You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

June 5, 2020

Thailand’s Personal Data Protection Act: A Guide to the Partial Compliance Extension

Subscribe to Updates

In May 2020, the Thai Cabinet approved a royal decree granting a one-year exemption from certain provisions of the Personal Data Protection Act 2019 (PDPA), which had been scheduled to take full effect on May 27, 2020. The new decree has extended the effective date for a number of the law’s provisions to May 31, 2021.

Key Elements of the Extension

Under the decree, certain critical provisions of the PDPA are not enforceable against exempted businesses (see list below) during the extension period, including the following:

  • General requirements and obligations on data controllers. Specifically, the postponed enforcement covers consent requirements, notification requirements, establishment of lawful basis, requirements on the collection of personal data from other sources, and processing of minors’ personal data. The enforcement of a second list of requirements is also postponed, including observance of data subjects’ rights and data erasure or destruction requirements, the implementation of appropriate internal security measures to prevent unauthorized access (section 37 (1)), provision of data breach notifications, appointment of data protection officers (DPOs), filing complaints, and penalties.
  • The grandfather provision (section 95) is also within the scope of the extension. This means that personal data collected or processed during the extension period will not be subject to the requirements enumerated in the second list above when they come into force in 2021. Furthermore, this data can be retained and used after the extension period has lapsed, provided that doing so is within the original purposes stated for collecting and processing the personal data. It is especially important to note that the scope of the grandfather provision does not include disclosure of personal data or processing of personal data outside of the original purposes stated.

However, as required by section 4, data controllers must still implement a minimum level of security protection measures for personal data in accordance with the standards to be prescribed by the Ministry of Digital Economy and Society, expected later this year.

It should also be noted that the requirement for the regulator to issue supplemental notifications and regulations is not within the scope of the extension. The Personal Data Protection Commission (PDPC) is therefore expected to continue issuing these supplemental measures during the extension period.

Exempted Businesses

The list of exempted businesses, below, covers a wide range of sectors and industries, and applies regardless of location:

  • Agriculture
  • Industrial businesses
  • Commerce
  • Medical and public health businesses
  • Energy, steam, water, waste disposal, and related businesses
  • Construction
  • Repair and maintenance
  • Transportation, logistics, and warehousing
  • Tourism
  • Communication, telecommunications, computers, and digital enterprises
  • Financial, banking, and insurance enterprises
  • Real estate
  • Professional practice
  • Administration and support
  • Science and technology, academia, social welfare, and arts
  • Education
  • Entertainment and recreation
  • Security
  • Household operations and SMEs that cannot be classified
  • Government agencies
  • Foreign government agencies and international organizations
  • Foundations, associations, and religious and nonprofit organizations

What to Do Now

In addition to staying up to date on the issuance and implementation of supplemental notifications and regulations under the PDPA over the coming year, businesses should make use of the additional time to prepare for compliance. A sample framework for doing so is provided below.

Step 1: Identify the personal data currently possessed by the company

Estimated timeframe: 1–3 months

In this stage, it is important to understand the PDPA’s requirements and conduct self-assessments to identify an entity’s current and anticipated personal data processing activities. To identify the main processing activities, companies should answer the five Ws:

  • Who are the relevant data subjects and the responsible personnel?
  • What types of personal data are collected and processed, and what are the sources?
  • When is the personal data collected and updated, and how long is it retained?
  • Where is the physical and digital data stored and transferred to (i.e. within Thailand or overseas)?
  • Why is the personal data being collected or processed?

This should be a reported in an internal assessment to aid widespread understanding of the practice—especially the original purpose for collecting or processing the personal data—within the organization.

Gaps and mitigation measures should also be identified, including:

  • processing activities that require consent as the lawful basis;
  • processing activities that can rely on another lawful basis (e.g. “legitimate interest”);
  • relevant retention periods pertaining to the various types of personal data; and
  • list of data processors, the scope of their data processing activities, and relevant personal data pertaining to the activities.

Step 2: Close the gaps and monitoring for new subordinate regulations

Estimated Timeframe: 2-4 months for closing gaps, monitoring ongoing until May 31, 2021

In this stage, organizations should monitor the issuance and development of new subordinate legislation—including through public hearings—to ensure that they are aware of their compliance obligations. At the same time, it will be necessary to focus also on closing the gaps identified in Step 1 by implementing the necessary mitigation measures and putting measures in place to ensure operational compliance. This may include preparing the following:

Privacy policies for relevant data subjects. Where consent is identified as the lawful basis, consent forms must be prepared for the relevant data subjects (e.g. individual customers, employees, etc.).

  • A data processing agreement (or addendum) template to be arranged, proposed, and countersigned by the relevant data processors.
  • A record of processing activities.
  • A record of internal assessments where legitimate interest is to be relied upon as the lawful basis (noting that these should be carried out in consideration of organizational conflicts of interest).
  • Plans for a DPO or DPO team, depending on the size of the operation and quantity of personal data involved, and in accordance with the DPO qualifications prescribed by the PDPC.
  • A custom internal training program, addressing current gaps and relevant parties in the context of the new legal requirements.
  • Internal rules forbidding collection of personal data without justification or lawful basis, or that is not necessary for business operations. Any personal data of this type that is currently being processed should also be deleted at this time.

When the subordinate laws on data subject rights become publicly available, it will be necessary to examine the requirements and set up a process for managing requests to uphold data subject rights, as well as data controller and processor obligations under the PDPA.

Achieving Compliance on Schedule

By following these steps, organizations can ensure that they will be fully compliant when the extension period ends on May 31, 2021. The estimated timeframes of the various steps listed above can give an idea of how long each step will take, but the actual schedules should be determined based on the level of PDPA readiness within the organization, the scale of implementation, and any future developments of the subordinate legislation under the PDPA. Companies should work closely with local legal counsel to ensure that their compliance measures are on track, and will be effective when the law comes into force.

Tilleke & Gibbins will continue to monitor the development of the PDPA and provide updates as they emerge. If you have questions about the PDPA, or any other aspect of data compliance in Thailand, please do not hesitate to contact any member of the PDPA team, including Athistha (Nop) Chitranukroh at [email protected] or Nopparat Lalitkomon at [email protected].

Download Full Article
Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

December 26, 2025
The Bank of Thailand (BOT) has released the Guidelines for Digital Fraud Management, which took effect on December 17, 2025, incorporating certain amendments to the draft guidelines issued in March 2025. These official guidelines aim for end-to-end digital fraud prevention, with a particular focus on mule accounts, to enhance trust and security in Thailand’s financial system. The guidelines apply to “financial service providers,” including: Financial institutions and special financial institutions under the Financial Institution Business Act; and Operators of Inter-institutional Fund Transfer System e-money services and e-fund transfer services under the Payment Systems Act. Besides commercial banks and e-money operators that offer fund-transfer services, other providers may adopt requirements based on risk proportionality and baseline standards set out in the guidelines (for instance, an e-money operator that does not offer e-fund transfer services could consider implementing a fraud monitoring and detection system according to the risk level of its service). The guidelines establish the following key requirements: Policy and oversight. Directors and senior executives of financial service providers must adopt appropriate “end-to-end” fraud management policies and KPIs to manage digital fraud, covering prevention, monitoring, detection, management, resolution, and support for affected customers. The fraud management policy must be regularly reviewed, and whenever there is a situation or change that significantly affects the efficiency of the fraud management. Any significant update to the policy must first be approved by the board of the financial service provider. The BOT also encourages providers to collaborate in establishing industry standards aligned with applicable laws and regulations to ensure consistency and best practices across the sector. Fraud management processes. Financial service providers must establish a clear framework for managing digital fraud throughout the customer lifecycle—from customer onboarding to service termination—covering at least the following processes: Know your customer (KYC) and customer due diligence (CDD):
Read More
December 15, 2025
Thailand is taking steps to energize its startup scene by drafting the Startup Promotion Law. This draft law aims to remove obstacles, open new funding opportunities, and provide coordinated government support. The goal is to make it easier for Thailand-based startups to grow and compete on a global stage. Why Is This Law Needed? For many years, Thai startups have operated under traditional company law frameworks that were not designed with high-growth businesses or with fundraising opportunities in mind. Restrictions on issuing bonds, offering shares to outside investors, and repurchasing shares for employee incentive programs made it challenging for emerging companies to access capital and accelerate their growth. The draft Startup Promotion Act seeks to remove these obstacles and foster a more competitive, entrepreneur-friendly environment in Thailand. Who’s in Charge? Two main organizations will oversee the startup ecosystem: Startup Promotion Committee: This group, to be appointed by the National Science, Research, and Innovation Policy Council, will set national strategies, policies, and budget; design promotional campaign and incentives; and propose further legislative amendments to promote startups. National Innovation Agency (NIA): Under the draft act, the NIA will be the main contact for startups and will serve as the secretariat office of the Startup Promotion Committee, coordinating data, advising startups, maintaining the public registry, and providing funding and investment (grants, repayable grants, loans, and equity) under committee criteria and, where applicable, cabinet approval. What Startups Are Eligible for Benefits? To be officially recognized and access benefits, a company must: Be a private limited company less than 10 years old at the time of application. Existing companies that already exceed the 10-year threshold may still apply for startup statues within one year of the law’s enactment, as long as they otherwise still qualify for the new regime. Have average annual revenue not
Read More
December 12, 2025
Tilleke & Gibbins has updated the Cambodia, Myanmar, Thailand, and Vietnam chapters in Multilaw’s Global Data Protection Guide, which collects expert advice from Multilaw member firms in 90 jurisdictions around the world (including a Laos chapter, which is also authored by Tilleke & Gibbins). The guide provides answers to key issues concerning the fast-developing data protection and privacy laws around the world, and helps data protection officers and in-house counsel understand how the regulatory regime for data protection can affect their organizations in various jurisdictions. Each section of the guide identifies the main laws that govern data protection in that jurisdiction, and gives a detailed overview of the legal principles in place as well as the enforcement authorities responsible for overseeing compliance. The guide also covers issues related to data subject rights, data protection officers, impact assessments, data breach notification requirements, and cross border data transfers. The use of personal data in marketing is also considered, with specific information on electronic marketing rules, cookies, and marketing to businesses and consumers. Multilaw, of which Tilleke & Gibbins is a longtime member, is a global network of carefully selected independent law firms able to provide expert legal advice in complex environments around the globe. The full guide is available for free on the Multilaw website.
Read More
December 11, 2025
On December 10, 2025, the National Assembly of Vietnam passed a new Cybersecurity Law, which will take effect on July 1, 2026. The new Cybersecurity Law was developed based on the consolidation of the 2018 Cybersecurity Law and the 2015 Law on Network Information Security. While the final approved version of the new Cybersecurity Law has not yet been published, according to official reports, the following notable requirements are confirmed to be included: The new Cybersecurity Law dedicates a specific article to prohibited acts related to cybersecurity, under which it strictly prohibits posting or disseminating information online that propagandizes against the Socialist Republic of Vietnam. The law also prohibits, among other things, (i) the appropriation, trading, seizure, or intentional disclosure of information classified as state secrets, work secrets, business secrets, personal secrets, family secrets, and private life; (ii) intentionally eavesdropping, recording, or filming online conversations without authorization; and (iii) the use of artificial intelligence (AI) or new technologies to conduct prohibited acts. The Ministry of Public Security (MPS) has the authority to require enterprises providing telecommunications, internet, and online services, as well as system administrators, to remove information violating cybersecurity laws from systems under their management. The MPS is also assigned responsibility for ensuring information security in cyberspace and data security, establishing mechanisms for IP address identity management, verifying digital account registration information, and issuing warnings and sharing information on cybersecurity threats. Information systems are classified into five levels (similar to the 2015 Law on Network Information Security) based on the degree of harm to national security and social order if an incident occurs. The MPS is the lead agency assisting the government in state management of cybersecurity. The Ministry of National Defense is responsible for managing military information systems, and the Government Cipher Committee manages cryptographic and cipher
Read More