PDPA guides for website owners: consent, notices and audits
Our PDPA guides for website owners in Thailand, in reading order: what the law asks of a site, consent, privacy notices, audits and penalties.
What does the PDPA mean for website owners?
Thailand's Personal Data Protection Act B.E. 2562 (2019) governs how businesses collect, use and share personal data, and it has been fully enforced since 1 June 2022 under the Personal Data Protection Committee (PDPC).
A website touches personal data in more places than most owners expect: the enquiry form, the booking flow, the newsletter box, the WhatsApp or LINE chat button, and every analytics or advertising cookie. Each of those needs a lawful basis, a clear notice explaining what happens to the data, and, where consent is the basis, a real choice for the visitor.
The guides in this section translate that into website terms. They explain what a cookie banner must do, what a privacy notice has to say, how to check your own site and what is at stake if you ignore it. They are written for owners and managers, not lawyers.
Not legal advice
These guides are general information from a web development company. They are not legal advice, and they cannot account for your particular business. Clinics, hotels and anyone handling health, financial or children's data should have a Thai lawyer review their notices and processes.
Our own notices as examples
You can see how we apply this on our own site. Our privacy policy sets out how enquiry details are used and kept, and the cookie notice on this website lists which cookies we use and how consent works for any that are optional. On the build side, our PDPA-compliant websites page explains what we set up for clients: cookie consent, a privacy notice page and consented forms.
Guides in reading order
Every PDPA guide we have published is listed below. If you are new to the topic, this order builds up from the basics to the details.
- Start with the overview. The complete PDPA guide for website owners covers who the law applies to, lawful bases, data subject rights and what a site needs in place.
- Consent. Cookie banners and consent forms done right explains equal Accept and Reject choices, blocking scripts until consent, and tick boxes on forms. Then choosing a consent management platform helps if you would rather use a ready-made tool.
- Notices. What a PDPA privacy notice must say, and whether your site also needs terms and conditions, which are a different document.
- Check your site. The PDPA self-audit checklist gives you checks you can run today with a browser.
- Know the stakes. PDPA penalties and fines sets out the civil, criminal and administrative sides, and how the PDPA compares with GDPR is useful if your business also serves European guests or clients.
Sectors with sensitive data
Health information counts as sensitive data under the PDPA, so clinics, dental practices and aesthetic clinics carry a heavier duty than most. Our page on clinic and med spa website design explains how we handle consultation forms and consent for that sector.
If you want a new site, or an existing one rebuilt, with consent and notices set up from the start, ask for a website development quote and mention PDPA in your brief.
PDPA and compliancePDPA Thailand explained for people who run a website
A plain English guide to PDPA Thailand for website owners: what the law covers, when you need consent, cookie banners, privacy notices, forms, rights requests, breaches and a working checklist.
PDPA and compliancePDPA consent on your website: cookie banners and consent forms that hold up
A practical guide to PDPA consent for Thai websites: when consent is the right lawful basis, what valid consent looks like under Section 19, cookie banner rules with Thai and English wording, consent checkboxes on forms, minors, records and withdrawal.
PDPA and complianceChoosing a PDPA platform for consent management on your website
A buyer's guide to PDPA consent management platforms for Bangkok websites: eight selection criteria, SaaS versus WordPress plugin versus custom banner, vendors that state PDPA support, and setup pitfalls.
PDPA and complianceHow to write a PDPA privacy policy for your website, section by section
A practical guide for Bangkok business owners: the elements Section 23 of the PDPA asks a privacy notice to cover, a section-by-section outline, plain Thai and English wording, placement and updates.
ComparisonPDPA and GDPR compared for websites that serve Thai and EU visitors
PDPA vs GDPR for website owners: scope, lawful bases, consent and cookies, rights, breach reporting, DPOs, transfers and fines, compared point by point, plus how one site can satisfy both.
PDPA and complianceA PDPA audit checklist for your website, from cookies to breach response
A hands-on PDPA self-audit for Bangkok business websites: map data collection, test what fires before consent, check forms, processors, storage and security, and prepare for breaches and data requests.
PDPA and complianceAre terms and conditions required for a website? The honest answer for Thai businesses
Do Thai business websites legally need terms and conditions? The honest answer, which sites need them in practice, how they differ from a PDPA privacy notice, and the clauses most sites include.
PDPA and compliancePDPA penalties for website owners: fines, liability and real enforcement cases
A source-checked guide to PDPA penalties in Thailand: the three kinds of liability, the fine ceilings in the Act, real enforcement cases and the website gaps behind them.
Common questions
Does the PDPA apply to my website?
If your website collects any personal data from people in Thailand, almost certainly yes. A contact form that asks for a name and phone number, a booking request, a newsletter sign-up or analytics cookies are all enough. The Act can also reach businesses based outside Thailand that offer goods or services to people here. Our overview guide explains the scope in more detail.
Where should I start reading?
Start with the complete PDPA guide for website owners, which gives you the whole picture in one place. Then read the cookie consent guide and the privacy notice guide, because those are the two things visitors actually see. Finish with the self-audit checklist and run it against your own site. The penalties guide and the GDPR comparison are useful background once the basics are in place.
Are these guides legal advice?
No. They are general guidance written by a web development company, based on the text of the Act and material published by the PDPC. They explain how the law usually shows up on a website, but they cannot assess your specific business, contracts or data flows. For that, and especially if you process health or financial data, speak to a lawyer qualified in Thailand.
What does a PDPA-ready website need?
On the technical side, it needs cookie consent, a privacy notice page and forms that ask for consent before personal data is sent, set up on a new site or as part of a redesign. Our Starter package includes PDPA cookie consent; on larger builds it is set in your written quote. The wording of your privacy notice should reflect how your business really uses data, so we recommend having a lawyer review it.
Tell us about your website
Send a few lines on WhatsApp or through the quote form. You get a written quote with the scope, timeline and price for your project.
Or WhatsApp or call +66 93 004 4098, every day, 10:00 to 19:00 ICT. service@