What are the PDPA penalties for website owners?
PDPA penalties for website owners come in three kinds: administrative fines of up to THB 5 million per breach, civil damages plus punitive damages of up to twice the actual harm, and criminal penalties of up to one year in prison and fines up to THB 1 million for misusing or disclosing sensitive data.
They come from Thailand's Personal Data Protection Act B.E. 2562 (2019), fully enforced since 1 June 2022. Civil liability means paying the actual damage a person suffered, and a court can add punitive damages on top. Criminal liability applies to misusing or disclosing sensitive data. Administrative fines, imposed by the PDPC's expert committees, go up to THB 1 million, 3 million or 5 million per breach depending on which duty was broken.
These are not theoretical. The first administrative fine, THB 7 million, was reported in August 2024 against an online seller of computer products, and several more fines have followed. Most of the cases turned on basics a website touches every day: security, breach notification and having a data protection officer where one is required. This article covers penalties only. For the whole law, start with the PDPA guide for website owners. Nothing here is legal advice; for questions about your own exposure, speak to a Thai lawyer.
Administrative fines
Administrative fines are the penalty most website owners are likely to meet, because they do not need a court case. Part II of the penalty chapter sets the ceilings by which duty was broken. The table summarises the sections that apply to data controllers, which is what almost every business running a website is. Data processors, such as outsourced IT or marketing vendors handling data for you, face parallel ceilings in Sections 85 to 87.
Two points are easy to miss. First, the ceilings apply to each offence, so a single case with several failures can total more than THB 5 million, which is how the first fine reached THB 7 million. Second, under Section 90 the expert committee may order rectification or issue a warning first, and must weigh the severity of the act and the size of the business when deciding a fine.
| Section | Typical failure | Maximum fine |
|---|---|---|
| 82 | No privacy notice at collection (s.23), no DPO where required (s.41), no record of processing (s.39), consent not in the required form | THB 1 million |
| 83 | Processing without a lawful basis, collecting more than needed, deceptive consent, weak security or no breach notification (s.37) | THB 3 million |
| 84 | Unlawful use or transfer of sensitive data such as health, biometric or religious data (s.26) | THB 5 million |
| 89 | Ignoring an expert committee order or failing to give requested facts | THB 500,000 |
Civil and criminal liability
Civil damages
Under Section 77, a data controller or processor whose breach of the Act causes damage must compensate the person affected, whether the breach was intentional or negligent. The only defences are force majeure, the person's own act, or following a lawful government order.
Compensation includes what the person spent to prevent or limit the harm. Section 78 lets a court add punitive damages of up to two times the actual compensation, taking into account how serious the harm was, what the business gained and how it responded. A claim must generally be brought within three years of learning of the damage and the party responsible.
Criminal penalties
Criminal liability is narrower. Section 79 covers unlawful use, disclosure or transfer of sensitive personal data. Where it is likely to harm someone or damage their reputation, the penalty is up to six months in prison, a fine up to THB 500,000, or both. Where it is done for unlawful gain, it rises to one year, THB 1 million, or both. Section 80 punishes people who learn personal data through duties under the Act and disclose it.
Directors and managers
Section 81 is the one owners notice. When a company commits an offence because a director or manager instructed it, or failed to act when it was their duty, that person faces the same criminal penalty personally. Responsibility for data cannot simply be left with the IT vendor.
Enforcement so far
For the first two years after full enforcement, the PDPC mostly issued guidance. That changed on 21 August 2024, when an expert committee fined a large online seller of computer products THB 7 million. According to DLA Piper's summary of the case, the company had not appointed a data protection officer despite holding data on a very large customer base, lacked adequate security so that customer data reached call-centre scam gangs, and was slow to respond to complaints and report the breach. It was also ordered to improve security and train staff.
A later review by Tilleke & Gibbins, published in August 2025, counted eight fines across five cases totalling about THB 21.5 million. As reported there, the cases included:
- a state agency and its system developer, each fined after a cyberattack exposed around 200,000 records;
- a private hospital, fined THB 1.21 million after a contractor mishandled the destruction of medical records;
- a cosmetics company, fined THB 2.5 million over weak security, leaked data and a failure to notify the breach;
- a collectible toy retailer and its data processor, fined THB 500,000 and THB 3 million after the processor's system was compromised and notification was delayed.
The pattern is consistent: weak security, late or missing breach reports and no DPO. None of these cases was about an ugly cookie banner. They were about data that leaked and a business that did not react properly.
Which website mistakes create risk
A website is where most businesses collect personal data first, so it is where many gaps begin. Here is how common problems map to the duties in the Act.
- No privacy notice, or one copied from another company. Section 23 requires you to tell people why you collect their data, how long you keep it and their rights, before or at collection. A missing notice falls under Section 82. Our article on writing a PDPA policy for a website explains what it should contain.
- Consent that is not real consent. Pre-ticked boxes, tracking scripts that fire before anyone chooses, or one checkbox covering enquiries and marketing together. Misleading consent sits under Section 83. Tools that record choices properly are compared in our guide to PDPA consent platforms.
- Weak security. Outdated plugins, shared admin logins, form entries emailed in plain text and stored forever. Section 37 requires appropriate security, and this is the failure behind most fines so far.
- No breach plan. Section 37 also requires notifying the PDPC of a breach, as a rule no later than 72 hours after learning of it where feasible, unless it is unlikely to create a risk to people's rights.
- No DPO where required. Section 41 requires one when core activities involve large-scale regular monitoring or sensitive data, which can include clinics and large online stores. A clinic website handling health details should plan for this from the start.
How the PDPC handles a case
Most cases start in one of two ways: a person files a complaint under Section 73, or a breach comes to light through a notification or the news. Expert committees appointed under the Act then consider the complaint or investigate. Under Section 72 they can look into the conduct of the business, its employees and its contractors, and they can settle disputes.
If the committee finds no grounds, it dismisses the matter. If it finds a breach, it can order the business to fix the problem, issue a warning, or impose an administrative fine. It can also require you to provide documents and facts, and refusing is itself finable under Section 89. Civil claims for damages and criminal complaints run separately through the courts and police, so one incident can lead to more than one kind of liability.
In practice, how you behave once a problem appears matters. The published cases stress slow responses to complaints and late notification, so a business that answers quickly, fixes the cause and documents what it did is in a far better position than one that ignores the first email.
Lowering your risk
You do not need to fear the PDPA, but you do need the basics in place and a record that you did them. The short list below covers the website side. For a full walk-through, work through our PDPA audit checklist. If you also serve European customers, the differences in fines and duties are covered in PDPA vs GDPR, and the legal pages beyond privacy are discussed in are terms and conditions required for a website.
When we build PDPA-compliant websites, the cookie consent, privacy notice and consented forms are part of the build rather than an afterthought. If your current site has gaps, you can request a quote for a rebuild or fix; the scope and price are set in the written quote. The legal questions still belong with your lawyer.
- Publish a real privacy noticeWritten for your business, linked from every form and the footer.
- Block tracking until consentAnalytics and ad pixels load only after a visitor agrees.
- Separate consentsEnquiry handling and marketing emails are never one checkbox.
- Keep software updatedWordPress core, themes and plugins patched, unused ones removed.
- Limit and protect form dataStore only what you need, restrict admin access, delete on schedule.
- Write a breach planWho decides, who informs the PDPC, and how fast.
- Check whether you need a DPOEspecially clinics, hospitals and large online stores.
More on the PDPA and your website
Sources
- Personal Data Protection Act B.E. 2562 (2019), unofficial English translation, Sections 77 to 90, Ministry of Digital Economy and Society
- DLA Piper Privacy Matters: first PDPA enforcement in Thailand (August 2024)
- Tilleke & Gibbins: eight serious fines imposed in Thai data protection cases (August 2025)
- Personal Data Protection Committee (PDPC), official website
Builds and ranks the websites: the systems behind the 17 client sites whose Search Console numbers we publish. This guide was written by the Website Development Bangkok team. More about us