You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

August 4, 2026

Thailand Proposes Significant Amendments to the Personal Data Protection Act

Subscribe to Updates

Thailand’s Personal Data Protection Act B.E. 2562 (2019) (PDPA) could soon see some important changes, as a draft bill to amend the PDPA has been introduced in the House of Representatives. The draft amendment is currently in the public consultation phase, with comments accepted from July 16 to August 15, 2026. If enacted in its current form, the amendment would make three key changes: expanding the government exemption to cover anticorruption operations, introducing a statutory definition of “government agency,” and restructuring the lawful bases for personal data processing to align with international standards.

Background

The PDPA has encountered several enforcement challenges since its implementation, including three core problems identified by the bill’s sponsors: (1) the current exemptions for government agencies do not cover anticorruption and misconduct-prevention operations; (2) the PDPA lacks a clear statutory definition of “government agency,” causing legal uncertainty as to which entities are covered; and (3) the existing framework for lawful bases of data processing does not align with international standards—particularly the multiple-lawful-bases system in the EU’s General Data Protection Regulation (GDPR)—making compliance inflexible for both government and private sector entities.

Expanded Government Exemption

The current PDPA exempts government agencies performing duties related to national security (including fiscal security), public safety, anti-money laundering, forensic science, and cybersecurity. The proposed amendment adds “prevention and suppression of corruption and misconduct” to this list of exempted functions. This would allow anticorruption bodies—most notably the National Anti-Corruption Commission (NACC), which is identified as a directly affected party—to collect, use, and disclose personal data without being subject to PDPA requirements when carrying out their duties.

New Statutory Definition of “Government Agency”

Notably, while the current PDPA use the term “government agency” in several provisions, the term is not comprehensively defined, creating potential uncertainty as to its scope. The draft bill therefore inserts a new definition of “government agency” to cover central government agencies, regional government agencies, local government agencies, state enterprises, public organizations, Parliament, courts, independent constitutional organizations, the Office of the Attorney General, public higher-education institutions, and independent state agencies. The proposed definition seeks to clarify which entities are considered “government agencies” and covered by the act.

Restructured Lawful Bases for Data Processing

The most significant proposed change for both government and private-sector organizations is the restructuring of the PDPA’s section 24, which currently prohibits data controllers from collecting personal data without consent, subject to certain exceptions framed as carveouts.

The proposed amendment would restructure section 24 to adopt a multiple-lawful-bases model aligned with the GDPR, and add more clarity on the public-task basis. Under the new framework, personal data processing would be lawful when carried out under at least one of the following bases:

  • Archival/research/statistical: For historical or archival purposes in the public interest, or for research or statistics with appropriate safeguards, as prescribed by the PDPC board.
  • Public task/official authority: Necessary for performing a public-interest mission or exercising official authority, including government disclosure obligations under the Official Information Act or other laws.
  • Vital interests: To prevent or suppress danger to a person’s life, body, or health.
  • Contractual necessity: Necessary for performing a contract with the data subject or for pre-contractual steps at the data subject’s request.
  • Legitimate interests: Necessary for the legitimate interests of the data controller or a third party, unless overridden by the data subject’s fundamental rights.
  • Legal obligation: Necessary for compliance with a legal obligation of the data controller
  • Consent: The data subject has given consent.

The most critical structural shift is that consent is repositioned from the default requirement to one of seven coequal lawful bases.

Next Steps

All organizations should monitor the public consultation process, which is open until August 15, 2026. If enacted, the bill will take effect the day after its publication in the Government Gazette.

Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

July 10, 2024
The need for privacy and security has grown in tandem with the rapid proliferation of internet-enabled technologies. This is a major concern for consumers and individuals, and governments are increasingly mindful of online threats to their national security and their citizens. All of this represents an imposing challenge for companies—especially now that technology has enabled them to operate with relative ease across jurisdictions throughout the world.
Read More
July 5, 2024
The landscape of intellectual property (IP) has transformed alongside advancements in technology, transitioning from traditional methods to modern online approaches. A growing number of IP infringers are moving their illegal activities to the online sphere, particularly through the sale of counterfeit goods on their websites, social media, or e-commerce platforms. In response to these shifting pressures, Thailand implemented the Computer-Related Crime Act B.E. 2550 (CCA) on July 18, 2007, and amended it in 2017, aiming to enhance the effectiveness of combating online infringement by empowering government officials to request that the court block computer data (called “website-blocking”) that infringes upon other parties’ intellectual property rights, as per section 20(3) of the CCA. From 2018 to May 2024, Thailand’s Criminal Court and Central Intellectual Property and International Trade Court have issued 53 orders to block more than 1,779 infringing URLs. One significant recent development is the Criminal Court’s establishment of the Technology Crime Division, which has been operating since April 1, 2024. Its purpose is to address criminal offenses that occur through electronic means, which should then be handled in an effective and prompt manner by judges who have expertise on technological crimes. In addition, several current measures to combat technology crime, including section 20(3) of the CCA, require court orders for the prevention of electronic criminal offenses or online infringement. The Technology Crime Division has the jurisdiction to consider and grant these orders, which will help expedite the approval process and ensure review by specialized judges. Scope of the Technology Crime Division The announcement of the establishment of the Technology Crime Division within the Criminal Court was published in the Government Gazette on March 18, 2024, with operations commencing on April 1, 2024. The Technology Crime Division is empowered to: Consider and adjudicate technology crime cases, except cases falling
Read More
July 4, 2024
The rapid development and deployment of artificial intelligence in various industries is increasingly attracting the attention of regulators, who aim to encourage the progression of AI technologies while ensuring their responsible use. Recent regulatory developments around the world, including in the European Union and Southeast Asia, serve as evidence of this emerging trend. Here we shall discuss the effect of AI regulatory approaches in the  EU on Southeast Asian countries. Approach and Action The EU Artificial Intelligence Act has been officially adopted by EU colegislators and will enter into force 20 days after its publication in the EU Official Journal.[1] Most of its provisions will apply two years after its entry into force. The act establishes a harmonized EU legal framework, aiming at ensuring that AI systems placed on and utilized in the EU market are safe, have managed risks, and are aligned with EU fundamental rights and values. Countries in Southeast Asia, predominantly governed by civil law systems, often adopt statutory frameworks similar to those in the EU when addressing new legal matters. In the rapidly developing field of AI, Southeast Asian countries are adopting a wait-andsee approach toward global regulatory trends. This cautious stance allows them to observe and analyze international developments in AI regulation before crafting their own frameworks. Compared to the EU, countries in Southeast Asia are generally more focused on using AI for national development. Common themes include building human resource capability, developing ecosystems and building infrastructure. Some countries emphasize governance and ethics more than others. Over the past five years, governments across Southeast Asia have been focusing on promoting AI by implementing national policies to strengthen AI promotion and governance. While there may be less regional integration in the approach to AI of countries in Southeast Asia, there are some efforts to create
Read More
June 27, 2024
Thailand recently made history by becoming the first country in Southeast Asia to legalize same-sex marriage. This landmark decision recognizes the equality and dignity of all people, regardless of their sexual orientation or gender identity. It also opens up new opportunities for couples who wish to start or grow their families through adoption. One of the benefits of adopting a child in Thailand is that the law does not discriminate based on the gender or sexual orientation of the adoptive parents. As long as the married couple meets the age and legal requirements, they can adopt a child and become their loving and supportive family. This means that same-sex couples who are married can also enjoy the same rights and responsibilities as any other adoptive parents and provide a caring and nurturing environment for their adopted child. One of the main reasons why same-sex couples can adopt a child in Thailand without any discrimination or prejudice is the strong and comprehensive privacy law that protects the personal data of individuals and families. Thailand’s Personal Data Protection Act (PDPA) ensures that the personal data of people, especially children, is collected, used, and disclosed only for legitimate and lawful purposes, and with respect to their rights and dignity. The PDPA also grants the right of consent and other data subject rights to the legal representatives of children, such as their parents or guardians, regardless of their gender or sexual orientation. This means that same-sex adoptive parents can decide how their adopted children’s personal data is processed and can also protect their children’s privacy and interests from any unauthorized or harmful access. The PDPA also safeguards the personal data of same-sex adoptive parents from any unlawful or discriminatory processing that may damage their reputation or violate their rights. In these ways, the
Read More