Thailand’s Personal Data Protection Act B.E. 2562 (2019) (PDPA) could soon see some important changes, as a draft bill to amend the PDPA has been introduced in the House of Representatives. The draft amendment is currently in the public consultation phase, with comments accepted from July 16 to August 15, 2026. If enacted in its current form, the amendment would make three key changes: expanding the government exemption to cover anticorruption operations, introducing a statutory definition of “government agency,” and restructuring the lawful bases for personal data processing to align with international standards.
Background
The PDPA has encountered several enforcement challenges since its implementation, including three core problems identified by the bill’s sponsors: (1) the current exemptions for government agencies do not cover anticorruption and misconduct-prevention operations; (2) the PDPA lacks a clear statutory definition of “government agency,” causing legal uncertainty as to which entities are covered; and (3) the existing framework for lawful bases of data processing does not align with international standards—particularly the multiple-lawful-bases system in the EU’s General Data Protection Regulation (GDPR)—making compliance inflexible for both government and private sector entities.
Expanded Government Exemption
The current PDPA exempts government agencies performing duties related to national security (including fiscal security), public safety, anti-money laundering, forensic science, and cybersecurity. The proposed amendment adds “prevention and suppression of corruption and misconduct” to this list of exempted functions. This would allow anticorruption bodies—most notably the National Anti-Corruption Commission (NACC), which is identified as a directly affected party—to collect, use, and disclose personal data without being subject to PDPA requirements when carrying out their duties.
New Statutory Definition of “Government Agency”
Notably, while the current PDPA use the term “government agency” in several provisions, the term is not comprehensively defined, creating potential uncertainty as to its scope. The draft bill therefore inserts a new definition of “government agency” to cover central government agencies, regional government agencies, local government agencies, state enterprises, public organizations, Parliament, courts, independent constitutional organizations, the Office of the Attorney General, public higher-education institutions, and independent state agencies. The proposed definition seeks to clarify which entities are considered “government agencies” and covered by the act.
Restructured Lawful Bases for Data Processing
The most significant proposed change for both government and private-sector organizations is the restructuring of the PDPA’s section 24, which currently prohibits data controllers from collecting personal data without consent, subject to certain exceptions framed as carveouts.
The proposed amendment would restructure section 24 to adopt a multiple-lawful-bases model aligned with the GDPR, and add more clarity on the public-task basis. Under the new framework, personal data processing would be lawful when carried out under at least one of the following bases:
- Archival/research/statistical: For historical or archival purposes in the public interest, or for research or statistics with appropriate safeguards, as prescribed by the PDPC board.
- Public task/official authority: Necessary for performing a public-interest mission or exercising official authority, including government disclosure obligations under the Official Information Act or other laws.
- Vital interests: To prevent or suppress danger to a person’s life, body, or health.
- Contractual necessity: Necessary for performing a contract with the data subject or for pre-contractual steps at the data subject’s request.
- Legitimate interests: Necessary for the legitimate interests of the data controller or a third party, unless overridden by the data subject’s fundamental rights.
- Legal obligation: Necessary for compliance with a legal obligation of the data controller
- Consent: The data subject has given consent.
The most critical structural shift is that consent is repositioned from the default requirement to one of seven coequal lawful bases.
Next Steps
All organizations should monitor the public consultation process, which is open until August 15, 2026. If enacted, the bill will take effect the day after its publication in the Government Gazette.
