You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

November 15, 2023

Thailand Signals End to Relaxation of PDPA Enforcement

Subscribe to Updates

Four decisions from the Expert Committee under Thailand’s Personal Data Protection Act B.E. 2562 (2019) (PDPA) indicate that there will no longer be any relaxation of PDPA enforcement.

The enforcement of Thailand’s seminal data protection law had been relaxed for more than a year when, on October 18, 2023, the Personal Data Protection Committee (PDPC) published the first decision made by the Expert Committee on the imposition of administrative measures against a company pursuant to authority granted to it under the Notification of the PDPC Re: Rules for the Consideration of the Imposition of Administrative Penalties by the Expert Committee B.E. 2565 (2022), which was one of the first subordinate regulations issued under the PDPA. Shortly thereafter, on October 19, October 25, and November 15, three additional Expert Committee decisions were published.

These three decisions made by the Expert Committee are summarized below.

October 18 Decision

The complainant in this case lodged a complaint with the Expert Committee alleging that an insurance company contacted him to offer the company’s products without his consent. The complaint further claimed that when the complainant requested the company to disclose how his personal data had been acquired and asked the company to stop contacting him through any channel, the company did not take any action on the requests.

The insurance company appeared to have obtained the personal data of the complainant from another source prior to the PDPA becoming fully effective (i.e., June 1, 2022). As the Expert Committee explained in its order, the company failed to comply with its obligations under the PDPA regarding the collection of personal data from another source, which requires consent as a legal basis; failed to comply with the grandfather provision by not publicizing opt-out procedures to enable the data subject to withdraw his consent easily; and did not grant the data subject the right to have his personal data rectified or deleted.

The Expert Committee ordered the insurance company to:

  1. Comply with its obligations under the PDPA regarding the collection of personal data from another source;
  2. Delete the personal data of the complainant;
  3. Take action to suppress damage, starting from the date of receiving the  order;
  4. Stipulate measures to prevent the occurrence of similar cases; and
  5. Set forth and implement guidelines for complying with the provisions of the PDPA on the right of access, right to rectification, obligation to implement a monitoring system for the deletion of personal data, and so on.

The Expert Committee also ordered the company to report to the Office of the PDPC on the outcome of the actions taken in relation to the five items above within 30 days of receiving the order.

October 19 Decision

The complainant in this case lodged a complaint with the Expert Committee alleging that a mobile banking application service provider did not allow him to give his consent freely in the application. The complainant requested that the service provider amend its consent request format and that he be allowed to withdraw the consent he had previously given to the service provider and its affiliated companies for accessing the application.

By the time the case came before the Expert Committee, the service provider had already amended its consent request format to be compliant with the requirements of the PDPA. Accordingly, the complainant wanted to withdraw his complaint; moreover, the service provider had already proceeded with the requests of the complainant. Considering these facts, the Expert Committee decided to reject the complaint.

October 25 Decision

In this case, the complainant lodged a complaint with the Expert Committee stating that as the former employee of a data controller he was entitled to a transportation card benefit following his employment with the data controller. The data controller sent an email informing the complainant that he could be issued a transportation card via an electronic system, with the condition that he must first provide his personal data in order to access the transportation card issuance system. Subsequently, the complainant received another email from the data controller reporting that his transportation card benefit had been suspended, and that he had accepted this suspension when he gave consent to the processing of personal data as required by the data controller. This was contrary to the complainant’s understanding that the consent was for the issuance of a transportation card only, rather than for the suspension of his rights.

The Expert Committee ordered that:

  1. The data controller must amend its consent request form to be consistent with the purposes notified to the data subjects;
  2. The consent must be freely given by the data subject;
  3. The consent must not be conditional; and
  4. The data controller must not rely on such consent to suspend other rights of the complainant.

Also, the data controller must notify the Office of the PDPC of the outcome of remedial actions pursuant to the above order or take any action to suppress damage within 30 days from the date of receiving the order.

November 15 Decision

The complainant in this case lodged a complaint with the Expert Committee stating that his name and an image of his medical license were acquired by another person who pretended to be a licensed healthcare professional, which resulted in service recipients and the public being misled and the complainant suffering damage to his reputation. The Expert Committee, however, stated that the facts of the case and the information provided by the complaint did not verify that the accused is a data controller who violated or failed to comply with the PDPA, and therefore, the Expert Committee was unable to make a determination on the complaint. Considering these facts, the Expert Committee decided to reject the complaint.

Takeaways

These cases indicate an end to the relaxation of Thailand’s enforcement of its PDPA. As data subjects gain more awareness of their rights over their personal data, more complaints are likely to be lodged with the Expert Committee if data subjects suspect that their personal data is not handled or processed properly by data controllers or data processors. Since the PDPA has been fully effective for over a year, the Expert Committee may be prepared to start taking more serious actions in imposing administrative fines and penalties. Organizations should thus take extra care in ensuring that they stay in compliance with the PDPA.

Tilleke & Gibbins will continue to monitor the development of the PDPA and provide updates as they emerge. If you have questions about the PDPA or any other aspect of data compliance in Thailand, please contact any member of the Tilleke & Gibbins PDPA team, including Nopparat Lalitkomon at [email protected], Gvavalin Mahakunkitchareon at [email protected], Thammapas Chanpanich at [email protected], Wilin Somya at [email protected], and Punyavee Koaysomboon at [email protected].

Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

September 30, 2026
On September 15, 2026, Vietnam’s Ministry of Finance (MOF) released for public consultation a draft circular on reporting and information disclosure in the pilot crypto asset market. The draft implements Resolution No. 05/2025/NQ-CP on the Pilot Implementation of the Crypto Asset Market in Vietnam and provides further detail on how licensed crypto asset service providers (“CASPs”) will be supervised once the market becomes operational. The draft indicates a data-intensive supervisory model, with licensed CASPs serving as the first line of market oversight. Public Disclosure Requirements The draft imposes detailed public disclosure requirements on CASPs, aimed primarily at market transparency. CASPs and crypto asset issuers must make disclosures in both Vietnamese and English, retain reported and disclosed information for at least 10 years, and keep information published on their websites accessible for at least five years. For CASPs, disclosure obligations arise both periodically and when specific events occur. A CASP must announce any crypto asset to be admitted to trading on its website at least seven days before trading begins and publish periodic financial statements. Certain extraordinary events and information requested by the MOF must generally be disclosed within 24 hours. CASPs must also provide ongoing market information. During trading hours, they must publish key trading data, including prices and volumes, daily highs and lows, average prices, the three best bid and offer levels, and transactions by foreign investors. By 9:00 a.m. each trading day, they must publish specified information on the previous day’s trading activity. Regulatory Reporting Requirements Separate from public disclosure, the draft requires CASPs to provide regulators with detailed information enabling ongoing supervision of their operations and the market. For market activity, CASPs must report decisions to admit or remove a crypto asset from trading within 24 hours, submit previous-day trading data to the State Securities Commission
Read More
September 24, 2026
Vietnam is implementing and developing a broad package of regulatory reforms that could reshape how IP, data, digital platforms, and product authenticity are regulated and enforced. Several of the key measures have been led by the Ministry of Public Security in its legislative and administrative capacity, as part of a broader government effort. The core reform package consists of four key legal instruments: proposed amendments to the Criminal Code, a proposed new Data Security Law, a draft Decree on Product Identification, Authentication and Traceability, and the newly enacted Decree No. 330/2026/ND-CP. These instruments include rules on criminal enforcement, data security, electronic identification, product identification and traceability, administrative violations, and cybersecurity sanctions. Combined, these measures will affect copyright enforcement, industrial property rights, trade secrets, AI training data, product provenance, online takedowns, valuation of counterfeit goods and electronic evidence. It is worth noting that, in addition to strengthening criminal penalties for IP crimes, Vietnam’s emerging regulatory framework increasingly treats infringement, data misuse, product authentication, and platform-enabled violations as interconnected regulatory and enforcement challenges. For rights holders and foreign investors, this could mean stronger tools against counterfeiting and online infringement, but also more compliance obligations around data, traceability, AI, platform controls and government-facing reporting. Expansion of Criminal IP Enforcement Proposed amendments to Article 225 of the Criminal Code would expand criminal copyright exposure beyond reproduction and distribution to cover large-scale commercial public performance and online communication of works, phonograms and video recordings. This is important because piracy is increasingly about streaming, unauthorized communication, and platform access models rather than physical copying. Aggravated copyright infringement could be subject to up to 10 years in prison for individuals and fines of up to VND 6 billion (about USD 228,300) for commercial legal entities. The amended Article 226 would expand criminal industrial property liability beyond
Read More
September 17, 2026
Thailand’s Office of the Consumer Protection Board (OCPB) has released for public comment a draft bill to amend the Consumer Protection Act B.E. 2522 (1979), the country’s foundational consumer protection legislation. The draft amendment aims to modernize the nearly five-decade-old framework to address the rapid growth of digital commerce, online advertising, influencer marketing, and new business models. The public consultation period is open until October 10, 2026. Expanded Definitions Covering Digital Commerce The draft significantly broadens several core definitions to capture modern commercial activities: “Consumer” is expanded to include natural persons and nonprofit juristic persons who purchase or receive services, including those solicited by businesses and end users who do not directly pay for the goods or services. “Business operator” now explicitly covers advertising business operators and hired advertising persons, such as influencers and content creators. “Advertising media” is expanded to include digital platforms, social media, and social media user accounts. “Label” now encompasses electronic labels—symbols, codes, or other electronic formats displaying product information. Influencer and Advertising Disclosure Requirements In addition to these expanded definitions, “hired advertising person for selling goods or services” is a new definition covering influencers, content creators, live streamers, affiliate marketers, and virtual online media operators who receive monetary compensation or other benefits for advertising goods or services. Hired advertising persons—including influencers and content creators—must disclose to consumers that content is advertising and reveal their relationship with the business owner. Disclosure is required when the business owner employs the advertiser, pays or provides other benefits for the advertisement, or provides free or discounted products or services. These requirements apply where consumers would not otherwise know that the business has a connection to the person presenting the content. Labeling Requirements for Importers The draft introduces a clearer labeling obligation for importers of label-controlled goods, who must
Read More
September 11, 2026
Thailand’s National Broadcasting and Telecommunications Commission (NBTC) has published a new five-year master plan that will bring significant regulatory changes to the broadcasting and digital media sectors, including formal licensing requirements for internet-based audiovisual services. The Master Plan for Broadcasting and Television, 3rd Edition (B.E. 2569–2573/2026–2030) was published in the Government Gazette on September 1, 2026, and will affect OTT platforms, internet-based audiovisual service providers, and traditional broadcasters. Licensing Reform The NBTC will develop new licensing frameworks ahead of existing digital television license expirations, which are slated to occur between 2028 and 2030. This creates both uncertainty and opportunity for incumbents and new market entrants. New licensing criteria will also be developed for audiovisual services delivered over the internet, meaning previously unregulated internet-based providers may face licensing, fee, and content obligations for the first time. The plan also calls for a new law to govern converged communications services. OTT Regulation and Content Oversight The plan explicitly acknowledges and aims to lessen the regulatory asymmetry between traditional broadcasters—which are subject to licensing, fees, and content regulation—and internet-based services that currently face fewer obligations. The NBTC intends to develop regulatory frameworks to bring internet-based audiovisual services, including OTT platforms, streaming services, and user-generated content platforms, under content, consumer protection, and licensing requirements. Consumer Protection and Digital Rights The NBTC will strengthen its oversight of broadcasting, television, and telecommunications operators to ensure compliance with consumer protection and personal data protection requirements. This includes updating relevant notifications and orders and more strictly enforcing rules against practices that unfairly exploit consumers. These measures may layer NBTC-specific requirements on top of Thailand’s existing Personal Data Protection Act obligations. Stricter enforcement against practices that exploit consumers is a priority, with particular scrutiny on advertising practices. The NBTC will modernize complaint resolution processes, meaning service providers should
Read More