You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

August 4, 2026

Thailand Proposes Significant Amendments to the Personal Data Protection Act

Subscribe to Updates

Thailand’s Personal Data Protection Act B.E. 2562 (2019) (PDPA) could soon see some important changes, as a draft bill to amend the PDPA has been introduced in the House of Representatives. The draft amendment is currently in the public consultation phase, with comments accepted from July 16 to August 15, 2026. If enacted in its current form, the amendment would make three key changes: expanding the government exemption to cover anticorruption operations, introducing a statutory definition of “government agency,” and restructuring the lawful bases for personal data processing to align with international standards.

Background

The PDPA has encountered several enforcement challenges since its implementation, including three core problems identified by the bill’s sponsors: (1) the current exemptions for government agencies do not cover anticorruption and misconduct-prevention operations; (2) the PDPA lacks a clear statutory definition of “government agency,” causing legal uncertainty as to which entities are covered; and (3) the existing framework for lawful bases of data processing does not align with international standards—particularly the multiple-lawful-bases system in the EU’s General Data Protection Regulation (GDPR)—making compliance inflexible for both government and private sector entities.

Expanded Government Exemption

The current PDPA exempts government agencies performing duties related to national security (including fiscal security), public safety, anti-money laundering, forensic science, and cybersecurity. The proposed amendment adds “prevention and suppression of corruption and misconduct” to this list of exempted functions. This would allow anticorruption bodies—most notably the National Anti-Corruption Commission (NACC), which is identified as a directly affected party—to collect, use, and disclose personal data without being subject to PDPA requirements when carrying out their duties.

New Statutory Definition of “Government Agency”

Notably, while the current PDPA use the term “government agency” in several provisions, the term is not comprehensively defined, creating potential uncertainty as to its scope. The draft bill therefore inserts a new definition of “government agency” to cover central government agencies, regional government agencies, local government agencies, state enterprises, public organizations, Parliament, courts, independent constitutional organizations, the Office of the Attorney General, public higher-education institutions, and independent state agencies. The proposed definition seeks to clarify which entities are considered “government agencies” and covered by the act.

Restructured Lawful Bases for Data Processing

The most significant proposed change for both government and private-sector organizations is the restructuring of the PDPA’s section 24, which currently prohibits data controllers from collecting personal data without consent, subject to certain exceptions framed as carveouts.

The proposed amendment would restructure section 24 to adopt a multiple-lawful-bases model aligned with the GDPR, and add more clarity on the public-task basis. Under the new framework, personal data processing would be lawful when carried out under at least one of the following bases:

  • Archival/research/statistical: For historical or archival purposes in the public interest, or for research or statistics with appropriate safeguards, as prescribed by the PDPC board.
  • Public task/official authority: Necessary for performing a public-interest mission or exercising official authority, including government disclosure obligations under the Official Information Act or other laws.
  • Vital interests: To prevent or suppress danger to a person’s life, body, or health.
  • Contractual necessity: Necessary for performing a contract with the data subject or for pre-contractual steps at the data subject’s request.
  • Legitimate interests: Necessary for the legitimate interests of the data controller or a third party, unless overridden by the data subject’s fundamental rights.
  • Legal obligation: Necessary for compliance with a legal obligation of the data controller
  • Consent: The data subject has given consent.

The most critical structural shift is that consent is repositioned from the default requirement to one of seven coequal lawful bases.

Next Steps

All organizations should monitor the public consultation process, which is open until August 15, 2026. If enacted, the bill will take effect the day after its publication in the Government Gazette.

Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

October 25, 2023
Thailand has released a notification adding new consumer protection provisions related to the collection of prepaid telecom service fees and combining several disparate regulations and resolutions. The Notification on the Criteria Relating to the Collection of Prepaid Telecommunications Service Fees was issued on September 4, 2023, and came into effect on September 21, 2023. The notification will be enforced as a general regulation and guideline for all telecom services other than fixed broadband services, which already fall under a comparable regulation.   Previously, Thailand’s National Broadcasting and Telecommunications Commission (NBTC) had issued several regulations to regulate the collection of prepaid telecom service fees. These include the NBTC Notification on Contract Standards, the NBTC Notification on the Maximum Service Fee Rate and Collection of Prepaid Telecommunications Service Fees, and the NBTC Notification on the Criteria Relating to the Collection of Prepaid Fixed High-Speed Broadband Service Fees. These are now subsumed by the new notification. Key requirements of the new notification on prepaid telecom fee collection are described below. Collection Approval Requirement Before collecting prepaid telecom service fees, service providers (SPs) must apply to the NBTC for approval by submitting the required forms and supporting documents. Changes to the criteria and methods of prepaid telecom service fee collection must also be reapproved. This provision aims to protect against fraud and money-laundering transactions. The NBTC will consider whether to approve an SP’s proposal for the maximum period to be covered by the prepaid service fees on a case-by-case basis. After the collection criteria and methods are approved by the NBTC, SPs must inform their users individually. SPs must also report to the NBTC by the 15th of every month after receiving the NBTC’s approval to collect prepaid service fees. Approvals of prepaid service fee collection granted by the NBTC prior to the
Read More
October 17, 2023
On June 20, 2023, Vietnam’s new Law on Protection of Consumers’ Rights (“CPL 2023”) was officially promulgated, followed two days later by a new Law on E-Transactions (“LOET 2023”). The new laws, which will both take effect from July 1, 2024, replacing the CPL 2010 and the LOET 2005, respectively, provide new regulations for e-commerce platforms and will impact e-commerce activities in Vietnam. Some of the more significant changes are outlined below. Law on Protection of Consumers’ Rights Regulation of offshore entities: Previously, the CPL 2010 regulated only organizations and individuals in the territory of Vietnam. Under the CPL 2023, both onshore and offshore agencies, organizations, and individuals related to protecting consumers’ rights are regulated. In other words, Vietnam intends to monitor and manage activities of platforms with no legal presence in Vietnam. Remote transactions: Previously, the laws on consumer protection regulated “remote contracts.” The CPL 2023 introduces and defines “remote transactions” as transactions made online, by electronic means or by other means wherein consumers cannot check or have direct contact with products, goods or services before participating in the transaction. In addition, the CPL 2023 also provides for additional responsibilities of business entities offering remote transactions such as adequately and precisely providing consumers with information when entering into these remote transactions, including the rights of consumers in case of incomplete or inaccurate provision of information and complaint handling mechanisms. Online businesses: The CPL 2023 introduces “online businesses,” which are defined as (i) those trading products, goods, and services via their self-established platforms or digital platforms or (ii) those establishing or operating intermediary digital platforms. According to the Vietnam Competition Commission in a recent workshop, the definitions of “digital platforms” and “intermediary digital platforms” can be referred to in the LOET 2023 (see below). Under this new category, online
Read More
October 10, 2023
The Royal Decree issued under the Revenue Code B.E. 2481 (1938) on the Exemption from Taxes (No. 779) B.E. 2566 (Royal Decree No. 779), which came into force on August 16, 2023, provides exemptions from corporate income tax (CIT) and value-added tax (VAT) for qualifying transfers of digital tokens for investment. Transfers of these digital investment tokens—as opposed to securities transfers—have been subject to taxes. By establishing CIT and VAT exemptions, Royal Decree No. 779 introduces incentives in order to promote digital investment tokens as a new alternative tool for fundraising. The authorities hope that this will stimulate investment in the country’s economic system and elevate the standards for digital assets in Thailand. The key points of Royal Decree No. 779 are summarized below. Digital Investment Token Definition Royal Decree No. 779 and relevant digital asset regulations define “digital investment tokens” as a type of digital tokens that grant the holder the right to invest in a project or business, with the holders of the digital investment tokens receiving a share of revenue or profits as a return on their investment. In this way, digital investment tokens resemble securities. Tax Exemptions Primary Market Royal Decree No. 779 exempts companies and registered partnerships that legally issue and offer digital investment tokens for sale to the public (i.e., the primary market) from CIT and VAT on income or the value of the tax base earned from the sale. These exemptions apply to all primary market issuance from May 14, 2023, onward. However, the relevant notifications of Thailand’s Securities and Exchange Commission only allow limited companies (private and public) incorporated under Thai law to offer digital tokens for sale. Therefore, registered partnerships will not yet be able to benefit from the tax exemptions in Royal Decree No. 779. If a digital token
Read More
October 2, 2023
Thailand’s National Broadcasting and Telecommunications Commission (NBTC) has issued the Notification of the NBTC Re: Measures to Protect Telecommunications Service Users’ Rights Regarding Personal Data, Privacy Rights, and Freedom of Telecommunications to replace the previous 2006 notification of the same name. The replacement notification supports compliance with the Personal Data Protection Act B.E. 2562 (2019) (PDPA), modernizes the regulations in response to technological change and the convergence of digital business, and enhances the protection of telecommunications users’ personal data, privacy rights, and freedoms. Key aspects of the replacement notification are highlighted below. User Data and Consent The notification specifies that “user’s personal data” includes name, address, ID number, mobile number, usage information, and user behavior that can identify the user. “User” does not include resellers of telecommunications services. To collect, use, or disclose users’ personal data for a purpose other than telecommunications service, service providers must obtain each user’s consent prior to or at the time of collecting the data. The consent (whether written or electronic) must be separate from the telecommunications service agreement. Service providers must clarify the purpose of collecting data, and they must honor users’ rights to opt in and opt out by providing clear and convenient channels for users to withdraw any of their information or cancel any services offered by the operator. Service providers must add an electronic channel for receiving requests from users to review, access, edit, change, or obtain a copy of their data. The electronic channel must also allow requests from users to suspend use or disclosure of their personal data and withdraw consent to collect, use, or disclose their personal data. In addition, service providers must have a system for verifying the identity of users who want to exercise the rights listed in this paragraph. Data Collection and Storage Collection
Read More