# Standards and Regulatory References — Thailand PDPA

## Primary Legislation

### Personal Data Protection Act B.E. 2562 (2019)
- **Published**: Royal Gazette, 27 May 2019
- **Fully effective**: 1 June 2022 (after two postponements from May 2020)
- **Structure**: 7 chapters, 96 sections
- **Scope**: Collection, use, and disclosure of personal data in Thailand; extraterritorial for activities targeting Thai data subjects (Section 5)

### PDPC Subordinate Legislation (Selected)
- **PDPC Notification on Security Measures (2022)**: Minimum technical and organisational safeguards
- **PDPC Notification on DPO Appointment Criteria (2022)**: Criteria for mandatory DPO appointment
- **PDPC Notification on Cross-Border Transfer (2022)**: Appropriate safeguards for international transfers
- **PDPC Notification on Data Breach Notification (2022)**: Form and content of breach notification
- **PDPC Notification on ROPA Requirements (2022)**: Record of processing activities requirements

## Related Thai Legislation

### Computer Crime Act B.E. 2550 (2007, amended 2017)
- Criminalises unauthorised access to computer systems and data
- Interacts with PDPA for cybersecurity incidents involving personal data

### Electronic Transactions Act B.E. 2544 (2001)
- Governs electronic signatures and electronic records
- Relevant for PDPA electronic consent mechanisms

### Cybersecurity Act B.E. 2562 (2019)
- Establishes the National Cybersecurity Committee
- Critical information infrastructure (CII) protection framework
- Incident reporting obligations complement PDPA breach notification

## International Comparison

| Feature | Thailand PDPA | GDPR |
|---------|--------------|------|
| Supervisory authority | PDPC (single authority) | Multiple DPAs |
| Legitimate interest | Available (Section 24(5)) | Available (Art. 6(1)(f)) |
| Consent withdrawal | Must be as easy as giving consent | Must be as easy as giving consent |
| Breach notification | 72 hours to OPDPC | 72 hours to DPA |
| Administrative fines | Up to THB 5 million (~USD 140K) | Up to EUR 20M or 4% turnover |
| Criminal penalties | Yes — up to 1 year imprisonment | No (GDPR itself; Member State law varies) |
| Punitive damages | Up to 2x actual damages | Not in GDPR (Member State law) |
| DPO requirement | For large-scale/sensitive processing | For public bodies and large-scale/sensitive |
| Children's age | Under 10: parental consent required | Under 16 (lowerable to 13) |
| Data portability | Yes (Section 31) | Yes (Art. 20) |

## Enforcement Precedents

### PDPC Guidance and Compliance Actions (2022-2025)
- Initial enforcement period focused on educational guidance and compliance advisory
- Published sector-specific guidelines for financial services, telecom, healthcare, and e-commerce
- Formal investigation powers activated from 2024 with escalating enforcement
- PDPC published FAQ documents addressing common compliance questions

### OPDPC Compliance Assessments
- The OPDPC conducts compliance assessments of major data controllers
- Findings published as anonymised guidance for industry reference
- Focus areas: consent mechanisms, cross-border transfers, breach notification readiness