You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

August 4, 2026

Thailand Proposes Significant Amendments to the Personal Data Protection Act

Subscribe to Updates

Thailand’s Personal Data Protection Act B.E. 2562 (2019) (PDPA) could soon see some important changes, as a draft bill to amend the PDPA has been introduced in the House of Representatives. The draft amendment is currently in the public consultation phase, with comments accepted from July 16 to August 15, 2026. If enacted in its current form, the amendment would make three key changes: expanding the government exemption to cover anticorruption operations, introducing a statutory definition of “government agency,” and restructuring the lawful bases for personal data processing to align with international standards.

Background

The PDPA has encountered several enforcement challenges since its implementation, including three core problems identified by the bill’s sponsors: (1) the current exemptions for government agencies do not cover anticorruption and misconduct-prevention operations; (2) the PDPA lacks a clear statutory definition of “government agency,” causing legal uncertainty as to which entities are covered; and (3) the existing framework for lawful bases of data processing does not align with international standards—particularly the multiple-lawful-bases system in the EU’s General Data Protection Regulation (GDPR)—making compliance inflexible for both government and private sector entities.

Expanded Government Exemption

The current PDPA exempts government agencies performing duties related to national security (including fiscal security), public safety, anti-money laundering, forensic science, and cybersecurity. The proposed amendment adds “prevention and suppression of corruption and misconduct” to this list of exempted functions. This would allow anticorruption bodies—most notably the National Anti-Corruption Commission (NACC), which is identified as a directly affected party—to collect, use, and disclose personal data without being subject to PDPA requirements when carrying out their duties.

New Statutory Definition of “Government Agency”

Notably, while the current PDPA use the term “government agency” in several provisions, the term is not comprehensively defined, creating potential uncertainty as to its scope. The draft bill therefore inserts a new definition of “government agency” to cover central government agencies, regional government agencies, local government agencies, state enterprises, public organizations, Parliament, courts, independent constitutional organizations, the Office of the Attorney General, public higher-education institutions, and independent state agencies. The proposed definition seeks to clarify which entities are considered “government agencies” and covered by the act.

Restructured Lawful Bases for Data Processing

The most significant proposed change for both government and private-sector organizations is the restructuring of the PDPA’s section 24, which currently prohibits data controllers from collecting personal data without consent, subject to certain exceptions framed as carveouts.

The proposed amendment would restructure section 24 to adopt a multiple-lawful-bases model aligned with the GDPR, and add more clarity on the public-task basis. Under the new framework, personal data processing would be lawful when carried out under at least one of the following bases:

  • Archival/research/statistical: For historical or archival purposes in the public interest, or for research or statistics with appropriate safeguards, as prescribed by the PDPC board.
  • Public task/official authority: Necessary for performing a public-interest mission or exercising official authority, including government disclosure obligations under the Official Information Act or other laws.
  • Vital interests: To prevent or suppress danger to a person’s life, body, or health.
  • Contractual necessity: Necessary for performing a contract with the data subject or for pre-contractual steps at the data subject’s request.
  • Legitimate interests: Necessary for the legitimate interests of the data controller or a third party, unless overridden by the data subject’s fundamental rights.
  • Legal obligation: Necessary for compliance with a legal obligation of the data controller
  • Consent: The data subject has given consent.

The most critical structural shift is that consent is repositioned from the default requirement to one of seven coequal lawful bases.

Next Steps

All organizations should monitor the public consultation process, which is open until August 15, 2026. If enacted, the bill will take effect the day after its publication in the Government Gazette.

Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

September 11, 2025
Thailand’s Securities and Exchange Commission (SEC) has amended its digital asset regulations to permit the offering, trading, and provision of services related to tokenized environmental commodities by licensed digital asset exchanges, brokers, and dealers. This regulatory development is aimed at facilitating Thailand’s green economy and net-zero goals while diversifying the products available in the regulated digital assets market. The environmental commodities currently being traded on certain market platforms and via over-the-counter channels include: Carbon credits: Tradable certificates representing a reduction of CO₂ emitted into the atmosphere. Renewable energy certificates (RECs): Tradable proof of electricity generated from renewable energy sources. Carbon allowances: Tradable permits to emit a capped amount of greenhouse gases. The tokenization of these instruments is essentially the process of converting them into digital tokens, making it possible to list them on blockchain exchanges for trading purposes. Background Tokenized carbon credits, RECs, and carbon allowances fall under the category of utility tokens for consumption purposes or tokens representing entitlement certificates—that is, group 1 utility tokens, which are not considered financial products. The offering, trading, and provision of secondary-market services of this type of token are exempted from licensing requirements for regulated digital asset businesses under the Emergency Decree on Digital Asset Businesses B.E. 2561 (2018). Under the previous regulatory framework, licensed digital asset business operators were not allowed to provide services involving such unregulated tokens, as it was deemed to be engaging in “other businesses,” which digital asset operators generally cannot engage in without prior SEC approval. Regulatory Amendment Under the amended digital asset regulations, licensed digital asset exchanges, brokers, and dealers may now apply for SEC approval to offer services related to these tokenized assets as “other businesses,” including listing them for trading on digital asset exchanges. Apart from requiring operators to comply with the general conditions
Read More
September 4, 2025
With advancements in health technology, telemedicine has taken on a wider online presence in Thailand. Under the Medical Facility Act, licensed clinics and hospitals may now diagnose, prescribe, and issue electronic prescriptions during a video call, provided they maintain patient confidentiality and proper recordkeeping. As a complementary concept, a telepharmacy allows a pharmacist to verify prescriptions, counsel patients, and dispense medication from a remote site. Hospitals, clinic chains, and some retail pharmacy groups have adopted “drive-thru” or “locker” pick-up points where drugs are bagged only after a real-time video consultation with a registered pharmacist. The clear benefits of telehealth include shorter waiting times and broader access to specialists, which is in the public interest. Drug Distribution and Advertising in Thailand The online pharmacy ecosystem creates a legal bridge in that once a teleconsulting doctor issues an e-prescription, a licensed pharmacy can lawfully dispense and deliver the medicine prescribed to the patient’s door. Nonetheless, the critical compliance component remains the advertising of medicinal drugs. It is still not allowed to advertise prescription/pharmacy-dispensed drugs to the public in Thailand. Although Thailand’s Drug Act of 1967 was written more than half a century ago, it still governs the trading of every medicinal drug that makes its way to consumers in Thailand—whether bought at a pharmacy or delivered with a few taps on a smartphone. First and foremost, the pharmacy must hold a license to sell medicinal drugs as a retailer. It is also mandatory that arrangements be made for a pharmacist to be on duty during opening hours. Drugs are classified into three main categories: prescription drugs, pharmacy-dispensed drugs, and over-the-counter (OTC) drugs. The listing of OTC drugs with their prices via an online platform is allowed, as only OTC drugs may be advertised directly to the public. However, naming or showing
Read More
September 2, 2025
Thailand’s National Space Policy Committee (NSPC) has proposed new regulations that would permit foreign satellite operators to provide services within the country. The draft announcement responds to rapid advancements in digital and space technologies that have led to new global satellite operators expanding their services worldwide, including into Thailand. These include low-Earth-orbit (LEO) satellite constellations offering high-speed internet, nonterrestrial network (NTN) technologies that integrate terrestrial and satellite communications, and direct-to-device (D2D) technologies that transmit signals directly from satellites to mobile devices without relying on terrestrial networks. The draft aims to replace the existing announcement, which was issued in 2021, to better align with current national policies on foreign satellite usage. The draft announcement was published for public consultation on August 20, 2025, with the comment period concluding on September 3, 2025. Applying for Authorization Two types of operators may apply for authorization: Thai operators who intend to use foreign satellites owned by World Trade Organization (WTO) member countries to provide satellite communication services to third parties; and Foreign operators of satellites owned by WTO member countries who intend to operate a business providing satellite communication services within Thailand. Applications for approval must be submitted to the National Broadcasting and Telecommunications Commission (NBTC) according to the NBTC’s established procedures. In considering whether to permit foreign satellites to provide services within Thailand, the relevant authority will take into account technical justifications, economic benefits, social benefits, and national security considerations. Determining Satellite Ownership The determination of which country qualifies as the owner of a satellite is based primarily on the country that holds the satellite network filing rights registered with the International Telecommunication Union (ITU). The satellite network filing includes details regarding frequency usage, orbital positions, and technical specifications of the satellite operations. It serves as a regulatory tool used by the
Read More