You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

October 10, 2019

PTIT Focus: The Personal Data Protection Act

Subscribe to Updates
Petroleum Institute of Thailand: PTIT Focus

Most of the operators in the petroleum or oil and gas industries are large international companies that correspond and coordinate with their parent companies or contractors, subcontractors, suppliers or vendors who are based around the globe. In addition, such petroleum or oil and gas operators may employ a significant number of employees, and therefore, they may need to collect, use or disclose personal data relating to their contracting parties, or their employees, in their business operations.

Thailand announced the Personal Data Protection Act (“PDPA”) in the Government Gazette on 27 May 2019, which relates to operators who need to collect personal data. The PDPA prescribes the duties and responsibilities of a natural or juristic person who has the power and duty to make decisions regarding the collection, use or disclosure of personal data (“Data Controller”), and a natural or juristic person who undertakes the collection, use or disclosure of personal data pursuant to the orders given by the Data Controller (“Data Processor”). The Data Controller and the Data Processor can collect, use or disclose personal data based on the conditions stipulated under this Act. For example, a Data Controller must obtain consent from the Data Subject prior to, or at the time of, such collection, use or disclosure. Moreover, such consent must be explicitly provided in writing or via electronic means. However, the consent can be exempt if the collection of personal data is to prevent a danger to a person’s life, body or health, or for the public interest, or for the legitimate interests of the Data Controller.

In addition, the PDPA also prescribes the rights of the Data Subject, such as: (i) the right to access and obtain a copy of the personal data that is related to themselves; (ii) the right to request a Data Controller to transfer the personal data to other Data Controllers; (iii) the right to object to the collection, use or disclosure of the personal data; and (iv) the right to ask the Data Controller to erase or destroy the personal data or to anonymize the personal data.

In addition to the abovementioned principles, the PDPA prescribes that a Data Controller who wishes to send or transfer personal data overseas must ensure that the destination country receiving such personal data has adequate data protection standards. The Data Controller must also ensure that the usage of the personal data is carried out in accordance with the rules for the protection of personal data, as prescribed by the Personal Data Protection Committee.

A Data Controller or Data Processor located in the Kingdom of Thailand will have to provide a personal data protection policy related to overseas transfers of personal data to another Data Controller or Data Processor located overseas, and show they are affiliated, or within the same group of companies, in order to jointly operate the business or the group’s undertakings. If such overseas transfer of personal data policy has been reviewed and approved by the Office of the Personal Data Protection Committee, the personal data transfer in accordance with that policy can be carried out and will be exempt from the requirements that will be prescribed by the Personal Data Protection Committee. Therefore, operators in petroleum or oil and gas industries, who collect personal data (as Data Controllers) and who wish to transfer personal data to their parent companies or contracting companies abroad, must comply with these principles.

A Data Controller who uses or discloses personal data without the consent of the Data Subject, or who sends or transfers personal data to a foreign country without ensuring adequate data protection standards, is liable to be punished with imprisonment for a term ranging from six months to one year and a fine of THB 500,000 to THB 1,000,000.

With respect to other violations, the criminal liabilities vary in accordance with the type of offenses. With respect to civil liability, the Data Controller and the Data Processor will be required to pay punitive damages of up to twice the amount of the actual compensation, depending on the discretion of the court. In addition, a Data Controller may be punished with administrative fines ranging from THB 500,000 to THB 5,000,000 depending on the type of violation under the PDPA. For a juristic person, if the offender is a director, manager or other person responsible for such violations, the juristic person will also be subject to punishment.

In conclusion, only Chapter 1 (Personal Data Protection Committee) and Chapter 4 (Office of the Personal Data Protection Committee) of the PDPA came into effect on 28 May 2019. The provisions of the other chapters, such as the collection, disclosure, use, of personal data, and the duties of the Data Controller or the rights of the Data Subject, will come into effect in May 2020. Therefore, operators have a period of one year to adjust or amend their internal rules or policies, and correct their practices to be in compliance with the PDPA in order to avoid any violations. 

 

This article first appeared in the April 2019 edition of PTIT Focus, the Petroleum Institute of Thailand’s monthly newsletter. The article was published in both English and Thai. For the original publication, please see the PDF below.

Download Full Article
Related Professionals

Industries

Energy

Location

RELATED INSIGHTS​ 

May 25, 2026
After several years of policy discussion and continued efforts led by the Ministry of Commerce (MOC) to relax the list of reserved businesses under the Foreign Business Act B.E. 2542 (1999) (FBA), the reform process has now reached a significant milestone. On May 12, 2026, the Thai cabinet approved in principle two draft subordinate legislative instruments aimed at delisting certain reserved business activities under the FBA and reducing licensing requirements for foreign business operators. These developments signal a renewed and concrete effort by the government to modernize Thailand’s business regulatory framework in order to attract foreign investment and boost Thailand’s competitiveness in the global market. Nine Businesses Set for FBA Delisting Below is a list of the nine businesses that are being targeted for delisting from the FBA’s restrictions. A draft ministerial regulation would delist the first eight reserved businesses, while a royal decree has been drafted to delist the ninth business: Telecommunications services (Type 1 license only, covering operators without their own telecommunications infrastructure), under the supervision of the Office of the National Broadcasting and Telecommunications Commission. Treasury center services subject to the Foreign Exchange Control Act B.E. 2485 and under the supervision of the Bank of Thailand. Securities-collateralized lending, pursuant to the laws governing securities and exchange and derivatives regulated by the Securities and Exchange Commission. Agency, dealer, advisory, or fund management services relating to derivatives where the underlying assets fall outside the scope of the Derivatives Act B.E. 2546 (2003) Intra-group shared services, including administrative, human resources, and IT functions Intra-group domestic debt guarantee services Leasing of partial space for installation of financial service machines and automatic vending machines for employee use Petroleum drilling services Trading of agricultural product derivatives through a futures exchange, with physical delivery or receipt of agricultural products at a futures exchange–designated
Read More
February 10, 2026
Data center and cloud investments are forming a major focus of private-sector investment in Thailand, with tech giants like Amazon, Google, Microsoft, and TikTok, as well as numerous telecom and data center companies, committing significant outlays to data center and cloud development. The country’s Board of Investment (BOI) approved projects worth THB 1.87 trillion in 2025, and THB 746 billion of this was from planned data center investments—by far the largest amount from any single industry. Thailand’s swift rise as a regional data center hub is fueled by surging demand for cloud, AI, and digital services, as well as large-scale investments from global tech firms. The country’s strategic location, competitive power costs, robust fiber infrastructure, expanding IT talent, and supportive government policies—including BOI incentives and streamlined approvals—have made it an attractive destination for scalable and sustainable digital infrastructure investments. The BOI’s proactive approach in updating promoted categories and providing both tax and non-tax incentives further ensures Thailand’s continued growth in this sector. 2025 BOI Changes for Data Centers In the middle of 2025, the BOI responded to the remarkable trend by updating investment‑promotion categories across various sectors (e.g., machinery and electrical equipment, public utilities, digital and innovative industries) to accommodate growing investment in data‑center projects. Before the change, which was detailed in a notification that has applied to investment promotion applications submitted from July 1, 2025, onward, data‑center projects under BOI promotion were granted a single A1 incentive (an eight‑year corporate income‑tax exemption) and subject to one uniform set of conditions. The July 2025 notification restructured promotion for data centers into two categories based on power‑usage efficiency: high‑efficiency data centers and other data centers. Under these rules, qualified high‑efficiency data centers are eligible for an eight‑year corporate income tax (CIT) exemption, while for other data centers this exemption is
Read More
November 21, 2025
On November 17, 2025, Thailand’s Ministry of Interior introduced significant regulatory changes to make rooftop solar adoption easier and more cost-effective for property owners. Ministerial Regulation No. 72 B.E. 2568 (2025), issued under the Building Control Act B.E. 2522 (1979), was published in the Government Gazette on November 19, 2025, with immediate effect. Background Under the Building Control Act (BCA), any alteration made to a building requires either notification of the relevant authority or application for a building alteration permit—unless the alteration falls under a separate list of exceptions specified in the ministerial regulations issued under the BCA. In 2015, installation of solar rooftops on any residential building under 160 square meters was added to this list of exceptions, subject to inspection and notification requirements. The newly enacted regulation now eliminates many of these requirements and introduces a broader and more permissive framework to promote solar adoption nationwide. Key Changes Specifically, the regulation introduces three major changes: Expanded exemption from the definition of “building alteration”: The installation of solar panels on any building roof—regardless of the type of building or the total area of the installation—is no longer considered a building alteration under the BCA, provided that the total weight of the installation does not exceed 20 kg/m2. Removal of structural integrity certification requirement: The new regulation eliminates the obligation to obtain a structural stability certificate from a licensed civil engineer. Removal of notification requirement: Property owners or possessors are no longer required to notify the local authority before installation of a solar rooftop. Impact This significant streamlining of requirements for solar rooftop installation is expected to accelerate the adoption of renewable energy in the country, particularly for residential and commercial properties—similar to the way Thailand’s December 2024 removal of licensing requirements for factory solar rooftop installations encouraged such
Read More
September 25, 2025
Tilleke & Gibbins’ labor and employment team in Hanoi and Ho Chi Minh City has contributed the Vietnam chapter to Labor and Employment Disputes 2026. Drawing on the expertise of three of the firm’s employment specialists, the chapter provides practical guidance for navigating employment disputes in Vietnam and covers: Pre-action considerations: key requirements, third-party funding, contingency fee arrangements Issuing a claim: forum, territorial jurisdiction, standing, commencing claims, fees, service, defendants and legal personality, types of claims, time limits, counterclaims Case management: procedure, rules, amendments to claims, adding parties, consolidating proceedings, class and collective actions, evidence, witnesses, tactical considerations Interim relief: availability, requirements Trial: hearings conduct and time frames, confidentiality and public access, media reporting, elements of successful claims and burden of proof Alternative dispute resolution: available types, requirements and expectations, enforcement Collective employment and labor rights: enforcement and standing Remedies and enforcement: available remedies, assessing compensation, enforcement mechanisms Appeals: procedure, time frames, other means of challenge Updates and trends: recent cases and developments, technology developments, other issues The Vietnam chapter is available for download below. Tilleke & Gibbins also contributed the Cambodia and Thailand chapters to Labor and Employment Disputes 2026. Readers can also gain 30 days of complementary access to the full Labor and Employment Disputes 2026 guide and the rest of Lexology Panoramic’s varied offerings through this link.
Read More