You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

August 4, 2026

Thailand Proposes Significant Amendments to the Personal Data Protection Act

Subscribe to Updates

Thailand’s Personal Data Protection Act B.E. 2562 (2019) (PDPA) could soon see some important changes, as a draft bill to amend the PDPA has been introduced in the House of Representatives. The draft amendment is currently in the public consultation phase, with comments accepted from July 16 to August 15, 2026. If enacted in its current form, the amendment would make three key changes: expanding the government exemption to cover anticorruption operations, introducing a statutory definition of “government agency,” and restructuring the lawful bases for personal data processing to align with international standards.

Background

The PDPA has encountered several enforcement challenges since its implementation, including three core problems identified by the bill’s sponsors: (1) the current exemptions for government agencies do not cover anticorruption and misconduct-prevention operations; (2) the PDPA lacks a clear statutory definition of “government agency,” causing legal uncertainty as to which entities are covered; and (3) the existing framework for lawful bases of data processing does not align with international standards—particularly the multiple-lawful-bases system in the EU’s General Data Protection Regulation (GDPR)—making compliance inflexible for both government and private sector entities.

Expanded Government Exemption

The current PDPA exempts government agencies performing duties related to national security (including fiscal security), public safety, anti-money laundering, forensic science, and cybersecurity. The proposed amendment adds “prevention and suppression of corruption and misconduct” to this list of exempted functions. This would allow anticorruption bodies—most notably the National Anti-Corruption Commission (NACC), which is identified as a directly affected party—to collect, use, and disclose personal data without being subject to PDPA requirements when carrying out their duties.

New Statutory Definition of “Government Agency”

Notably, while the current PDPA use the term “government agency” in several provisions, the term is not comprehensively defined, creating potential uncertainty as to its scope. The draft bill therefore inserts a new definition of “government agency” to cover central government agencies, regional government agencies, local government agencies, state enterprises, public organizations, Parliament, courts, independent constitutional organizations, the Office of the Attorney General, public higher-education institutions, and independent state agencies. The proposed definition seeks to clarify which entities are considered “government agencies” and covered by the act.

Restructured Lawful Bases for Data Processing

The most significant proposed change for both government and private-sector organizations is the restructuring of the PDPA’s section 24, which currently prohibits data controllers from collecting personal data without consent, subject to certain exceptions framed as carveouts.

The proposed amendment would restructure section 24 to adopt a multiple-lawful-bases model aligned with the GDPR, and add more clarity on the public-task basis. Under the new framework, personal data processing would be lawful when carried out under at least one of the following bases:

  • Archival/research/statistical: For historical or archival purposes in the public interest, or for research or statistics with appropriate safeguards, as prescribed by the PDPC board.
  • Public task/official authority: Necessary for performing a public-interest mission or exercising official authority, including government disclosure obligations under the Official Information Act or other laws.
  • Vital interests: To prevent or suppress danger to a person’s life, body, or health.
  • Contractual necessity: Necessary for performing a contract with the data subject or for pre-contractual steps at the data subject’s request.
  • Legitimate interests: Necessary for the legitimate interests of the data controller or a third party, unless overridden by the data subject’s fundamental rights.
  • Legal obligation: Necessary for compliance with a legal obligation of the data controller
  • Consent: The data subject has given consent.

The most critical structural shift is that consent is repositioned from the default requirement to one of seven coequal lawful bases.

Next Steps

All organizations should monitor the public consultation process, which is open until August 15, 2026. If enacted, the bill will take effect the day after its publication in the Government Gazette.

Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

April 17, 2023
Since the issuance last October of Decree No. 71/2022/ND-CP (“Decree 71”), the differentiation of film vs. non-film content has become increasingly important for pay-TV service providers in Vietnam, because they are subject to completely different licensing requirements. With the effectiveness of Decree 71 on January 1, 2023, overseas providers of over-the-top (OTT) pay-TV services, including video on demand (VOD) content, to Vietnamese users are subject to licensing requirements and the establishment of a local presence in Vietnam. Meanwhile, the new Cinema Law promulgated on June 15, 2022, and its guiding Decree No. 131/2022/ND-CP dated December 31, 2022—both of which also took effect on January 1, 2023—do not impose any licensing requirements on film disseminators. Although there are ambiguities in Decree 71’s wording, the Ministry of Information and Communication (MIC) and the Authority for Broadcasting and Electronic Information (ABEI) under the MIC have confirmed orally in a closed industry meeting, without written confirmation, that for VOD film-only content, OTT pay-TV service providers are exempted from the licensing requirements of Decree 71 and are instead subject to regulations of the Cinema Law. This is why film vs. non-film content has become critical in shaping the business models of overseas pay-TV service providers. In this article, we provide an overview of the current regulations and draft regulations with regard to the classification/rating of film content under the regulations of the Cinema Law and its sub-laws, and the classification/rating of non-film content under the regulations of Decree 71.   Film Classification/Rating Under the Cinema Law, “films” are defined to include feature films, documentaries, cartoons, and films of combined genres. The law explicitly provides that “films” do not include recorded products for disseminating news, art shows, video games, recorded products that show the activities of one or more people and describe events and situations,
Read More
March 30, 2023
Digital asset litigation is one of the most cutting-edge types of litigation in Thailand. There are factual, technical, regulatory, and legal challenges and hurdles for the parties to the dispute throughout all procedural stages. This is mainly because digital assets are different in nature from more conventional types of assets, as they are digitally created and used on a blockchain network. Legal Status The first issue to be aware of in approaching digital asset litigation is the legal status of digital assets. Under Thai law, there are two key terms concerning digital assets’ legal status: “thing” and “property.” Things are tangible objects, while property provides a much wider range of meaning. Property could be anything—including intangible objects that may be of value and able to be appropriated. It is fairly clear that digital assets are not a “thing” since they are not tangible. However, determining whether digital assets are “property” is even more complicated. Although digital assets are intangible objects, one might argue that, unlike fiat money, they do not have any inherent value but are rather conferred value based on certain people’s perspective. (For example, the Bank of Thailand expressed this opinion of bitcoin in 2014.) Some may even argue that digital assets cannot be possessed and therefore cannot be appropriated. According to these arguments, digital assets should not be regarded as a property either. Legal Grounds Determining whether digital assets are things, property, or something else altogether is crucial to any subsequent litigation. In Thailand, the party initiating the lawsuit (the plaintiff) generally has to state the relevant legal grounds for the complaint—that is, the different relevant legal provisions that the court is to apply to the case. These provisions of Thai laws mostly refer only to “things” or to “property,” not both. This often means that
Read More
March 20, 2023
Thailand has enacted new legislation to counter cybercrime and scams. The Royal Decree on Measures for Protection and Suppression of Technology Crimes B.E. 2566 (2023) (“Cybercrime Decree”) was published in the Government Gazette on March 16, 2023, and took effect the following day. The Cybercrime Decree provides a new legal tool to interrupt the money-laundering process and aims to crack down on cybercrime perpetrators and scammers by providing stronger legal measures applying to certain types of offenders that had not been sufficiently covered by existing laws. This new legislation grants victims the right to have commercial banks and online payment platforms freeze suspicious transactions and obligates these banks and platforms to comply with such requests. It further requires these banks and platforms—as well as other service providers—to share data for the prompt prevention and suppression of cybercrime. The key rights, duties, and offenses established by the Cybercrime Decree are detailed below. Freezing Transactions The Cybercrime Decree requires commercial banks and online payment platforms to temporarily freeze (for 72 hours) any related transactions of their account holders upon receipt of an alert from the account holder that he or she is the victim of cybercrime. Victims can report these illicit transactions by phone or electronic means. If by phone, the relevant bank or platform must document the call. The victim must file a police complaint about the illicit transaction within 72 hours of the freeze being made. A police inquiry officer will then notify the bank or platform about the complaint, and the transaction freeze must be maintained for seven days from the filing of the complaint with the police. The police will then determine whether it is necessary to keep the transaction frozen for longer than seven days. If the seven days lapse without a further order to freeze the
Read More
February 28, 2023
Influencer marketing and the creation of sponsored content is an increasingly popular way for brands to reach their target audience. Although there is no universal definition of an “influencer,” the term is broadly used to describe people who are able to affect purchasing decisions of others through their relationship with their audience. In the context of social media and the creator economy, influencers are usually people with significant followings on platforms such as Instagram, TikTok, Twitch, or YouTube who are viewed as celebrities, opinion leaders, trendsetters, or experts in their respective field. Based on a study conducted by Nielsen in 2022, 80% of social media users in Asia who follow influencers are likely to purchase products recommended by the influencers. Brand owners should be aware of five key legal considerations when entering into influencer marketing agreements. 1. Making informed decisions through due diligence Every collaboration with an influencer is a business relationship. Brands must conduct thorough due diligence on potential influencers prior to engaging them. This may include deep dives into the individual’s old social media posts, as well as requests for disclosure of prior controversial incidents and existing brand associations. For example, a health and fitness brand may not want—for both legal and commercial reasons—to be publicly associated with an influencer who is a brand ambassador of electronic cigarettes, no matter how impressive the latter’s Instagram following or deadlift record is. Brands should also ensure that their influencer marketing agreements include relevant representations and warranties that the influencer has not and will not commit a crime or act in a way that may cause negative publicity for the brand. This may include racist, extremist, homophobic, violent, or misogynistic acts, or any other acts that are obscene or against public order. 2. Clearly defining the scope of engagement Brands
Read More