Thailand’s Office of the Personal Data Protection Committee (PDPC) published a series of draft guidance documents for public consultation on July 7, 2026. Issued under the Personal Data Protection Act B.E. 2562 (2019) (PDPA), the drafts address a range of compliance issues and offer insight into the regulator’s current enforcement priorities.
This article examines two of those drafts: one on lawful bases for processing personal data, and another on marketing and direct marketing. Together, they reflect the Office of the PDPC’s evolving expectations on lawful-basis selection, accountability, and the use of personal data in marketing. Organizations operating in Thailand should assess the practical implications now, before the guidance is finalized.
Lawful Bases: A Structured Selection Process
The draft guidance on lawful bases introduces a systematic five-step process for selecting an appropriate lawful basis for each processing activity. Organizations are expected to:
- Identify the processing activity involved.
- Assess the appropriate lawful basis.
- Evaluate whether the data is necessary for the processing.
- Conduct a legitimate interest assessment (LIA) where applicable.
- Ensure transparency through privacy notices.
The guidance provides practical explanations and examples for each lawful basis under section 24 of the PDPA—including archiving, research, statistics, vital interests, contractual necessity, legal obligation, public task, legitimate interests, and consent—as well as the bases applicable to sensitive personal data under section 26. The aim is to promote more consistent and accurate lawful-basis selection across public- and private-sector organizations.
A recurring theme throughout the guidance is that organizations should select the lawful basis that most accurately reflects the actual purpose and circumstances of the processing activity. The guidance cautions against treating consent as a default or catch-all basis where another lawful basis is more appropriate. For processing based on legitimate interests, organizations should conduct and document an LIA. Processing involving sensitive personal data may require additional safeguards and impact assessments depending on the level of risk.
The guidance also reinforces the PDPA’s accountability principle by encouraging organizations to maintain supporting documentation—including privacy notices, records of processing activities (ROPAs), LIAs, and data protection impact assessments (DPIAs)—as evidence of their lawful-basis determinations and compliance efforts.
Marketing: Consent Separation, AI Transparency, and Opt-Out Mechanics
The draft guidance on marketing and direct marketing helps organizations apply PDPA principles to the growing use of personal data in marketing. Recognizing that personal data is increasingly used to analyze consumer behavior, preferences, and purchasing patterns in the digital economy, the guidance promotes responsible marketing practices while mitigating risks to data subjects’ rights and freedoms.
The guidance covers a broad range of marketing activities, including direct marketing, digital marketing, profiling, and AI-driven marketing. It addresses the application of lawful bases, transparency requirements, consent management, and data subject rights across different marketing scenarios.
A recurring theme throughout the guidance is that marketing activities should be supported by an appropriate lawful basis and carried out transparently. Key points include:
- Marketing consent should be kept separate from the primary service relationship.
- Organizations should avoid practices that may undermine the validity of consent, such as preselected boxes, bundled consent requests, or manipulative user-interface designs.
- Individuals who decline marketing communications should not be denied access to core products or services where the marketing communications are not necessary for providing those services.
The guidance also highlights the importance of data subject choice and control, encouraging organizations to implement effective mechanisms for withdrawing consent and objecting to direct marketing activities. It addresses the use of personal data obtained from affiliates, business partners, and data brokers, as well as the growing use of profiling and AI-enabled marketing. Organizations are encouraged to ensure appropriate transparency, identify a suitable lawful basis, and implement additional safeguards where marketing activities may pose elevated privacy risks. The guidance also highlights specific areas of regulatory focus, including the need to:
- Separate marketing consent from core service agreements.
- Exercise caution when relying on personal data obtained through third-party sharing arrangements or data brokers.
- Implement additional transparency and safeguards for profiling and AI-driven marketing activities.
Practical Implications and Next Steps
In light of the draft guidance, organizations should consider taking the following steps:
- Review lawful-basis assessments for all processing activities.
- Revisit consent mechanisms to ensure they meet PDPA requirements.
- Assess marketing activities across all channels and eliminate practices that may undermine valid consent.
- Conduct due diligence on third-party data sources and marketing partners.
- Evaluate profiling and AI-driven marketing activities for elevated privacy risks.
- Update compliance documentation—including privacy notices, ROPA, LIAs, DPIAs, and consent records—to support accountability and demonstrate compliance.
Although the draft guidance is not yet final, it provides a useful indication of the Office of the PDPC’s expectations for PDPA compliance in areas that commonly present practical challenges. Organizations that process personal data in Thailand—particularly for marketing, profiling, or AI-enabled activities—should monitor the consultation process and use the draft guidance as an opportunity to identify potential compliance gaps and assess whether their current practices are sufficiently documented and aligned with the regulator’s emerging approach.
