You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

October 1, 2019

The Reach and Liabilities of the Personal Data Protection Act

Subscribe to Updates
Bangkok Post: Human Resources Watch

Earlier this year, Thailand enacted its Personal Data Protection Act (PDPA), which was published in the Government Gazette on 27 May 2019. Most parts of the PDPA will become effective one year after this, on 27 May 2020. As the PDPA will have broad impact across multiple aspects of most businesses—including their human resources operations—lawmakers provided this one-year period for those affected to prepare for compliance with the PDPA.

While the definitions and mechanics of the law in relation to HR operations were covered in a previous Human Resource Watch column (29 April 2019), this article will take a closer look at the civil, criminal, and administrative penalties applicable in the event of non-compliance with the PDPA.

It is important for employers to understand that these liabilities apply to them even if they outsource their company’s HR work. Some employers misunderstand that if they turn over their HR functions to an HR service provider, the employer will not have any liability under the PDPA. Indeed, even if HR functions are outsourced, the employer will still have the same liabilities under the PDPA if the HR service provider breaches the PDPA.

For instance, if an employer assigns an outsourced provider to manage the paying of wages and calculation of social security deductions, where the providers must collect, use or disclose the personal information of employees, both the employer and the HR service provider will be acting in roles defined by the PDPA. In this scenario, the employer would be considered a ‘data controller’, while the HR service provider would be considered a ‘data processor.’ Therefore, both the employer and the HR service provider will have potential liability under the PDPA.

If the employer or HR service provider violates a PDPA provision, such as selling employees’ personal information to a financial institution or other third party without the employees’ consent, the employer as data controller would not only be liable for paying compensation to the employees who own the personal information, but could also face criminal penalties and administrative liability under the PDPA. In addition, the HR service provider, as a data processor, could face civil liability.

The PDPA provides for three types of potential liability for violation of its provisions:

1. Civil Liability

Employers or HR service providers who are found to have violated the PDPA must pay compensation to the employees who own the personal information and who received damages from the violation, regardless of whether the violation was done intentionally or negligently, except where the offender can prove that the damages were caused by force majeure or the employees’ own actions. In addition, offenders who can prove that the violation was a result of their compliance with an order of a government officer exercising his or her duties under the law will not be liable. The compensation includes all necessary expenses associated with actual or likely damages, whether for purposes of prevention or mitigation.

In addition, the court is entitled to award punitive civil damages, up to two times the amount of actual damages.

The prescription period for claiming compensation under the PDPA is three years from the date that the employees who own the personal information became aware of the violation and the identity of the offenders, or ten years from the date on which the violation of the personal data took place.

2. Criminal liability

If an employer as data controller violates the PDPA by the use or disclosure of personal information without consent in a manner that is likely to cause the other person to suffer any damages, impair his or her reputation, or other reason, the offender will face imprisonment of up to six months, a fine of up to Baht 500,000, or both.

In addition, if the offender uses or discloses personal information in order to receive unlawful benefits (or secure benefits for others), the criminal penalties that the offender will face include imprisonment for up to one year, a fine of up to Baht 1 million, or both.

The criminal offence under the PDPA is a compoundable offence, which means that it can be settled by negotiation and agreement between the parties before a court issues a final judgment.

In a case where the offender is a juristic person and the offence occurs as a result of the order or act of any director, manager, or other person in a role of responsibility, those persons must be liable for the relevant penalties. Likewise, these persons can also be penalized for their omission of an instruction or act resulting in the commission of the offence by the juristic person.

3. Administrative liability

The PDPA also imposes administrative liability on any offender in the form of an administrative fine from Baht 500,000 to Baht 5 million, depending on the nature of the violation. The PDPA establishes an expert committee with the authority to order offenders to pay an administrative fine, issue an order for rectification, or issue a warning to the offender. In determining whether to impose an administrative fine, the expert committee will consider the severity of the circumstances of the offence, the size of the business of the data controller (e.g., an employer) or data processor (e.g., HR service provider or HR department), or other circumstances.

It is possible that specific classes of data controller could be exempted from the application of all or part of the provisions of the PDPA (in addition to the excepted activities, on which see the previous article on this topic). However, these exemptions would have to be made by royal decree.

As it stands now, though, exceptions for classes of person have not been promulgated, and employers should not expect that they will be automatically exempt from PDPA compliance. Recent news from Europe of companies being heavily fined for their violations of the EU’s General Data Protection Regulation (upon which much of the PDPA is based) underline the dangers of continuing to neglect the protection of personal data. With Thailand only months away from joining the EU and other jurisdictions around the world in implementing a robust data protection regime, businesses must ensure the compliance of all of their operations—including in-house or outsourced HR functions—to avoid such costly penalties.

 

This article was originally published in the Bangkok Post and is reproduced here with permission and thanks. The original story can be viewed on the Bangkok Post website.

Related Professionals

Practices

Employment

Location

RELATED INSIGHTS​ 

September 9, 2026
On August 25, 2026, Thailand’s cabinet approved in principle a draft amendment that would extend mandatory social security coverage to three categories of workers currently excluded from Thailand’s compulsory social security system. The amendment, proposed by the Ministry of Labour, would modify the Royal Decree Prescribing Businesses and Employees Excluded from the Social Security Act B.E. 2560 (2017). Newly Covered Workers The cabinet-approved proposal would remove the exclusions for the following three categories of employees, bringing them within Thailand’s mandatory social security system: Workers in seasonal cultivation (pho pluk), forestry (pa mai), and livestock (liang sat) businesses that do not employ workers year-round and whose operations do not include other types of business activities. Notably, fishery (pramong) workers were excluded from this amendment following objections raised at a Social Security Board meeting on April 30, 2025, because employers and employees in the fishery sector can already agree to opt into social security coverage under fishery labor laws. Domestic workers and other employees of individual employers where the work performed is not part of a business operation (e.g., housekeepers, gardeners, drivers). This group has actively demanded inclusion in the social security system. Workers employed in street-stall businesses operating fixed street stalls (kan kha phaeng loi). The rationale for including street-stall workers is that their employers have fixed, identifiable places of business that can be inspected. Accordingly, workers engaged in itinerant street hawking (kan kha re) remain excluded. The expanded coverage would apply to both Thai and foreign employees who possess valid identity documents and work permits, including migrant workers who have been granted special permission to work in Thailand. The Social Security Act B.E. 2533 (1990) does not restrict social security registration based on nationality, allowing these workers to register as insured persons under section 33. Employer Obligations and Employee
Read More
September 4, 2026
Thailand’s cabinet has approved two draft amendments aimed at improving labor-related judicial proceedings. The proposed amendments to the Act on the Establishment of Labor Courts and Labor Case Procedure B.E. 2522 (1979) and the Act on Procedures for Human Trafficking Cases B.E. 2559 (2016) are intended to make the process more efficient, appropriate, and fair. Key elements of these proposed amendments are outlined below. Expansion of Labor Court Jurisdiction Under the current framework, labor courts generally hear labor disputes, while criminal offenses under labor laws are handled separately. Matters involving both labor and criminal issues may therefore require the parties to pursue proceedings before different courts. To address this, the proposed amendments would expand the jurisdiction of labor courts to cover certain criminal offenses under labor laws. The government states that the change is intended to allow related issues to be heard by judges with expertise in labor law and to reduce the need for parallel proceedings. The proposed amendments also set out the following rules for cases involving multiple offenses. Where a single act gives rise to multiple offenses and at least one of those offenses falls within the jurisdiction of the labor court, the labor court may hear the related offenses as part of the same case. Where multiple connected acts give rise to different offenses, the labor court may hear the matters together or transfer part of the case to the appropriate court, taking into account convenience and the interests of justice. Criminal Offenses Covered The proposed amendments would extend labor court jurisdiction to criminal offenses under 11 labor-related laws, including laws concerning: Home workers protection Labor protection Labor protection in fisheries work Employment and job-seeker protection Management of foreign workers Social security Occupational safety, health, and working environment Compensation Maritime labor State enterprise labor relations
Read More
August 31, 2026
Thailand has introduced a new regulatory framework that may expose foreign nationals who violate the Foreign Business Act (FBA) to deportation. The Regulation of the Office of the Prime Minister on Deportation B.E. 2569 was published in the Government Gazette on August 27, 2026. The regulation establishes an administrative process for referring foreign nationals for deportation where this is deemed necessary in the interests of public order or public morality. It does not create new substantive deportation powers, but it expressly identifies unlawful business conduct under the FBA—including nominee arrangements—as grounds for referral. Grounds for Deportation Referral The regulation sets out five grounds that may give rise to a referral to the relevant authorities: Unlawful entry into, or unlawful stay in, Thailand in violation of immigration laws. Unlawful employment or engagement in work in violation of laws governing the employment of foreign nationals. Carrying on business in violation of the FBA, including through the use of nominee arrangements. Forging official documents or using forged official documents. Committing an offense punishable by imprisonment of five years or more. The framework takes a broad approach, extending not only to the perpetrators of these acts but also to those who facilitate, instigate, or otherwise support such acts. Deportation Risk Following a Criminal Judgment Where a foreign national has committed any of the above offenses and has fully served the sentence imposed pursuant to a final judgment, the interior minister has the power to order deportation. This power also applies where a court has issued a final judgment sentencing a foreign national to imprisonment but has suspended the execution of the sentence, or has imposed a fine. A deportation order may also specify a period during which the foreign national is prohibited from reentering Thailand. FBA Noncompliance: Broader Consequences Noncompliance with the FBA—including
Read More
August 20, 2026
As part of its membership in Lex Mundi, Tilleke & Gibbins has released the latest edition of its Guide to Doing Business in Thailand, providing an overview of the legal, regulatory, and commercial considerations for companies establishing or expanding operations in Thailand. The 2026 edition offers practical insight into the country’s business environment, investment framework, and operational requirements. The guide covers a wide range of topics relevant to foreign and domestic investors, including: Investment incentives and promotion schemes Financial facilities and banking regulations Exchange controls and money transfers Import and export regulations Business structures and incorporation options Requirements for establishing a business Operational and compliance considerations Business cessation and insolvency procedures Employment and labor laws Taxation Immigration and visa requirements Prepared by Tilleke & Gibbins lawyers across multiple practice areas, the publication outlines key aspects of doing business in Thailand, including foreign investment restrictions, regulatory compliance obligations, corporate structures, employment requirements, and recent legal and economic developments affecting investors. The publication forms part of Lex Mundi’s Country Guides series, a global collection of jurisdiction-specific reference materials prepared by member firms around the world. Together, these guides help companies evaluate opportunities, compare regulatory environments, and plan international business activities across multiple markets. The full Guide to Doing Business in Thailand 2026 is available through the button below.
Read More