Skip to main content
SUWANVARA LAWFIRM
Suwanvara Law Firm Co., Ltd.
SUWANVARA LAWFIRM
SUWANVARA LAWFIRM
Suwanvara Law Firm Co., Ltd.
Business Law

PDPA update for Thai businesses, 2026

Key changes to Thailand's Personal Data Protection Act that every business operator should be aware of.

by Legal Advisory TeamApril 15, 20261 min read
PDPA update for Thai businesses, 2026

Overview

Thailand's PDPA is now in full effect, and PDPC guidance continues to evolve. Operators of every size should review their data practices against the latest standards.

Critical readiness items

  1. DPO appointment — for organizations with substantial data processing
  2. Records of Processing Activities (RoPA) — must be maintained and reviewed
  3. Data Processing Agreements — with vendors who access personal data
  4. Cross-border transfers — require an appropriate mechanism (e.g., SCCs)

Penalties

Administrative fines can reach THB 5 million depending on the nature of the violation and resulting harm.

📌 See more: business legal advisory & compliance

To audit and prepare your PDPA documentation end-to-end, talk to our team and get ready for the latest standards.

Frequently asked questions

Does PDPA apply to small businesses too?+

Thailand's personal data protection law is in full force, and the regulator's guidance continues to be updated. Businesses of every size should review their own systems against the current standard, not only large companies.

Does my company need a DPO?+

Companies processing personal data on a large scale must appoint a Data Protection Officer. Whether your business meets that threshold depends on the nature and volume of the processing you actually carry out.

What is a RoPA and how often must it be updated?+

A RoPA is the record of processing activities. It must be prepared and reviewed regularly rather than done once, because a business's processing activities change as its services and systems change.

We use outside vendors who access customer data. What else is needed?+

You need a Data Processing Agreement with any external provider that accesses the data, and if data moves across borders you need an appropriate mechanism for that transfer, such as standard contractual clauses.

What are the penalties for a PDPA breach?+

Fines can reach up to 5 million baht, depending on the nature of the breach and the harm caused. The actual figure therefore varies with the facts of each case.

Share articleFacebookLINEX
Back to news

Read more

September 13, 2026

Can I Make a Will Leaving All My Assets to Only One Child? Can the Other Children Sue?

You want to leave the whole house and land to the child who looks after you. Thai law allows this, but there are conditions people often overlook — until the will is challenged. This covers marital property, witnesses, and the testator's capacity.

September 13, 2026

Your House Is on Your Thai Wife's Land: Protecting Your Home With a Usufruct and a Will

Foreigners cannot own Thai land, so the family home is usually in the Thai spouse's name. What happens to your right to live there if she dies first, and how a registered usufruct, superficies or habitation right combined with wills protects you.

September 13, 2026

Transferring Employees to an Affiliate Company: Is Consent Required? Does Their Length of Service Continue?

Companies in the same group are still separate employers, so transferring an employee is not merely an internal instruction. This summarizes consent, the counting of length of service and severance pay, the rights that must transfer with the employee, and the documents that should be prepared, from both the employer's and the employee's perspectives.