You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

July 20, 2026

Thailand Issues New Rules on Data Subject Access Requests

Subscribe to Updates

On July 16, 2026, Thailand’s Personal Data Protection Committee (PDPC) published a notification in the Government Gazette establishing detailed rules governing data subjects’ right of access under section 30 of the Personal Data Protection Act B.E. 2562 (2019) (PDPA). The notification will take effect 60 days after publication—mid-September 2026—giving data controllers a limited window to bring their processes into compliance.

Scope

The notification covers requests to access or obtain copies of personal data and requests for disclosure of the source of data collected without consent. Data subjects may exercise their rights directly or through authorized representatives.

Key Requirements

Important requirements set by the notification include the following:

  • Required request channels. Controllers must provide at least two request channels: direct submission at the business location and registered mail. Electronic channels are optional but, if offered, may also be used for fulfilling requests.
  • Request contents. Requests must be in writing or in electronic form and include the data subject’s name, the preferred access method, details of the data requested, and the requester’s signature. Controllers may request additional identifying information as needed.
  • Identity and authority verification. Controllers may require official identity documents for verification. Authorized representatives must provide authorization documents and identity documents for both the data subject and the representative. Alternative verification methods (e.g., digital authentication) are permitted if they do not unreasonably obstruct data subjects’ rights.
  • Review and response timelines. Controllers must review requests within 15 days. If the request is incomplete, the controller must notify the requester and allow at least 15 days to correct deficiencies. If not corrected, the request may be treated as abandoned. Once verified, controllers must fulfill requests within 30 days, extendable by another 30 days for large-volume or complex requests with notice to the requester.
  • Methods for providing access or copies. Controllers may fulfill requests by allowing inspection, providing document copies, or granting electronic access. If a request is submitted electronically, the response should also be electronic where possible.
  • Grounds for refusal or limitation. Controllers may refuse requests where permitted by law or court order, where compliance would harm third-party rights (including personal data, trade secrets, or IP), or where the request is manifestly unfounded or unreasonably burdensome. Controllers must provide data subjects with the reason for refusal in writing, and the refusal must be recorded in the controller’s records.
  • Allowable fees. Electronic access without special recording or delivery costs should generally be free. Where fees are permitted, they must be reasonable, not exceed actual costs, and comply with the schedule attached to the notification. Fee details must be disclosed to data subjects in advance of any requests.
  • Recordkeeping. Controllers must retain records of requests and responses for at least two years. Electronic recordkeeping is permitted.
  • Interaction with other laws. Where other laws impose access-related duties, controllers must comply with those laws while remaining consistent with this notification’s procedures.

Next Steps

Data controllers being subject to the PDPA, both onshore and offshore, should assess their current data access request handling procedures against the notification’s requirements, including whether they offer the mandatory request channels and can meet the prescribed timelines. Key actions include:

  • Conducting a gap analysis of existing procedures against the new requirements.
  • Updating privacy notices and internal policies to clearly communicate request channels, fee schedules, and processing timelines.
  • Implementing or updating request management systems to track requests, verification status, deadlines, and record retention.
  • Training relevant personnel, particularly data protection officers, customer service teams, and legal and compliance staff, on the new timelines and procedures.
  • Preparing template responses, including refusal notices with documented reasons, correction requests, and abandonment notifications.

Given the short compliance window, organizations that have not yet established formal data access request procedures should begin implementation promptly.

Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

May 22, 2025
While digital technologies have significantly enhanced communication and information sharing, they have also created new opportunities for misuse, particularly for children, who are especially vulnerable to online abuse and exploitation. These risks are often difficult for parents and guardians to detect or prevent in a timely manner. To address these concerns, Thailand has drafted an amendment to the Criminal Code to introduce new provisions targeting offenses against children committed via online platforms. The objective is to close existing legal gaps and to provide more robust protections for children in the digital environment. The draft amendment focuses primarily on addressing online offenses against children and enhancing legal protections for children. The draft amendment proposed changes regarding the following issues: Jurisdiction and media misuse Expanding Thailand’s jurisdiction to cover sexual and liberty-related offenses committed against children outside the country. Adding offenses for misuse of media, including recording, publishing, or transmitting text, images, or sounds for unlawful or exploitative purposes. Offenses involving child exploitation Adding penalties for persuading, luring, or enticing children to engage in sexual or indecent conduct. Imposing harsher penalties for aggravated cases relating to child exploitation that result in serious harm or death. Adding penalties for sending or forwarding inappropriate sexual content to children with exploitative intent. Adding penalties for using threats involving sexual conduct to pressure or coerce victims. Removing ignorance of a child’s age as a possible defense for certain offenses (e.g., luring children or sending inappropriate content) when the child is under 13 years old. Special protections for vulnerable individuals Imposing harsher penalties for offenses committed against parents, persons under legal guardianship or parental authority, or individuals unable to protect themselves. Adding penalties to offenses such as luring children, sending inappropriate content, and cases involving serious harm or death. Child pornography Increasing liability for possession and
Read More
May 15, 2025
Thailand’s Electronic Transactions Development Agency (ETDA) held an explanatory session on the draft principles and regulatory approaches of the country’s planned artificial intelligence (AI) law on May 2, 2025. This came after a lull of two years following the initial release of draft legislation on AI. In the session, the ETDA explained that the earlier drafts were modeled after the EU’s legal framework for AI, but given the evolving Thai legal and technological landscape, it is now necessary to revisit and refine the drafts to ensure they remain relevant and effective in the local context. To aid in this process, the ETDA will accept public comments on the draft principles of the AI law until June 9, 2025. Based on gap analysis and a comparative study of how different countries have addressed AI issues, the ETDA’s draft AI law principles are structured into five key areas. These are described below. 1. Risk-Based Requirements The draft principles outline a set of approaches that the legislation will take toward mitigating risk: Delegation of powers to enforcement agency or sectoral regulators The primary legislation will not directly specify a list of prohibited risks or high-risk types of AI. Instead, it will empower an enforcement agency or relevant sectoral regulators to determine and issue such lists. This approach allows regulators in each specific industry to assess the necessity of risk classifications within their respective sectors, based on the principle that sectoral regulators are best positioned to understand the specific risks in their domains. These regulators are expected to issue subordinate legislation in alignment with the overall framework. Meanwhile, the central enforcement agency will coordinate oversight across sectors and cover areas not under the jurisdiction of any specific regulator. Duties of high-risk AI providers Providers of AI deemed by the enforcement agency or sectoral
Read More
May 14, 2025
Following the amendment to the Emergency Decree on Measures for the Prevention and Suppression of Technological Crimes in mid-April 2025, new measures were introduced by the Electronic Transactions Development Agency (ETDA) in a hearing session held on May 13, 2025, to establish shared liability between online social media platform operators and other in-scope operators for damages arising from technological crimes. Stakeholders are being invited to submit their comments on the proposed new provisions directly to the ETDA by May 20, 2025. The concept of the new measures for social media platform operators is that to be released from liability for damages arising from technological crimes, social media platform operators must demonstrate compliance with the relevant technological crime prevention standards and measures prescribed by their respective regulators (“safe harbor rules”). Safe Harbor Rules Under the principles of the proposed safe harbor rules, social media platform operators and the relevant service providers would be required to comply with the following obligations: Immediate takedown and suspension of dissemination: Disable access, remove the content from the system, or suspend the relevant service within 24 hours of receiving an official notification from the Cyber Crime Investigation Bureau’s Anti-Online Scam Operation Center (AOC) that a service or social media platform is disseminating content that is or may be used to commit or support technological crimes. Establishment of notification channels: Establish a system or channel to receive notifications from the AOC. User registration and identity verification: Require user registration (including identity verification and authentication) before allowing content to be posted, with sufficient information to identify the user. Suspending dissemination of suspect advertisements: Disable access to advertisements reasonably suspected of involving or potentially involving the commission of technology-related crimes. Reporting: Report on actions taken, including details like account owner information, IP address, email, or phone number used for account
Read More
May 5, 2025
On April 29, 2025, the government of Vietnam promulgated Decree No. 94/2025/ND-CP with regulations on a controlled “sandbox” for innovative fintech solutions in the banking sector (Decree 94). The decree aims to promote innovation, modernize banking, and enhance financial inclusion while assessing risks and benefits of fintech solutions in a controlled testing environment. Fintech Sandbox Currently, the fintech sandbox focuses on three specific areas: Credit scoring Open API data sharing Peer-to-peer (P2P) lending Eligible participants for the fintech sandbox include: Credit institutions and foreign bank branches (except for P2P lending) Fintech companies operating in Vietnam Cross-border supply by foreign providers is not included in the sandbox framework. Eligible participants are permitted to provide fintech solutions only within the scope specified in the Certificate of Sandbox Participation issued by the State Bank of Vietnam in consultation with other ministries. P2P lending companies face specific restrictions within the fintech sandbox, including prohibitions against: Providing security for customer loans Operating as a customer (i.e., P2P lender or borrower) Providing P2P lending solutions to pawn shops The maximum sandbox period is two years, with the possibility of extension as permitted by law. The outcomes of the fintech sandbox will serve as a practical basis for authorities to develop and refine future fintech regulations. It is worth noting that participation in the sandbox does not guarantee that participants will meet relevant business and investment conditions that may be stipulated in future regulations. Decree 94 will take effect on July 1, 2025, signaling that the Vietnamese government intends to take a proactive approach to fostering fintech development. Implications Parties interested in participating in the fintech sandbox should begin preparing now to be ready to apply for a Certificate of Sandbox Participation when the decree takes effect.
Read More