Data protection officers (DPOs) have become a fixture of Thailand’s privacy compliance landscape since the Personal Data Protection Act B.E. 2562 (2019) (PDPA) took full effect and the Office of the Personal Data Protection Committee (PDPC) began requiring certain organizations to appoint them.

On July 7, 2026, the Office of the PDPC presented draft guidance on DPOs as part of a public consultation on a series of draft personal data protection manuals and recommendations. The draft offers the clearest indication yet of how the regulator expects the DPO role to work in practice, addressing recurring implementation issues under the PDPA—including when an organization must appoint a DPO, how the DPO should operate independently, how to manage conflicts of interest, and how data subjects and regulators should be able to contact the DPO. Because it remains in draft, organizations have an opportunity to weigh the practical implications now before the guidance is finalized.

When a DPO Must Be Appointed

The draft guidance clarifies the triggers for mandatory DPO appointment, including:

• Regular and systematic monitoring of personal data or systems on a large scale, such as tracking, analyzing, or predicting behavior, attitudes, or individual characteristics.
• Core activities involving large-scale processing of sensitive personal data, such as health data, biometric data, or criminal records.
• Certain foreign-organization representative arrangements.
• Public-sector coverage under relevant notifications identifying government entities that must appoint a DPO.

Processing involving 100,000 or more data subjects may be considered large-scale.

The guidance also contemplates voluntary DPO appointment for organizations that wish to raise their privacy governance standards, and such organizations should still comply with the standards applicable to DPOs under the law.

Independence and Reporting Lines

The draft guidance identifies lack of DPO independence as a core risk because an ineffective or constrained DPO may be unable to raise deficiencies to senior management. Organizations are expected to support the DPO with adequate time, budget, personnel, tools, access to information, and the ability to report directly to the highest level of management. The DPO should be protected from punishment for identifying organizational deficiencies or objecting to non-compliant practices. Where management does not follow the DPO’s recommendation, the DPO should document the reasons in writing.

Conflict of Interest

The draft guidance cautions against appointing individuals who determine the purposes and means of processing as DPO, including the chief executive officer, chief operating officer, chief financial officer, head of marketing, or head of human resources. It draws a distinction between general IT support personnel, who may serve as DPO, and senior IT leaders who decide what systems to use or what data to centralize, whose appointment may create a conflict. For organizations with limited personnel, the draft allows some flexibility but recommends assigning monitoring functions to another department to preserve neutrality.

Structuring Options for the DPO Role

The draft guidance recognizes several possible DPO structures:

• In-house DPO. Appropriate for medium or large organizations with complex internal systems; organizations should avoid appointing someone who decides how personal data is used.
• Outsourced DPO. Appropriate where specialist expertise or limited internal resources exist; organizations should define access rights, response responsibilities, and internal coordination arrangements.
• Group DPO. May be appointed for companies within the same corporate group; the DPO must be easily contactable by each company and understand each business’s context.
• Voluntary DPO. Organizations appointing a DPO voluntarily should still comply with the standards applicable to DPOs under the law.

DPO Operational Role and Accountability Framework

The DPO should be involved from the system design or new project planning stage to support privacy by design. The DPO serves as a key accountability mechanism, providing advice, monitoring compliance, coordinating with relevant stakeholders, and maintaining confidentiality, while responsibility for compliance remains with the organization. The organization should support the DPO with adequate resources, independence, access to necessary information, and direct reporting to senior management. Where breach notification is required, the notification should include the DPO’s name, contact location, and contact method, along with information on the breach, potential impacts, and measures taken or to be taken to prevent, stop, correct, or remediate the breach.

Outlook

Organizations should map their processing activities, confirm whether any DPO appointment trigger applies, and review reporting lines, job descriptions, and governance documents to ensure DPO independence, adequate resources, and senior management access. Any current or proposed DPO role should be assessed for conflicts of interest.

Organizations using an outsourced or group DPO should document access rights, scope of work, escalation processes, and data-subject response arrangements. Privacy notices and public contact points should be updated, and the DPO should be integrated into DPIAs, product reviews, ROPA governance, training, and breach response.

The draft guidance shows that DPO governance is increasingly becoming an operational compliance issue in Thailand. Organizations should not treat DPO appointment as a formality but should note the draft guidance’s emphasis on functional independence, contactability, conflict management, and documented escalation when the organization declines to follow the DPO’s advice. Reviewing DPO arrangements against these expectations now—while the guidance is still open for consultation—will leave organizations better positioned once it is finalized.