What Is PDPA? A Complete Summary of What Businesses Need to Know, with an Action Checklist
What Is PDPA? An Easy-to-Understand Guide for Thai Businesses and SMEs
In an age when "data" is worth its weight in gold, protecting personal data has become a priority worldwide. Thailand has the PDPA (Personal Data Protection Act), which is now fully in force. This article summarises the key points business owners cannot afford to miss.
What is PDPA?
PDPA is a law designed to protect "personal data" from being misused or disclosed without the data owner's consent. This data covers everything from full names, phone numbers, email addresses, home addresses and photographs to sensitive data such as health records or fingerprints.
The 3 key roles in PDPA
To handle data correctly, you first need to know which role your business plays:
- Data Subject: Our customers or employees.
- Data Controller: Our business (the party that decides what the collected data will be used for).
- Data Processor: Anyone we hire to handle data, such as an advertising platform or a cloud company.
5 things a business must do right away to comply with the law
1. Prepare a Privacy Policy
State clearly on your website or storefront what data you collect, why you collect it, and how long you will keep it.
2. Obtain Consent
Before using customer data (for example, to send promotional news), you must obtain consent that is clear and unambiguous, and you must give customers an easy way to "withdraw consent".
3. Keep a Record of Processing Activities (ROPA)
A business must keep a logbook (or a digital file) recording whose data it uses and for what, so that it can be inspected on request.
4. Put Data Security Measures in Place
You must make sure the data you store does not leak. For example, set passwords, restrict employees' access rights to data, or use a cloud system that meets recognised standards.
5. Appoint a DPO (if necessary)
Large organisations, or those that process large volumes of data, may need a Data Protection Officer to look after this area specifically.
Penalties for non-compliance
PDPA carries fairly severe penalties: civil liability (compensation), criminal penalties (imprisonment or fines) and administrative penalties (fines of up to 5 million baht).
FAQ: Frequently Asked Questions About PDPA in 2026
Q: Do small SMEs or online sellers need to comply with PDPA?
A: Yes. The law applies to every organisation that collects personal data. However, small SMEs are given some relief on keeping a ROPA (record of processing activities) if their data processing does not pose a high risk to the data owners.
Q: Is it illegal to photograph customers in the shop and post the photos on social media?
A: If the photos are taken for general publicity and customers appear only as part of the scene (not singled out as individuals), this usually falls under "legitimate interest". Even so, you should put up a notice that images are being recorded, and if a customer asks you to delete a photo, you should do so immediately to be safe.
Q: How severe are the penalties for violating PDPA?
A: They range from civil liability (paying compensation) to criminal penalties (imprisonment of up to 1 year or a fine of up to 1 million baht) and administrative penalties (a fine of up to 5 million baht). Beyond that, the greatest damage is to your "brand reputation" in your customers' eyes.
Summary
Complying with PDPA is not only about avoiding fines. It shows "professionalism" and builds trust with customers, which is a key foundation of doing business in the digital era.