Do small businesses have to comply with the PDPA?

In principle, every organization that collects, uses, or discloses personal data falls under the PDPA, regardless of size. The scope of work simply scales with the volume and sensitivity of the data, but even a small business should at minimum have a proper privacy notice and a valid consent mechanism in place.

Does every company need to appoint a DPO?

No. A Data Protection Officer is only mandatory where the nature and scale of processing meets certain thresholds, such as large-scale behavioral monitoring or processing sensitive data as a core activity. Even when not legally required, it is wise to assign an internal person responsible for data protection.

What are the penalties for not complying with the PDPA?

Non-compliance can trigger administrative fines, civil liability to affected data subjects, and in some cases criminal penalties. Beyond the sanctions, the damage to reputation and customer trust is often far more costly, which is why getting it right upfront is cheaper than fixing it later.

What should we do about existing customer data we already hold?

Legacy data must be reviewed to confirm there is a valid lawful basis for continued use; in some cases you will need to notify a new purpose or obtain fresh consent. You must also have a process for data subjects to exercise their rights, such as deletion or objection, and our lawyers can help you bring an existing database into compliance.

What do we have to do if there is a data breach?

When a personal data breach occurs, your organization must assess the risk and notify the relevant authority within the timeframe set by law, and in certain cases notify the affected individuals as well. Having an incident response plan prepared in advance significantly reduces both the harm and your liability.

PDPA Compliance Checklist for Thai Businesses (2026 Edition)

Why PDPA matters in 2026

Thailand's Personal Data Protection Act (PDPA), B.E. 2562, became fully enforceable in June 2022, and the Personal Data Protection Committee (PDPC) has since issued more than 30 sub-regulations and 50+ enforcement decisions. As of early 2026, administrative fines have crossed THB 380 million, with the largest single fine being THB 7M against a healthcare provider for inadequate access controls.

The PDPA applies to every entity processing personal data of individuals in Thailand, regardless of where the entity is based. There is no SME exemption. There is no small-volume exemption. If you have a customer list, an HR system, or a website with a contact form, you are in scope.

This checklist captures everything we've learned advising 200+ Thai entities through PDPA implementation.

Disclaimer: General information only. Contact us for an audit fitted to your specific operations.

What this guide covers

Quick PDPA overview
The 10-step compliance checklist
Mandatory vs. optional measures
DPO appointment — when required and how
Records of Processing Activities (RoPA)
Privacy Notice requirements
Data Subject Rights handling
Data Processing Agreements (DPA)
Cross-border transfer rules
Breach notification procedure
Cost estimates by company size
Common audit findings (and fixes)
Penalty structure
The next 6 months — what's coming

1. Quick PDPA overview

PDPA is structurally similar to GDPR but with three Thai-specific differences:

Lawful basis is more permissive — Thailand allows a "legitimate interest" basis without the formal balancing test that GDPR demands.
Sensitive data categories include religion, race, and criminal records, but also explicit categories not in GDPR like genetic and biometric data when processed for unique identification.
Penalties are tiered — administrative (up to 5M THB), criminal (imprisonment up to 1 year), and civil (compensation + punitive damages).

If your organization is GDPR-compliant, you are 80% of the way to PDPA compliance. The remaining 20% is the gap most companies underestimate.

2. The 10-step compliance checklist

The path to PDPA compliance, in priority order:

Step 1: Data inventory (1-2 weeks)

Map every category of personal data you collect, where it's stored, who accesses it, why, and for how long. This is the foundation for every other step. Without this, you cannot satisfy RoPA, privacy notice, or data subject rights.

We recommend a spreadsheet with the following columns:

Data category	Source	Storage	Access	Purpose	Lawful basis	Retention	Cross-border

Step 2: Lawful basis analysis (1 week)

For each processing activity, determine which of the 6 lawful bases applies:

Consent
Contract performance
Legal obligation
Vital interest
Public task
Legitimate interest

Pitfall: many Thai HR systems incorrectly default to "consent" when "contract performance" or "legal obligation" is the correct basis. This matters because consent can be withdrawn — contract performance cannot.

Step 3: Privacy Notice update (1 week)

Required content per PDPC guidelines:

Identity and contact of controller
DPO contact (if appointed)
Categories of data processed
Purposes
Lawful basis
Recipients (including third parties)
Cross-border transfers
Retention period
Data subject rights and how to exercise
Right to lodge complaint with PDPC

Many Thai companies still publish GDPR-style notices that don't meet PDPC's 2024 specificity guidelines.

11. Cost estimates by company size

Company size	Typical PDPA implementation cost	Annual maintenance
Under 10 employees	50-100K THB	30-60K THB
10-50 employees	150-300K THB	80-150K THB
50-200 employees	400-800K THB	200-400K THB
200-500 employees	800K-1.5M THB	400-800K THB
500+ employees	1.5-3M THB+	800K-1.5M THB

Costs above include legal advisory, DPO appointment (outsourced or internal), policy drafting, training, and remediation of major findings. They exclude software/tooling costs.

Closing

PDPA is not a one-time project — it is an operating discipline. The companies that struggle are the ones that treat it as a documentation exercise. The ones that thrive treat it as a governance investment.

Need a PDPA audit? Call us at +66 92 254 2045 or email [email protected].

— Suwanvara Law Firm