You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

January 30, 2026

Key Takeaways from Thailand’s Data Privacy Day 2026

Subscribe to Updates

Thailand’s Data Privacy Day 2026, hosted by the Office of the Personal Data Protection Committee (PDPC), underscored the country’s commitment to strengthening personal data protection, advancing regulatory maturity, and preparing organizations for the next phase of PDPA enforcement. The event marked a clear shift from policy-level compliance toward “Privacy in Action,” signaling that operational readiness and real-world implementation are now priorities.

The Office of the PDPC also emphasized that data protection is now a national economic enabler that supports digital trust, competitiveness, and sustainable growth, not just a compliance obligation.

The following insights summarize the key takeaways from the Data Privacy Day 2026 event.

PDPA in Real Life: What Happens to Your Data Today

The Office of the PDPC provided concrete data on enforcement trends and real-world compliance issues facing organizations across Thailand.

Complaints and trends. The Office of the PDPC’s Personal Data Protection Act (PDPA) Center recorded 2,672 PDPA-related complaints as of January 2026, with the highest volumes involving failure to comply with the data minimization principle, collection without lawful basis, and use and disclosure without lawful basis.

Administrative penalties. Several administrative penalties have been imposed on data controllers and data processors across various sectors, including government, healthcare, retail, SMEs and e-commerce, ranging from tens of thousands to several million baht. Most violations stemmed from weak security measures, failure to notify data breaches within the required timeline, absence of a data protection officer (DPO) when required, and noncompliance with governance requirements such as the Record of Processing Activities (ROPA) and data processing agreements with data processors.

Case studies. The Office of the PDPC highlighted specific examples of violations:

  • Hospitals misused personal data for purposes beyond their intended scope (e.g., using personal data collected for providing medical services to send birthday cards)
  • Vendors compromised systems due to inadequate password protocols and the absence of firewalls, resulting in unauthorized access

AI and Privacy: Regulatory Expectations in the Emerging Landscape

Thailand is moving toward a clearer regulatory framework for AI, with the AI Act currently in draft form. While the PDPA does not regulate AI itself, it governs personal data used within AI systems, meaning organizations, not the AI, remain fully accountable for any misuse or unlawful processing of personal data.

Key expectations highlighted for businesses include:

  • The use of AI is allowed, but accountability remains fundamental. Organizations must take full responsibility for how personal data is processed through AI systems.
  • Strong resource and access governance is necessary. Organizations must prevent uncontrolled AI usage and avoid over-sharing of data through proper data classification to restrict AI access to relevant datasets.
  • AI deployment may trigger obligations under other laws. While there is currently no specific law regulating the use of AI, AI deployment may trigger obligations under civil and commercial law, road traffic laws in relation to autonomous systems, and other regulations, reinforcing the need for comprehensive risk assessment.
  • Alignment with forthcoming guidelines. The Office of the PDPC is currently developing practical guidelines on personal data protection in the use and development of AI technologies. Organizations should align AI use with these forthcoming guidelines aimed at supporting safe innovation while adhering to PDPA requirements.

International Cooperation and Cross-Border Transfers

Efforts continue to advance Thailand’s participation in the Global Cross-Border Privacy Rules (CBPR) and strengthen alignment with regional data-protection frameworks. Organizations operating across borders should expect tighter scrutiny of cross-border transfers, including more rigorous requirements for risk assessments and transfer impact analyses to ensure compliance in multi-jurisdictional environments.

Data Breach Incident Monitoring

The PDPC Eagle Eye, a division within the Office of the PDPC, has launched advanced tools such as the PDPC Eagle Eye Crawler, which enables continuous URL access and facilitates 24-hour monitoring of data breach incidents. Additionally, the PDPC Eagle Eye shared details about their plan to send inspection letters to organizations for advisory reasons.

Privacy Maturity Model and Privacy Index

The Office of the PDPC introduced new tools to help organizations assess and improve their data protection practices.

The Privacy Maturity Model assesses an organization’s readiness for personal data protection. The Privacy Index measures data protection levels using both privacy data (such as survey results and Privacy Maturity Model scores) and secondary data (like public information), giving organizations an overview of their privacy risk management capabilities.

Information derived from the Privacy Maturity Model and Privacy Index can then be used toward obtaining the Personal Data Protection Certification Mark, an upcoming certification program to recognize compliant organizations.

Outlook for 2026

Based on the Office of the PDPC’s roadmap and expert discussions during the Data Privacy Day event, organizations should expect several key developments in the coming year:

  • Data privacy must go beyond policy and legal compliance to practical implementation in all systems and operations.
  • Heightened enforcement, driven by expanded automated surveillance capabilities such as the PDPC Eagle Eye Crawler and the rollout of inspection letters for advisory purposes.
  • Stronger national PDPA infrastructure, with continued development of PDPA Centers and Trustmark certification.
  • Closer alignment with international privacy standards, supporting Thailand’s role in cross-border digital trade and strengthened mechanisms to support trusted cross-border data flows.
  • Increased regulatory attention on AI governance, with forthcoming guidance to ensure AI use complies with data-protection principles and standards.
  • A nationwide push toward a “new data-ethics culture” emphasizing legal compliance, incident prevention, organizational cooperation, and the use of technology to strengthen national and public trust, anchored in the national goal of improving data security, attracting investments, and enhancing quality of life.

Organizations should treat 2026 as a critical year for operationalizing privacy compliance, building robust governance frameworks, and preparing for more active regulatory oversight. The shift from policy to practice means that demonstrable implementation, not just documentation, will be the standard by which compliance is measured.

Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

November 11, 2024
The Vietnamese government has demonstrated a strong commitment to building a digital government, digital economy, and digital society through its recently issued national strategy on digital infrastructure. Under Decision No. 1132/QD-TTg dated October 19, 2024, on “Digital Infrastructure Strategy to 2025 with Orientation to 2030,” the government will create supportive conditions for both domestic and international businesses to invest in digital infrastructure with cybersecurity as a priority. Recognized as vital to the economy, this digital infrastructure will consist of four main components: (i) telecommunications and internet infrastructure, (ii) data infrastructure, (iii) physical-digital infrastructure, and (iv) digital utility infrastructure, including digital technology as a service. Key goals for 2025 include universal fiber optic access for households, 100% 5G coverage across all provinces and cities, deployment of at least two new international undersea fiber optic cables, establishment of AI data centers, development of green-standard data centers, and platforms for IoT, AI, big data, blockchain, and cybersecurity. By 2030, goals include fiber access with speeds of at least 1 Gbps, 5G coverage for 99% of the population, readiness for 6G trials, six additional international undersea fiber optic cables, development of a hyperscale data center, and positioning Vietnam as a digital hub. To achieve these goals, the government has outlined some core tasks, creating significant opportunities for both foreign and domestic investors: Developing telecommunications and internet infrastructure for widespread fiber optic and 5G access, while preparing for emerging technologies like 6G, Open RAN, satellite, and IpV6. Telecommunication enterprises will jointly invest in and share the use of international fiber optic cable routes to ensure efficient capacity utilization and optimize investment capital. Attracting foreign and domestic investment to establish hyperscale data centers and cloud computing services that meet global standards. Creating physical-digital infrastructure by integrating technology across key sectors such as transportation, energy, healthcare,
Read More
November 8, 2024
On October 31, 2024, Thailand’s Office of the Personal Data Protection Committee (PDPC) opened a public consultation period on its draft notifications—one directed at data controllers and another at data processors—regarding exemptions from the requirement to create and maintain records of processing activities (ROPAs) under the Personal Data Protection Act B.E. 2562 (2019) (PDPA). The draft notification for data controllers aims to amend and revoke certain aspects of the first ROPA exemption notification issued in June 2022 and outlines the criteria for data controllers to be exempted from the obligation to prepare and maintain such records. Although it is officially titled “Notification of the Personal Data Protection Committee on Exemption from Record-Keeping Requirements for Small Business Data Controllers,” this draft notification applies to all types of exempted data controllers (see list below), and not only small businesses. The draft notification for data processors is new and does not replace any prior notification. The criteria under both draft notifications exempt certain data controllers and data processors from the obligation to maintain ROPAs, but exempted data controllers are not free from the obligation to retain information on the rejection of data subjects’ requests to exercise certain rights under the PDPA. While these criteria remain consistent with the June 2022 ROPA exemption notification, there are a few key takeaways from the notifications, as detailed below. Types of Exempted Parties The draft notification on data controllers adds condominium and housing estate juristic persons, as well as individuals, to the list of parties eligible for an exemption, while removing internet cafes from the list. The new draft notification for data processors mirrors the corresponding list in the draft notification for data controllers. The complete list of parties eligible for ROPA exemptions under the draft notifications is as follows: SMEs according to the law on
Read More
October 8, 2024
On October 1, 2024, the Thai cabinet acknowledged the recommendations proposed by the National Anti-Corruption Commission (NACC) to prevent corruption related to online gambling. The Ministry of Digital Economy and Society (MDES) has been assigned as the lead agency to collaborate with various relevant agencies to reach a consensus on the necessary amendments and updates to laws related to online gambling. In assigning the MDES this role, the cabinet emphasized the importance of the following key items: Establishment of a national committee. The national committee will be chaired by a minister and will comprise relevant agencies, including policymaking bodies, technology agencies, frequency management agencies, law enforcement agencies, and other experts. The committee’s primary responsibility will be to consider amending and updating laws related to online gambling. Urgent action on online gambling. As online gambling has been deemed a serious issue requiring urgent action, joint policies will be developed among relevant agencies such as the Royal Thai Police, the Bank of Thailand, and the Anti-Money Laundering Office to elevate the importance of online gambling issues. Public awareness and law enforcement. Public awareness campaigns are to be conducted to educate the public about the risks and legal consequences of online gambling, and laws against online gambling and related financial crimes are to be strictly enforced. Compliance with the Cybersecurity Act. It is necessary to ensure strict compliance with the Cybersecurity Act B.E. 2562 (2019). At the same time, government data systems are to be moved to cloud computing for enhanced data security. Next Steps The MDES is tasked with summarizing the results of the related discussions, actions taken, and overall opinions and submitting the summary to the cabinet secretariat for further presentation to the cabinet. These measures aim to address and mitigate the risks associated with online gambling and related corruption.
Read More
October 8, 2024
Thailand’s Electronic Transactions Development Agency (ETDA) issued guidelines for managing advertisements on digital platform services (DPSs) earlier this year. These guidelines aim to prevent fraud, illegal product or service offerings, and inducements to commit illegal acts, and are likely to provide a basis for greater regulation of this issue in the future. Key obligations for DPS business operators under the guidelines are detailed below. Advertiser Screening and Data Collection Verification and collection: Business operators must establish processes for verifying and collecting advertiser data. This includes steps, methods, and required information for advertiser registration. Identity verification: Business operators should follow identity verification requirements for advertiser registration. This may include using identity verification results from other identity providers or conducting their own identity verification processes with a minimum identity assurance level (IAL) of IAL2. Data storage: Advertiser data must be stored in a machine-readable format. Business operators must maintain records for watchlists, blacklists, and whitelists. Prepublication Advertisement Review Review process: Business operators should review advertisements before publication. This review should consider factors such as prohibited or restricted advertisements, required permissions, and avoiding sensitive user data. Postpublication Monitoring Advertisement monitoring: Business operators must monitor published advertisements using automated systems, staff, or contracted personnel. Criteria for prioritizing reviews should be established. Reporting channels: Business operators must provide channels for users to report illegal or inappropriate advertisements. Reports must be promptly addressed, prioritizing cases involving intellectual property owners or multiple credible reports. Advertiser account monitoring: Business operators must monitor advertiser accounts. This includes considering factors such as the number of reports/flags received and compliance with service agreements and community standards. For more information on this initiative from the ETDA, or on any aspect related to Thailand’s regulations for DPSs, please contact Athistha (Nop) Chitranukroh at [email protected], Thammapas Chanpanich at [email protected], Pornpan Wichawut at [email protected],
Read More