy is a complaint to the expert committee, which can order compliance. Rectification (Sections 35 to 36) follows the same pattern: no deadline, but a recorded reason if you refuse. Portability (Section 31) states no deadline at all.

This is a genuine, checkable difference from GDPR, which gives a uniform one-month response window across every data subject right under Article 12(3). Treating every PDPA request as if it carries the same GDPR-style one-month clock is a common and understandable mistake worth correcting: only access requests and third-party-source notices actually have one.

Section 37(4) requires a data controller to notify the Office of the PDPC of a personal data breach without delay, and where feasible within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of the people affected.

If the breach is likely to cause a high risk, you also have to notify the affected data subjects and tell them what remedial steps you have taken, without delay. There is no 72-hour figure attached to that second notification, only 'without delay.'

A data processor's duty is narrower: notify the controller of any breach it detects (Section 40(2)). The processor does not notify the PDPC directly; that stays the controller's job.

Almost every website sends data overseas without thinking about it, through analytics, ad platforms, or an overseas host. Section 28 says a controller may only transfer personal data to a destination the Committee has found has adequate protection standards, unless a specific exception applies: legal compliance requires it, the data subject consented after being told the destination is inadequate, it is necessary to perform a contract with them or take pre-contract steps at their request, it is necessary under a contract with a third party for their benefit, it is needed to prevent a danger to life, body or health when they cannot consent, or it serves a substantial public interest.

Section 29 gives a group-transfer alternative: an Office-certified Personal Data Protection Policy, similar in shape to GDPR's binding corporate rules, or, absent both an adequacy finding and a certified policy, 'suitable protection measures' guaranteeing enforceable rights and real remedies. The PDPC issued cross-border transfer notifications in December 2023, with a compliance deadline of 24 March 2024.

What we could not confirm in our research, and did not want to guess at: whether the Committee has published a specific list of 'adequate' countries that includes, say, the EU or the US, which matters enormously if your stack runs on Google Analytics, Meta ads, or an overseas host. That is a real open question, not a settled fact either way, and exactly the kind of thing to bring to a Thai data protection lawyer for your specific vendor list rather than assume from a blog post, including this one.

None of this is a ranking of which law is stricter overall, it is the list of places where copying a GDPR checklist onto a Thai business gets something wrong.

• 01

  fines are flat, not turnover-based. pdpa caps at thb 5,000,000 per provision. gdpr can reach eur 20 million or 4% of global turnover, whichever is higher. a small thai business faces a smaller absolute number, but one that can still be existential for it.

• 02

  personal criminal exposure is real here. section 81 can put a director or manager in prison for up to a year if the offence came from their order or their failure to instruct compliance. gdpr leaves criminal sanctions to individual eu member states and has no direct equivalent built in.

• 03

  punitive damages exist, capped at 2x. section 78 lets a thai court award up to two times actual compensation. gdpr's article 82 is compensatory only, no punitive multiplier.

• 04

  no cookie law sits next to the pdpa. the eu layers a specific eprivacy regime on top of gdpr with codified cookie-banner practice. thai cookie compliance is genuinely less settled in law.

• 05

  the deadlines are not uniform. gdpr gives one month across every data subject right. pdpa gives 30 days for access and third-party notice only, and states no deadline for erasure, restriction, objection or portability.

Drawn from the confirmed enforcement record and the sections above, not a generic checklist.

• 01

  cookie banner up, everything else ignored. every confirmed pdpc fine to date has been for the substance, a breach, a missing dpo, a late report, not for cookie-banner wording.

• 02

  assuming 'we're too small to be covered.' the only real small-business relief is a narrow exemption from formal record keeping. it does not touch consent, security or breach notification, and a sole trader running a commercial site is not covered by the personal or household exemption either.

• 03

  quoting 'up to thb 5 million' as an absolute per-incident ceiling. the first confirmed case already totalled thb 7 million by combining fines across three provisions in one incident.

• 04

  assuming analytics and ad pixels are automatically fine under 'legitimate interest.' whether section 24(5) covers them is genuinely unsettled, and separately, sending that data overseas is its own question under section 28.

• 05

  missing the two deadlines that actually exist while assuming a general gdpr-style one month applies to everything. only access requests and third-party-source notices carry a stated 30-day clock.