Thailand PDPA Compliance 2026: What the First THB 21.5 Million in Fines Means for Foreign Companies, Cross-Border Transfers to Head Office, SCC and the New BCR Rules

Key takeaways

• Thailand's Personal Data Protection Act B.E. 2562 (PDPA) has applied in full since 1 June 2022. The regulator is the Personal Data Protection Committee (PDPC); administrative fines are imposed by its Expert Committee.
• Enforcement has started, and it is not symbolic. The first fine of THB 7 million came in 2024; on 1 August 2025 the PDPC published eight fines in five cases totalling about THB 14.5 million, bringing the cumulative total to about THB 21.5 million, and data processors were fined directly.
• Three gaps appear in every case: inadequate security measures, breaches not reported, and no data protection officer (DPO).
• No country is on the adequacy list, because the PDPC has not issued one. Every transfer of Thai employee or customer data to head office in the United States, Europe or anywhere else needs an exception under section 28 or a safeguard under section 29.
• The four usual routes: data subject consent and contractual necessity (section 28 exceptions); standard contractual clauses (ASEAN Model Clauses or the GDPR SCCs, both recognised) and Binding Corporate Rules (section 29).
• The BCR certification rules B.E. 2568 took effect on 17 February 2026, giving intra-group transfers a formal certification route.
• Penalties: administrative fines up to THB 1 million, 3 million or 5 million by category (5 million for unlawful cross-border transfer of sensitive data); criminal liability of up to one year's imprisonment or a fine of THB 1 million, or both, with responsible directors liable alongside the company.
• The PDPA amendment has not passed. Two drafts went to consultation in November 2025 and July to August 2026; as at September 2026 the current Act still governs.

Most foreign companies formed their view of Thailand's PDPA in 2022: the law took effect, nobody was fined, so it went on the "later" list.

That view stopped being true on 1 August 2025. That day the PDPC published its first batch of administrative fines: eight fines, five cases, about THB 14.5 million, bringing the total since the Act took effect to about THB 21.5 million. Processors were fined as well as controllers. And the breaches named, weak security, unreported leaks, no DPO, describe the current state of most foreign-owned subsidiaries in Thailand.

This guide works backwards from the enforcement cases to the gaps a foreign-owned company is most likely to have, and then deals with the issue that affects a foreign group most directly: the data that moves every day between the Thai subsidiary and head office, and what makes that lawful. Where it helps, it marks the points where the PDPA differs from the GDPR and from US state privacy laws such as the CCPA.

1. The turning point: from zero to THB 21.5 million

2024: the first fine

In August 2024 the PDPC's Expert Committee imposed the first large fine, THB 7 million, on a major online retailer of computers and IT equipment. The company held data on more than 100,000 customers; after a leak, the data was used by phone-scam gangs. Three failures were each fined at the statutory maximum: no DPO (THB 1 million), inadequate security (THB 3 million), and failure to report the breach (THB 3 million).

1 August 2025: the first wave

The PDPC published eight administrative fines in five cases, about THB 14.5 million in total. With the THB 7 million from the year before, the Act had produced six cases, nine fines and about THB 21.5 million.

Three signals matter:

• Processors are fined directly. Processors were fined in three of the five cases; in the toy case the system vendor's fine was six times the company's own. Most people assumed only the controller (the company) was exposed and that outsourced vendors and system providers were not. These cases confirm the processor's independent liability, without relieving the controller of its duty to supervise: the agency and the hospital were both faulted for having no data processing agreement and no oversight of the processor. For a US or European SaaS vendor serving Thai customers, this is the case to read twice.
• The grounds repeat. All five cases involved inadequate security; breach reporting and DPO appointment recur. These three items are the PDPC's current enforcement priorities.
• Remediation changes the number. The retailer that did not compensate victims paid THB 7 million; the cosmetics company that did paid THB 2.5 million. Remedial steps taken after the breach are a factor the Expert Committee weighs in setting the fine.

The enforcement posture

The PDPC's monitoring centre (PDPC Eagle Eye) has scanned websites, social media and the dark web for leaked personal data since November 2023, so enforcement can begin without a complaint. In November 2025 the Expert Committee ordered the Thai operator of an iris-scanning service to stop collecting iris data and delete the data of about 1.2 million users, holding that consent given in exchange for cryptocurrency was not freely given. In February 2026 the PDPC published a draft guideline on personal data protection in AI development and use. The environment in 2026 is different in kind from 2022.

2. Working backwards: the three gaps a foreign-owned subsidiary usually has

Gap one: security measures that exist but are not "appropriate"

Section 37 requires the controller to adopt appropriate security measures meeting the minimum standard announced by the PDPC; the maximum fine is THB 3 million. What is examined in practice is not whether there is a firewall but whether access rights are tiered, whether access is logged, whether leavers' accounts are removed promptly, whether data is encrypted, and whether the measures are reviewed.

The typical foreign-owned subsidiary: a security policy copied from head office in English that the Thai staff have never read; an administrator account shared by several people; a former employee's account still live three months after departure.

Gap two: a breach not reported within 72 hours

Section 37 requires the controller to notify the PDPC Office of a breach without delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to pose a risk to data subjects' rights; where the breach is likely to pose a high risk, the data subjects must also be notified without delay, with the remedial measures. Failure to notify carries a fine of up to THB 3 million. The 72-hour clock will be familiar to anyone who has handled a GDPR breach; the difference is that the PDPC's Eagle Eye may already know.

The typical subsidiary: no incident response procedure; the first instinct is to "handle it internally and see if it goes away"; by the time the decision to notify is taken, 72 hours have passed.

Gap three: a DPO that should have been appointed

Under section 41, a DPO must be appointed in the following cases:

Failure to appoint carries a fine of up to THB 1 million (section 82).

The DPO can be an employee or an external provider, but their contact details must be given to data subjects and notified to the PDPC Office.

The typical subsidiary: unsure whether it crosses the "large-scale" line, so it appoints nobody; or it names the HR manager and never tells the PDPC.

3. Cross-border transfers: what happens every day between the subsidiary and head office

This is the section with the most direct effect on a foreign group.

Why every foreign-owned company is in scope

Almost every foreign group with a Thai subsidiary has at least one of these data flows:

• Thai employees' HR data entered into the group HR system run from head office
• Thai customer data synchronised to the group CRM or ERP
• Thai employees using cloud accounts and email systems administered by head office
• Finance and audit data sent to head office on a regular cycle

Each one hands data to the parent company, a separate legal entity, and is a cross-border transfer under section 28 that needs a lawful basis.

No country is on the adequacy list

The principle in section 28 is that personal data may be transferred only to a country with adequate data protection standards.

But the PDPC has not yet issued any adequacy list. That means not that the United States, or Europe, or Singapore has been excluded, but that no country has been admitted. Every cross-border transfer must rest on something else: one of the exceptions in section 28 itself, or a safeguard under section 29. Readers used to the GDPR should note the contrast: there is no equivalent of an EU adequacy decision to rely on, and the EU-US Data Privacy Framework has no bearing on transfers out of Thailand.

The four usual routes

Section 28 also contains exceptions for legal compliance, protection of life and substantial public interest, which ordinary commercial transfers rarely use.

BCR: the 2026 tool

The PDPC's Regulation on the Examination and Certification of Binding Corporate Rules B.E. 2568 was first published by the PDPC Office on 29 September 2025, and the revised version was published in the Government Gazette and took effect on 17 February 2026.

A BCR is not merely a contract but a governance mechanism at group level: internal policies, audit, training, complaint handling, and consistent implementation across the group's entities. Once certified by the PDPC Office, intra-group cross-border transfers have a continuing lawful basis, without consent for each transfer or an SCC for each case.

The application is made by a group member established in Thailand, in Thai; the Office is to decide within 180 days, and no fee is charged. A certified BCR has no fixed expiry and remains effective until amended, suspended or revoked.

For a group with entities in the United States or Europe, Thailand and elsewhere in Asia, with data flowing continuously between them, a BCR is the most efficient long-term answer. It takes time and resources, so it suits larger groups with frequent transfers. A group that already holds GDPR BCRs has a dedicated review route under the regulation and should assess whether its approval can be extended to Thailand.

A common misunderstanding

"The data sits on a server in Singapore or in the US that the company itself owns, so it is not a cross-border transfer."

That is half right. The PDPC's notification provides that merely routing data through a foreign network, or storing it on a foreign server or cloud that nobody other than the sender and its own staff and contractors can access, is not a transfer. But head office is a separate legal entity. Once head-office staff can access the Thai subsidiary's data, or the group system synchronises it, the exclusion no longer applies and a lawful basis is needed.

4. Extraterritorial reach: head office may be directly subject to the Act

Section 5 provides that the PDPA applies to a controller or processor outside Thailand whose activities involve offering goods or services to data subjects in Thailand, whether or not for payment, or monitoring their behaviour in Thailand. The test will look familiar to anyone who has mapped Article 3 of the GDPR.

What this means for a foreign company:

• A US or other foreign parent that itself operates a website, e-commerce platform or app aimed at Thai consumers is directly subject to the PDPA, not only its Thai subsidiary
• A website with a Thai-language version targeted at the Thai market may amount to "offering services to data subjects in Thailand"
• In that case the foreign controller must in principle appoint a representative in Thailand in writing (section 37); a controller that processes no sensitive data and whose volume is below the PDPC's "large" threshold is exempt (section 38)

A US company that has concluded it is outside the CCPA because it has no California customers can still be inside the PDPA because it has a Thai checkout page. The representative is normally the Thai subsidiary where one exists, which is one reason to set the Thai entity up properly rather than selling into Thailand from abroad.

A brand that sells to Thai consumers online also needs a Thai trademark filing, ideally before the storefront opens, and since 2026 online sellers can ask for a first examination result within four months. See Trademark Registration in Thailand 2026 for US and Foreign Brands: Fast Track 4 Month Plus+, Madrid vs Direct Filing, and the First-to-File Rule .

5. Penalties at a glance

Each breach is fined separately and the fines add up: the THB 7 million in 2024 was three items combined. The Expert Committee may also order rectification or issue a warning first, and weighs the seriousness and the size of the business (section 90).

There is also criminal liability (section 79): unlawfully using, disclosing or transferring sensitive data abroad in a way likely to cause damage, loss of reputation or contempt carries up to six months' imprisonment or a fine of up to THB 500,000, or both; doing so for unlawful gain carries up to one year or THB 1 million, or both. These are compoundable offences, and where the offender is a company, the director or manager responsible is punished as well (section 81). What that means for a foreign director personally is in our guide to director liability in Thailand .

And civil liability (section 78): the data subject may claim damages, and the court may award punitive damages of up to twice the actual loss.

6. Where the PDPA differs from the GDPR and US state laws

For a compliance team that already runs a GDPR or CCPA programme, three differences cause most of the surprises:

• Lawful basis. The PDPA's structure is consent-led: consent is the default basis and the other bases (contract, legal obligation, legitimate interest and so on) are exceptions, the reverse of how most GDPR programmes are built, and far from the CCPA's opt-out model. The current amendment draft would reposition consent as one basis among several, but it is not law.
• Transfers. No adequacy decisions exist, so the "EU-US framework" reflex does not work; every transfer needs its own basis, and the SCC route is the practical one for most groups.
• DPO and representative. The DPO threshold turns on "large-scale regular monitoring" and sensitive data rather than on employee count, and a foreign controller caught by section 5 needs a Thai representative, which has no CCPA equivalent.

7. Developments in 2026

Practical advice: the amendment has not passed, so the current Act governs. Its direction is worth watching, especially the restructuring of lawful bases, but do not rebuild a compliance programme for a bill that may change.

8. Compliance checklist for a foreign-owned company

Ordered by enforcement priority:

Security measures

• The security policy exists in Thai and Thai staff have been trained on it
• Access rights are tiered and administrator accounts are not shared
• Leavers' accounts are removed on the day of departure
• Sensitive data is stored encrypted

Breach response

• A written incident response procedure exists, naming who is responsible for the 72-hour notification and the steps
• Everyone knows whom to tell first when a breach is discovered

DPO

• Whether the section 41 threshold is met has been assessed
• If a DPO is appointed, the contact details have been given to data subjects and notified to the PDPC Office

Cross-border transfers

• Every data flow from Thailand to head office (and to other countries) has been mapped
• Each flow has a lawful basis under section 28 (consent, contractual necessity) or section 29 (SCC, BCR)
• Data processing agreements are in place with head office and with external processors

Data subject rights

• A Thai-language privacy notice states the purposes, legal bases, retention periods and data subject rights
• A procedure exists for access, correction and deletion requests

Processor management

• Data processing agreements are signed with every vendor and system provider that handles data on the company's behalf
• The agreements set out the processor's security and breach notification duties

Any buyer, lender or underwriter examining the Thai subsidiary will run through the same list; data protection is now a standard item in legal due diligence on a Thai subsidiary and in the due diligence before buying a Thai company .

Three years passed between the PDPA taking effect in 2022 and the first wave of enforcement in 2025, and most foreign-owned subsidiaries did nothing in those three years. The risk structure now is that enforcement has begun, the grounds are concentrated in three items, and those three items describe the current state of most subsidiaries. The compliance path is correspondingly clear: security, breach response, a DPO decision and a lawful basis for every transfer cover most of what the PDPC is looking for.

Frequently asked questions (FAQ)

Is Thailand's PDPA actually enforced?

Yes, and visibly faster since 2024. In August 2024 the PDPC imposed its first fine of THB 7 million on a retailer whose leaked customer data was used for phone scams, for three failures: no DPO, inadequate security and an unreported breach. On 1 August 2025 the PDPC published eight administrative fines in five cases, about THB 14.5 million, bringing the cumulative total to about THB 21.5 million; processors were fined directly in three cases. In November 2025 the Expert Committee ordered an iris-scanning operator to stop collecting data and delete the records of about 1.2 million people. The 2026 environment is different in kind from 2022, and "leave it for later" no longer works.

Is sending Thai employees' data to our head office a cross-border transfer?

Yes, and every flow needs a lawful basis. Section 28 permits transfers only to countries with adequate protection, but the PDPC has not issued any adequacy list: no country, including the United States and the EU member states, has been admitted. So the transfer must rest on a section 28 exception, such as consent (contestable in an employment relationship) or contractual necessity, or on a section 29 safeguard: standard contractual clauses meeting the PDPC's notification (the ASEAN Model Clauses or the GDPR SCCs) or Binding Corporate Rules. Data merely stored on a foreign server that outsiders cannot access is not a transfer; but head office is a separate entity, and once its staff can access the Thai data, it is.

What is a BCR, and should our group apply?

Binding Corporate Rules are the certification mechanism for intra-group cross-border transfers. The PDPC's examination and certification rules B.E. 2568 were published in the Government Gazette and took effect on 17 February 2026. A BCR is a governance mechanism rather than a contract: internal policies, audit, training, complaint handling and consistent implementation across the group. Once certified, intra-group transfers have a continuing lawful basis without consent per transfer or an SCC per case. It suits groups with entities in several countries and continuous data flows; a smaller group with occasional transfers will find SCCs more practical. A group with GDPR BCRs has a dedicated review route and should assess whether its approval can be extended.

Does our company need a DPO?

Under section 41, three cases require one: public bodies designated by the PDPC; businesses that must monitor personal data regularly and systematically because of the volume they hold (processing the data of 100,000 or more data subjects is one of the PDPC's indicators); and businesses whose core activity is processing sensitive data. Failure to appoint carries a fine of up to THB 1 million and was named in the enforcement cases. The DPO may be an employee or an external provider, but the contact details must be given to data subjects and notified to the PDPC Office; the common error is to name the HR manager and never notify. Even below the threshold, appointing a DPO is the safer course.

How quickly must a breach be reported, and what if it is not?

The controller must notify the PDPC Office without delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to pose a risk; where there is a high risk to data subjects, they must be notified as well. Failure to notify carries a fine of up to THB 3 million and was a recurring failure in the 2024 fine and the August 2025 cases. The usual problems are no written procedure, an attempt to handle it internally first, and a decision to notify after the deadline. Set the procedure in advance, naming the first contact and the 72-hour division of responsibility. Remediation counts: in the 2025 cases, the company that compensated victims paid THB 2.5 million and the one that did not paid THB 7 million.

We have no company in Thailand. Can the PDPA still apply to us?

It can. Section 5 gives the Act extraterritorial effect: a controller or processor outside Thailand whose activities involve offering goods or services to data subjects in Thailand, or monitoring their behaviour in Thailand, is subject to it. A foreign parent that itself runs a website, e-commerce platform or app aimed at Thai consumers is directly subject; a Thai-language site targeted at the Thai market may amount to offering services. It must then in principle appoint a representative in Thailand, unless it processes no sensitive data and its volume is below the PDPC's threshold. For a brand selling into several markets the rule is simple: a Thai-language site means PDPA compliance.

Has the PDPA been amended? What should we watch in 2026?

Not yet. The amendment draft went to consultation in November 2025 and again from 16 July to 15 August 2026, and had not passed as at September 2026; the current Act governs. Changes in force or under way in 2026: the BCR rules took effect on 17 February; the draft AI guideline was published in February; the PDPC opened consultation on six new guidelines in March; and the two voluntary certification announcements took effect on 18 June. Watch the amendment's restructuring of lawful bases, but do not restructure your programme for a bill that has not passed.

How Louis Group can help

Louis Group has offices in Taipei and Bangkok , with Thai-qualified lawyers working alongside Taiwanese colleagues in English. We help foreign-owned companies with Thai PDPA compliance: data-flow mapping and the lawful basis for cross-border transfers, SCCs and data processing agreements, BCR assessment and certification applications, DPO appointment and notification, breach response procedures, Thai-language privacy notices and staff training, and responding to PDPC investigations. If your Thai subsidiary has not had a data protection review since 2022, have one done before the PDPC's next wave.

Author: Raymond Yu (Po-Chang Yu) , Founder and CEO of Louis Group. Thai law review: Sopon Sirimongkolrat , Founding Partner, Louis & Partners Thailand.

*This article is general legal information, not advice on a specific case. The PDPC's enforcement standards, guidelines and the amendment process are moving; take advice from a Thai-qualified lawyer and rely on the latest announcements of the Personal Data Protection Committee.*

Related reading

• Setting Up a Company in Thailand 2026 for Foreign Investors: The 49% Rule, Nominee Shareholder Risk, Capital and Work Permit Ratios, BOI and the New DBD Checks
• Legal Due Diligence on a Thai Subsidiary 2026: What Buyers, Lenders and IPO Underwriters Check, the Nominee and BOI Deal-Breakers, and the 6-to-9-Month Timeline
• Joint Ventures and Shareholders' Agreements in Thailand 2026: Where Lawful Protection Ends and a Nominee Structure Begins under the New DBD Checks