Thailand’s Personal Data Protection Act applies to any business that collects or uses personal data of people in Thailand, including overseas customers’ contacts held by a Thai company. It requires a legal basis, a privacy notice, handling of data subject requests, breach notification within 72 hours and safeguards for transfers abroad.
The Act, in full force since June 2022, applies to data controllers and processors in Thailand, and also to those outside Thailand who offer goods or services to people in Thailand or monitor their behaviour. A Thai company that handles contact data for customers in other ASEAN countries is a controller regardless of where those customers live.
Personal data means information that identifies a living person, directly or indirectly: names, e-mail addresses, phone numbers, ID numbers, photos, location and online identifiers. Sensitive data, such as health, religion, biometrics and criminal records, carries stricter rules and generally needs explicit consent.
Business-to-business data is still personal data when it relates to an individual, such as a named buyer at a customer. The fact that the data is used for work does not remove it from the Act.
The Act lists the bases on which personal data may be processed, including consent, performance of a contract, compliance with a legal obligation, legitimate interests, vital interests and public tasks. Choose the basis for each purpose and record it; consent is not the only option, and for routine order handling the contract basis is usually more suitable.
People must be told what happens to their data. The privacy notice states what data is collected, why, how long it is kept, who receives it, whether it goes abroad and how to exercise rights. Put it where data is collected, such as the website form, the sales agreement and the employment contract.
Marketing messages usually need consent or another valid basis and an easy way to opt out. A sales team that exports a contact list into a mass mailing without checking the basis creates risk for the company.
Individuals can ask for access to their data, a copy, correction, deletion, restriction or objection to processing. The controller must respond within the period the Act sets, normally 30 days, so the company needs a defined route for requests and someone responsible for answering them.
If a breach is likely to risk people’s rights, the controller must notify the Personal Data Protection Committee’s office within 72 hours of becoming aware, and notify the individuals when the risk is high. A lost laptop, a mistaken email to the wrong list or a compromised account all qualify for assessment.
Maintain a breach log and a short internal procedure, so the first call is not made in a panic. Penalties under the Act include administrative fines, civil compensation and, for some offences, criminal liability, so documentation of good-faith compliance has real value.
Sending personal data out of Thailand is allowed if the destination country has adequate protection standards, or if another recognised safeguard applies, such as binding corporate rules, standard clauses or an exception under the Act. Using an overseas cloud service is a transfer, so check where your providers store data.
Where a provider processes data for you, sign a data processing agreement that fixes the purposes, security measures and sub-processors. You remain responsible for the data, so choose providers that can describe their security and location clearly.
Large-scale or sensitive processing may require a Data Protection Officer, and a foreign controller offering services in Thailand may need a local representative. Ask a Thai lawyer whether either applies to you.
Start with a map: which systems hold personal data, who can access them, where they are located and how long the data is kept. Then write the notice, set retention periods, restrict access and train the staff who handle requests. A short, accurate record of processing is better than a long template nobody follows.
4softcrm keeps customer contacts in one place so that you know where they are, and 4hosting offers hosting in EU data centres if you choose it. The products do not certify PDPA compliance, produce notices or records for you, or notify the authority. Legal advice remains necessary.
In the first month, list the personal data you hold and the systems that hold it: customer contacts, employee files, website forms, CCTV and supplier details. Name an owner for each and note whether any of it is sensitive or leaves Thailand.
In the second and third months, write the privacy notices, fix the legal basis for each purpose, set retention periods and sign agreements with service providers that process data for you. Update employment contracts and the staff handbook to cover employee data.
In the following months, train the people who answer customers and handle requests, test a mock data subject request from receipt to reply, and run a drill for a breach notification. Check that access rights match job roles and remove stale accounts.
Then review annually. Systems change, new tools are adopted and regulators publish guidance. A calendar entry and a named owner are cheap, and they are the evidence that the company treated the Act seriously if a complaint ever arrives.
Keep the documents simple enough to maintain. A two-page register of processing activities that is accurate beats a forty-page policy that is out of date, and officers reviewing a complaint generally want to see that the company knows what it holds, why it holds it and who can reach it. Update the register whenever a new tool or process begins to collect personal data, rather than once a year.
Customer data sits in several files, so deletion or correction requests are answered slowly.
Keep customer contact data in a CRM (4softcrm) so you know where it is. PDPA compliance is your responsibility and you should take legal advice; the products do not certify compliance.
Nobody knows which employees can access personal data.
Decide who may access personal data under your own internal policy and review access when staff leave. The system does not guarantee that role-based permissions are sufficient for the PDPA.
A former employee’s account still has access to the customer list.
Remove access on the leaving date and review the list of users each quarter. The system supports user roles, but it does not decide who should have access under the PDPA.
Yes, when the information relates to an identifiable person, such as a named buyer or manager. The Act does not exempt data simply because it is used in a business context. Choose a legal basis for holding it, inform the person through a privacy notice and keep it only as long as needed.
No. Consent is one of several legal bases. Handling an order or contract can rely on performance of the contract, tax records on a legal obligation, and some marketing on legitimate interests, depending on the facts. Marketing messages usually need consent or another clear basis plus an opt-out, so check each purpose.
If a breach is likely to risk people’s rights and freedoms, notify the Personal Data Protection Committee’s office within 72 hours of becoming aware, and notify the affected individuals without delay when the risk is high. Keep a log of incidents and a simple procedure so the first hours are not wasted.
Yes, but the transfer must have an adequate safeguard, and you should know where the data is stored and who can access it. Sign a data processing agreement with the provider and check its security measures. A lawyer can tell you whether your set-up meets the Act’s transfer rules before you migrate.
A CRM for contacts. PDPA compliance requires legal advice.
