You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

August 4, 2026

Thailand Proposes Significant Amendments to the Personal Data Protection Act

Subscribe to Updates

Thailand’s Personal Data Protection Act B.E. 2562 (2019) (PDPA) could soon see some important changes, as a draft bill to amend the PDPA has been introduced in the House of Representatives. The draft amendment is currently in the public consultation phase, with comments accepted from July 16 to August 15, 2026. If enacted in its current form, the amendment would make three key changes: expanding the government exemption to cover anticorruption operations, introducing a statutory definition of “government agency,” and restructuring the lawful bases for personal data processing to align with international standards.

Background

The PDPA has encountered several enforcement challenges since its implementation, including three core problems identified by the bill’s sponsors: (1) the current exemptions for government agencies do not cover anticorruption and misconduct-prevention operations; (2) the PDPA lacks a clear statutory definition of “government agency,” causing legal uncertainty as to which entities are covered; and (3) the existing framework for lawful bases of data processing does not align with international standards—particularly the multiple-lawful-bases system in the EU’s General Data Protection Regulation (GDPR)—making compliance inflexible for both government and private sector entities.

Expanded Government Exemption

The current PDPA exempts government agencies performing duties related to national security (including fiscal security), public safety, anti-money laundering, forensic science, and cybersecurity. The proposed amendment adds “prevention and suppression of corruption and misconduct” to this list of exempted functions. This would allow anticorruption bodies—most notably the National Anti-Corruption Commission (NACC), which is identified as a directly affected party—to collect, use, and disclose personal data without being subject to PDPA requirements when carrying out their duties.

New Statutory Definition of “Government Agency”

Notably, while the current PDPA use the term “government agency” in several provisions, the term is not comprehensively defined, creating potential uncertainty as to its scope. The draft bill therefore inserts a new definition of “government agency” to cover central government agencies, regional government agencies, local government agencies, state enterprises, public organizations, Parliament, courts, independent constitutional organizations, the Office of the Attorney General, public higher-education institutions, and independent state agencies. The proposed definition seeks to clarify which entities are considered “government agencies” and covered by the act.

Restructured Lawful Bases for Data Processing

The most significant proposed change for both government and private-sector organizations is the restructuring of the PDPA’s section 24, which currently prohibits data controllers from collecting personal data without consent, subject to certain exceptions framed as carveouts.

The proposed amendment would restructure section 24 to adopt a multiple-lawful-bases model aligned with the GDPR, and add more clarity on the public-task basis. Under the new framework, personal data processing would be lawful when carried out under at least one of the following bases:

  • Archival/research/statistical: For historical or archival purposes in the public interest, or for research or statistics with appropriate safeguards, as prescribed by the PDPC board.
  • Public task/official authority: Necessary for performing a public-interest mission or exercising official authority, including government disclosure obligations under the Official Information Act or other laws.
  • Vital interests: To prevent or suppress danger to a person’s life, body, or health.
  • Contractual necessity: Necessary for performing a contract with the data subject or for pre-contractual steps at the data subject’s request.
  • Legitimate interests: Necessary for the legitimate interests of the data controller or a third party, unless overridden by the data subject’s fundamental rights.
  • Legal obligation: Necessary for compliance with a legal obligation of the data controller
  • Consent: The data subject has given consent.

The most critical structural shift is that consent is repositioned from the default requirement to one of seven coequal lawful bases.

Next Steps

All organizations should monitor the public consultation process, which is open until August 15, 2026. If enacted, the bill will take effect the day after its publication in the Government Gazette.

Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

July 28, 2023
Myanmar’s Ministry of Commerce (MOC) issued three notifications related to e-commerce on July 21, 2023, classifying online retail businesses as essential services, requiring them to register with the relevant authorities, and setting the criteria for their registration. Under Notification No. 49/2023 the MOC authorized the Department of Trade (DOT) to issue notifications, orders, and directives relating to online retail businesses. This was followed by Notification No. 50/2023, which classifies online retail businesses as essential services under the Essential Supplies and Services Law and requires them to register with the DOT within six months of the issuance of the notification (i.e., by January 21, 2024). Failure to register within the specified period will be punishable by imprisonment for six months to three years and a fine of up to MMK 500,000 (approx. USD 238). Finally, under Notification No. 51/2023, the MOC set out the criteria and requirements for the registration of online retail businesses by entities, business institutions, and individuals, as well as the duties and liabilities of sellers and consumers. Pursuant to this notification, registration should be completed via the DOT’s online system, fees must be paid digitally, and electronic registration certificates will be issued. Certificates are initially valid for two years, and can be renewed. The MOC will provide information at a later time on the prescribed forms, certificate format, registration and online fees, and online registration portal. In applying for registration, an entity or business institution established under the Myanmar Companies Law, Special Company Act, Co-operative Society Law, or any other existing Myanmar laws must have a website with its own domain name or an online channel with an exact address that is used for online sales and a registered business address within Myanmar. Individual applicants must be at least 18 years old, reside in Myanmar, and
Read More
July 26, 2023
Thailand’s Electronic Transactions Development Agency (ETDA) held a briefing session on July 20, 2023, laying out the changes and new requirements in draft sublaws under the Royal Decree on Digital Platform Services. These sublaws are expected to be announced in August 2023. The key changes and new requirements are listed below. The ETDA has drafted guidelines on the methods for identifying active users to give digital platform service operators a better understanding of the calculation methods. The definition of “users” for calculating annual monthly active users (AMAUs) has been reduced in scope to cover only users in Thailand. E-marketplace digital platform services that will suspend or terminate operations for specific users must inform the affected users and provide a period for them to challenge the suspension or termination. Digital platform service operators cannot use the requirements to identify their active users as a legal basis for processing users’ personal data, especially for profiling and tracking activities. The sublaws on announcement of terms and conditions (T&Cs) and changes to T&Cs, once issued, will take effect on January 3, 2024, while the other sublaws will take effect immediately (i.e., August 21, 2023). This shows that the ETDA has acknowledged the private sector’s feedback that the requirements on T&Cs will take more time for operators to comply with. The requirements for changing T&Cs have been adjusted. Under the current draft, the required advance notification period can be exempted if a change in the T&Cs is for the purpose of, for example, rolling out new products or services and improving the platform. Required submissions under the Royal Decree for Digital Platform Services and its sublaws will be made through the ETDA’s online portal. There will likely be no extensions granted for compliance with the Royal Decree for Digital Platform Services and its sublaws
Read More
July 14, 2023
The Bank of Thailand (BOT) has issued new notifications amending regulations for payment businesses that fall under the Payment Systems Act B.E. 2560 (2017) to promote transparency and good governance in the payment industry. Notification No. SorKorChor 2/2566 (“Notification 2”) increases the required qualifications for applicants seeking a license to provide payment services designated as being under the BOT’s supervision, and Notification No. SorKorChor 4/2566 (“Notification 4”) stipulates additional duties and exemptions for certain types of business operators. The notifications were published in the Government Gazette on July 7, 2023, and came into effect the following day. Additional Qualifications Notification 2 expands the list of prohibited characteristics for business operators applying for a license or registration to engage in a designated payment service, and their directors. For example, applicants must not have been ordered to suspend or cease their operations, and their registration or license to engage in financial business or operate a designated payment system or service must not have been revoked. The notification defines “financial business” as including financial institutions, credit card business, personal loan business, securities business, and so on. In addition, applicants’ directors and management must not have prohibited characteristics, such as being involved in the management of a financial business or designated payment system or service that was ordered to suspend or cease its operations. The applicable registration or license also must not have been revoked. Reporting Requirements During the application process, Notification 2 requires applicants to disclose information on shareholders and related parties (including spouses) who hold an aggregate 10 percent or more of the total paid-up shares. Notification 4 imposes this same reporting duty regarding shareholders and related parties but applies it to licensed operators in an ongoing manner. Existing payment service operators must make their first report of this information to
Read More
July 12, 2023
On June 30, 2023, Vietnam’s Ministry of Information and Communications (MIC) issued Circular No. 06/2003/TT-BTTTT to provide implementing guidelines for Decree 71 on editing, ratings, and warnings for video on demand (VOD) sports and entertainment content provided over radio and TV services. Circular 06 will take effect on August 15, 2023. Because Decree 71 allows VOD providers to self-edit and self-rate this type of content, it is important for them to know how the process is regulated in order to fully comply before providing VOD sports and entertainment programs to Vietnamese users. Under Circular 06, radio and TV service providers are required to display ratings and warnings on their programs, following the principles set out in the circular. These service providers must also compile dossiers in a stipulated form on the editing, ratings, and warnings of their programs for reporting to the authority and inspection. The main contents of Circular 06 are as follows. 1. Content Editing The main principles for editing VOD sports and entertainment programs include: Protection of children and other vulnerable people from inappropriate or potentially harmful content. Removal of all illegal/prohibited content, as well as content related to controversial issues or issues not recognized by Vietnamese law. Removal of content or dialogue that disparages the origins of others or makes fun of others’ physical weaknesses, and content that is contrary to Vietnamese culture, morality and fine customs and traditions; Removal of programs if it is discovered during the editing process that in the program or at the venue of the event, there are images or activities violating the prohibitions of the law, violating Vietnamese fine customs and traditions, or containing sensitive political elements. In addition to compliance with the above-mentioned principles, sports and entertainment programs related to health, education, and online gaming must additionally meet
Read More