Thailand Personal Data Protection Act

Section 37(5) requires a Data Controller falling under the second paragraph of s.5 to designate in writing a representative of the Data Controller who must be in Thailand and who is authorised to act on the controller’s behalf, without any limitation of liability, in respect of the controller’s purposes for collecting, using or disclosing personal data. Breach falls squarely within the THB 3 million fine under s.83. Section 38 paragraph one, however, carves out two categories that must be applied first: a controller that is a public authority as prescribed and announced by the Committee; and a controller engaged in the profession or business of collecting, using or disclosing personal data whose processing is not of the nature described in s.26 (sensitive personal data) and which does not hold a large amount of personal data as prescribed by the Committee under s.41(2). A smaller overseas controller that handles no sensitive data may therefore not need a representative — but the volume threshold must be taken from the Committee’s notification and the assessment documented; the exemption must not be assumed. Section 38 paragraph two applies s.37(5) and paragraph one mutatis mutandis to a Data Processor of a controller caught by s.5 paragraph two.

Applies when

Controllers outside Thailand that offer goods or services to Thai data subjects or monitor their behaviour in Thailand and are not exempt under s.38 paragraph one; their Data Processors are subject to the same requirement via s.38 paragraph two.

Evidence to retain

• · Assessment record on whether the s.38 paragraph one exemption applies, covering both the sensitive-data nature test and the volume threshold
• · Written instrument designating and authorising the representative, in Thai and English
• · Published Thai address and contact details of the representative
• · Register of data-subject requests and regulator correspondence handled by the representative
• · Agreed liability and cooperation arrangements between representative and controller

Estimated first-time effort: 4–10 person-days (estimate, not a commitment)

Section 37(4): the Data Controller must notify the Office of any personal data breach without delay and, where feasible, within 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of persons. Where the breach is likely to result in a high risk to those rights and freedoms, the controller must also notify the data subject of the breach and the remedial measures without delay. The rules and procedures for notification and the exemption are set by the Committee.

Applies when

All controllers within the Thai PDPA; Chinese vendors acting as processors should contractually commit to immediate notification to the controller.

Deadline: Without delay and, where feasible, within 72 hours of becoming aware; where high risk, also notify data subjects without delay

Evidence to retain

• · Incident response plan defining when the 72-hour clock starts
• · Record of the time of awareness and the acknowledgement of the notification filed
• · Risk assessment record distinguishing “unlikely to result in a risk” from “high risk”
• · Notice text to data subjects with the remedial measures described

Estimated first-time effort: 5–12 person-days (estimate, not a commitment)

Section 37(1) requires the Data Controller to provide appropriate security measures preventing unauthorised or unlawful loss, access, use, alteration, correction or disclosure of personal data, to review them when necessary or when technology changes, and to meet the minimum standard specified and announced by the Committee. Section 37(2) requires the controller, where personal data is provided to other persons or legal persons, to take action preventing them from using or disclosing it unlawfully or without authorisation. Section 37(3) requires an examination system for erasure or destruction when the retention period ends, the data becomes irrelevant or exceeds the necessary purpose, or the data subject requests erasure or withdraws consent.

Applies when

All controllers within the Thai PDPA and their downstream recipients.

Evidence to retain

• · Inventory of security measures mapped to the Committee’s minimum standard
• · Security-measure review records, including reviews triggered by technology change
• · Use and disclosure restriction clauses in downstream recipient contracts
• · Operating logs of the erasure and destruction examination system

Estimated first-time effort: 10–25 person-days (estimate, not a commitment)

Section 39 requires the Data Controller to maintain at least the following records, in written or electronic form, so that the data subject and the Office can check them: the personal data collected; the purpose of collection for each category; details of the Data Controller; the retention period; the rights and methods of access, including the conditions on who may access and how; use or disclosure under s.27 paragraph three; rejections of requests or objections under ss.30 para 3, 31 para 3, 32 para 3 and 36 para 1; and an explanation of the appropriate security measures under s.37(1). Paragraph two applies the duty mutatis mutandis to the representative of a controller under s.5 paragraph two, and paragraph three allows items (1) to (6) and (8) to be disapplied for a controller that is a small organisation under rules prescribed by the Committee — an exemption that depends on those rules and whose applicability must be documented.

Applies when

All controllers within the Thai PDPA; records must be retrievable on demand during a regulatory check.

Evidence to retain

• · Record of processing activities covering every s.39 item
• · Section explaining the security measures
• · Records of rejected requests and objections
• · Record update and version-control mechanism

Estimated first-time effort: 6–15 person-days (estimate, not a commitment)

Section 41: a Data Controller and a Data Processor must designate a Data Protection Officer where: the controller or processor is a public authority as prescribed and announced by the Committee; the activities of collecting, using or disclosing personal data require regular monitoring of the personal data or the system because of the large number of personal data as prescribed and announced by the Committee; or the core activity is the collection, use or disclosure of personal data under s.26, that is, sensitive personal data. Controllers or processors in the same affiliated business or group of undertakings operating jointly as prescribed under s.29 paragraph two may jointly designate one DPO.

Applies when

Chinese AI companies processing user data at scale in Thailand, or whose core activity involves s.26 sensitive data such as facial, health or biometric data. Processors owe the same duty, and breach attracts a fine of up to THB 1 million under s.85.

Evidence to retain

• · DPO designation document and published contact details
• · Assessment record of which trigger applies: volume threshold, core activity or public authority
• · Where jointly designated in a group, arrangements ensuring each establishment can reach the DPO
• · Description of the resources and independence afforded to the DPO

Estimated first-time effort: 4–10 person-days (estimate, not a commitment)

Section 28: where a Data Controller sends or transfers personal data to a foreign country, the destination country or international organisation must have an adequate data protection standard and the transfer must follow the rules prescribed by the Committee under s.16(5). Exceptions include compliance with the law; consent obtained after the data subject has been informed of the inadequate standard of the destination; necessity for performance of a contract to which the data subject is a party or for pre-contractual steps at their request; performance of a contract between the controller and another person or legal person for the data subject’s benefit; and prevention or suppression of danger. Section 29 adds an intra-group route: where a controller or processor in Thailand has a personal data protection policy for sending or transferring personal data to a controller or processor abroad in the same affiliated business or group of undertakings, for the purpose of jointly operating that business, and the Office has reviewed and certified that policy, transfers made in accordance with it are exempt from s.28.

Applies when

Chinese AI companies moving Thai user data to China or a third country. Intra-group transfers can use the s.29 route of a policy reviewed and certified by the Office; otherwise reliance falls on properly informed data-subject consent or contractual necessity.

Evidence to retain

• · Cross-border transfer register: recipient, country, purpose, data categories
• · Adequacy assessment of the destination or an assessment of the exception relied on
• · Where consent is relied on: the notice informing the data subject that the destination standard is inadequate, plus consent records
• · The s.29 group personal data protection policy and the Office’s review and certification
• · Transfer contract clauses with the recipient

Estimated first-time effort: 10–25 person-days (estimate, not a commitment)

Collection, use or disclosure of personal data must rest on a lawful basis, and sensitive personal data under s.26 — such as racial or ethnic origin, political opinions, religious beliefs, sexual behaviour, criminal records, health data, disability, trade union information and biometric data — in principle requires the data subject’s explicit consent, with only limited statutory grounds permitting processing without it. Section 84 singles out breaches of s.26 paragraph one or three for the highest fine tier in the Act, up to THB 5 million.

Applies when

Chinese AI companies processing facial, voice, health or other s.26 data in Thailand, including facial recognition, health management, insurtech and embodied-AI vision products.

Evidence to retain

• · Mapping of processing activities to lawful bases
• · Explicit consent UI and consent records in Thai for sensitive data
• · Assessment of any statutory ground relied on to process without consent
• · Rules for identifying and tiering sensitive data

Estimated first-time effort: 8–20 person-days (estimate, not a commitment)