You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

November 15, 2023

Thailand Signals End to Relaxation of PDPA Enforcement

Subscribe to Updates

Four decisions from the Expert Committee under Thailand’s Personal Data Protection Act B.E. 2562 (2019) (PDPA) indicate that there will no longer be any relaxation of PDPA enforcement.

The enforcement of Thailand’s seminal data protection law had been relaxed for more than a year when, on October 18, 2023, the Personal Data Protection Committee (PDPC) published the first decision made by the Expert Committee on the imposition of administrative measures against a company pursuant to authority granted to it under the Notification of the PDPC Re: Rules for the Consideration of the Imposition of Administrative Penalties by the Expert Committee B.E. 2565 (2022), which was one of the first subordinate regulations issued under the PDPA. Shortly thereafter, on October 19, October 25, and November 15, three additional Expert Committee decisions were published.

These three decisions made by the Expert Committee are summarized below.

October 18 Decision

The complainant in this case lodged a complaint with the Expert Committee alleging that an insurance company contacted him to offer the company’s products without his consent. The complaint further claimed that when the complainant requested the company to disclose how his personal data had been acquired and asked the company to stop contacting him through any channel, the company did not take any action on the requests.

The insurance company appeared to have obtained the personal data of the complainant from another source prior to the PDPA becoming fully effective (i.e., June 1, 2022). As the Expert Committee explained in its order, the company failed to comply with its obligations under the PDPA regarding the collection of personal data from another source, which requires consent as a legal basis; failed to comply with the grandfather provision by not publicizing opt-out procedures to enable the data subject to withdraw his consent easily; and did not grant the data subject the right to have his personal data rectified or deleted.

The Expert Committee ordered the insurance company to:

  1. Comply with its obligations under the PDPA regarding the collection of personal data from another source;
  2. Delete the personal data of the complainant;
  3. Take action to suppress damage, starting from the date of receiving the  order;
  4. Stipulate measures to prevent the occurrence of similar cases; and
  5. Set forth and implement guidelines for complying with the provisions of the PDPA on the right of access, right to rectification, obligation to implement a monitoring system for the deletion of personal data, and so on.

The Expert Committee also ordered the company to report to the Office of the PDPC on the outcome of the actions taken in relation to the five items above within 30 days of receiving the order.

October 19 Decision

The complainant in this case lodged a complaint with the Expert Committee alleging that a mobile banking application service provider did not allow him to give his consent freely in the application. The complainant requested that the service provider amend its consent request format and that he be allowed to withdraw the consent he had previously given to the service provider and its affiliated companies for accessing the application.

By the time the case came before the Expert Committee, the service provider had already amended its consent request format to be compliant with the requirements of the PDPA. Accordingly, the complainant wanted to withdraw his complaint; moreover, the service provider had already proceeded with the requests of the complainant. Considering these facts, the Expert Committee decided to reject the complaint.

October 25 Decision

In this case, the complainant lodged a complaint with the Expert Committee stating that as the former employee of a data controller he was entitled to a transportation card benefit following his employment with the data controller. The data controller sent an email informing the complainant that he could be issued a transportation card via an electronic system, with the condition that he must first provide his personal data in order to access the transportation card issuance system. Subsequently, the complainant received another email from the data controller reporting that his transportation card benefit had been suspended, and that he had accepted this suspension when he gave consent to the processing of personal data as required by the data controller. This was contrary to the complainant’s understanding that the consent was for the issuance of a transportation card only, rather than for the suspension of his rights.

The Expert Committee ordered that:

  1. The data controller must amend its consent request form to be consistent with the purposes notified to the data subjects;
  2. The consent must be freely given by the data subject;
  3. The consent must not be conditional; and
  4. The data controller must not rely on such consent to suspend other rights of the complainant.

Also, the data controller must notify the Office of the PDPC of the outcome of remedial actions pursuant to the above order or take any action to suppress damage within 30 days from the date of receiving the order.

November 15 Decision

The complainant in this case lodged a complaint with the Expert Committee stating that his name and an image of his medical license were acquired by another person who pretended to be a licensed healthcare professional, which resulted in service recipients and the public being misled and the complainant suffering damage to his reputation. The Expert Committee, however, stated that the facts of the case and the information provided by the complaint did not verify that the accused is a data controller who violated or failed to comply with the PDPA, and therefore, the Expert Committee was unable to make a determination on the complaint. Considering these facts, the Expert Committee decided to reject the complaint.

Takeaways

These cases indicate an end to the relaxation of Thailand’s enforcement of its PDPA. As data subjects gain more awareness of their rights over their personal data, more complaints are likely to be lodged with the Expert Committee if data subjects suspect that their personal data is not handled or processed properly by data controllers or data processors. Since the PDPA has been fully effective for over a year, the Expert Committee may be prepared to start taking more serious actions in imposing administrative fines and penalties. Organizations should thus take extra care in ensuring that they stay in compliance with the PDPA.

Tilleke & Gibbins will continue to monitor the development of the PDPA and provide updates as they emerge. If you have questions about the PDPA or any other aspect of data compliance in Thailand, please contact any member of the Tilleke & Gibbins PDPA team, including Nopparat Lalitkomon at [email protected], Gvavalin Mahakunkitchareon at [email protected], Thammapas Chanpanich at [email protected], Wilin Somya at [email protected], and Punyavee Koaysomboon at [email protected].

Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

March 20, 2026
Thailand’s Board of Investment (BOI) now requires data center projects to demonstrate measurable benefits for local workforce development, R&D, SME capability, and domestic supply chains to qualify for corporate income tax (CIT) exemptions. BOI Notification No. Por. 3/2569, issued on February 6, 2026, updates the requirements for projects seeking promotion under BOI category 8.2.1 (data centers). All data center projects must now submit and implement plans covering development of Thai human resources and domestic supply chain support before benefiting from any CIT exemption. Human Resources Development Plan The BOI seeks to promote local talent development beyond basic training. Plans must include the following elements: Training for data center design, construction, and operations targeting vocational students, engineering and ICT undergraduates and postgraduates, and energy and building personnel in Thailand. Joint curricula with Thai universities and technical institutes. Collaborative R&D with Thai nationals or institutions in areas including AI, resource allocation, high-performance computing, and data center hardware and systems. Thai SME upskilling in electrical and energy systems and IT services. Domestic Supply Chain Support Plan Plans must demonstrate knowledge transfer in design, construction, cooling, security, and power and water management. Projects must also include usage or installation of domestically manufactured equipment or engage specialist domestic entities. Criteria for BOI Evaluation The BOI will assess data center operators’ eligibility for CIT incentives based on two criteria: Scale requirement: Training and joint-curriculum initiatives must reach a total participants equal to at least 10 times the project headcount and run for the duration of the CIT incentive. If this threshold is not met, the applicant must also implement continuous R&D or SME skills-development plans throughout the incentive period. Substantiality test: Supply-chain plans must be substantive, meet industry standards, and show measurable development of the domestic digital and data center supply base. To ensure compliance,
Read More
March 19, 2026
Thailand’s Electronic Transactions Development Agency (ETDA), which describes itself as a “co-creation regulator” working collaboratively with industry rather than imposing top-down rules, has unveiled its regulatory roadmap for digital platform businesses under the Royal Decree on Digital Platform Service Businesses B.E. 2565 (2022). The 2026 regulatory approach is guided by three core principles—“practicable, verifiable, shared responsibility”—aimed at elevating digital services to be safe, transparent, and fair. These principles inform ETDA’s 2026 priorities, which focus on three key dimensions: product and service standards on platforms, fair competition and fee transparency, and online fraud prevention. Product and Service Standards ETDA’s 2026 agenda addresses product and service standards across several platform categories: Online marketplace platforms. The Notification on Additional Measures for Online Marketplace Platforms under Section 18(2) came into force on December 31, 2025, designating 21 marketplace platforms that must verify products and merchants. Among other obligations, covered platforms must remove or suspend substandard products under the “notice and take down” principle. The ETDA has collaborated with the Food and Drug Administration and the Thai Industrial Standards Institute to develop inspection manuals and coordinate compliance procedures. Social commerce. The ETDA is preparing a new notification under Section 18(2) specifically targeting social commerce platforms with sales support functions, aiming to align regulation with evolving digital market conditions. Ride sharing. Since the postponement of the deadline to comply with the ETDA’s notification on ride-sharing platforms to March 31, 2026, the ETDA has supported drivers in registering with the Department of Land Transport through the Driver Verify registration system, which has already issued certifications to approximately 27,900 riders. The ETDA is also examining structural issues relating to appropriate insurance packages, motorcycle engine capacity expansion, and fair leasing fees and contract transfer costs in coordination with the Department of Land Transport, the Office of Insurance Commission,
Read More
March 19, 2026
Thailand’s Personal Data Protection Committee (PDPC) has launched a public consultation period to gather input for a forthcoming set of guidelines under the country’s Personal Data Protection Act (PDPA). This initiative follows the PDPC’s issuance of guidelines on consent and notification requirements in September 2022. The main consultation period, using an online questionnaire to gather feedback, runs until March 23, 2026. In addition, an interview-style online session for private-sector participants was held on March 17, and a two-day in-person event will be held on April 1–2—this is already fully booked and  walk-ins will not be accepted, but the session will be livestreamed on the PDPC’s Facebook page. The PDPC will use the public feedback to design draft guidelines that accurately reflect the operational realities of both public and private organizations, after which the guidelines will be shared with the public. Consultation Scope The PDPC has identified six priority areas for which upcoming guidance may be issued: Legal bases for processing: The online questionnaire assesses respondents’ understanding of consent requirements and seeks views on priority issues, such as explanations of the legal bases and considerations for selecting an appropriate legal basis depending on the nature of the processing activity. Security measures and data breach notification: The questionnaire examines respondents’ understanding of data breach reporting and security measure obligations. Topics proposed for inclusion in the guidelines include data breach prevention measures, incident response plans, risk assessment methods, and reporting procedures. Data protection officers: Respondents are invited to share their expectations regarding the DPO’s role and their experiences in contacting a DPO. The survey also asks respondents to identify priority issues, such as response timeframes for data subject requests and complaint procedures. Marketing and direct marketing: The online questionnaire seeks input on preferred topics for guidance, including individuals’ rights to refuse marketing
Read More
March 16, 2026
Thailand’s Securities and Exchange Commission (SEC) has broadened the definition of institutional investors, expanded the types of qualifying investments, and updated financial qualification thresholds for various investor categories through a revised notification on the definitions of institutional investors, ultra-high net worth investors, and high net worth investors. The amended framework, which came into force on March 1, 2026, adds digital asset business operators, investment planners, and investment consultants to the roster of entities recognized as institutional investors, and broadens the definition of investment to account for digital tokens. Expanded Definition of Institutional Investors Under the SEC’s revised notification, the category of institutional investors now expressly includes digital asset business operators licensed under the Royal Decree on Digital Asset Businesses B.E. 2561 (2018). This addition recognizes the growing role of digital asset platforms and service providers in Thailand’s investment ecosystem and aligns the regulatory treatment of digital markets with that of traditional markets. The definition of institutional investors now also encompasses investment planners and investment consultants approved by the SEC. Previously, only SEC-approved investment analysts held this status; the expansion covers a broader scope of professionals who possess comparable expertise and experience in evaluating investment opportunities. Broadened Investment Definition The revised framework now defines investment to mean direct or indirect investment in a wider range of assets beyond deposits. Specifically, the definition covers: Securities under the Securities and Exchange Act Derivatives under the Derivatives Act Investment tokens offered to the public Government-issued digital tokens (G-tokens) as specified in a separate SEC notification This expansion ensures that financial status assessments reflect the full spectrum of an investor’s holdings, including emerging digital assets. Updated Financial Qualification Thresholds The amended SEC notification also provides updated qualification thresholds for angel investors, ultra-high net worth investors, and high net worth investors. While the core criteria
Read More