Thailand: compliance overview

1 regulations, 7 mapped obligations and 0 data-transfer routes, organised by when they start to bind you and what you have to do.

Filter the obligations that bind us Contact an advisor

Applicable regulations (1)

In forceData & privacyRelevance High

Thailand Personal Data Protection Act

The second paragraph of s.5 provides that where the controller or processor is outside Thailand, the Act applies to the collection, use or disclosure of personal data of data subjects in Thailand where its activities are: (1) offering goods or services to data subjects in Thailand, irrespective of whether payment is made; or (2) monitoring the data subject’s behaviour where that behaviour takes place in Thailand. For a Chinese AI company, listing an app, running a web service or supplying a model API to Thai users falls under (1); tracking Thai users through telemetry, behavioural analytics, ad attribution or recommendation falls under (2). Once caught by that paragraph, the next step is to test the s.38 paragraph one exemption; where it does not apply, the written designation of a representative in Thailand under s.37(5) is mandatory.

7 obligations · reviewed 2026-09-12

Sources (2)

Personal Data Protection Act, B.E. 2562 (2019), Thailand — official English translationMinistry of Digital Economy and Society (MDES), Thailand · published 2019-05-27 · retrieved 2026-09-12
MDES (Thailand) — laws and regulations indexMinistry of Digital Economy and Society (MDES), Thailand · retrieved 2026-09-12

Content as of 2026-09-12 · corpus 2026.09|Compiled from public official sources with links and review dates for compliance decision support. Rules change; have licensed professionals review before external disclosure, regulatory filing or contractual commitments.