Do you need one? The short answer
Yes, if your website collects personal data, and nearly every business site does.
A contact form takes a name and phone number. A booking form takes an email and dates. Analytics tags record device identifiers. Under Thailand's Personal Data Protection Act B.E. 2562 (2019), fully enforced since 1 June 2022, the business that decides why that data is collected (the data controller) has to tell people what it does with it, at or before the moment it collects it. On a website, the privacy notice is how you do that.
The notice has to cover a fixed set of points: why you collect data, what you collect, how long you keep it, who receives it, how to reach you, and what rights people have. The rest of this guide walks through each point, gives you an outline, and shows where to link the notice so visitors actually see it. If you want the wider picture first, our guide to PDPA Thailand rules for websites covers consent, security and the regulator.
One honest caveat before we start. We build and configure websites, not legal opinions. Use this guide to prepare a solid draft, then have a Thai lawyer review the final wording, especially if you handle health, financial or children's data.
Notice, policy and cookie policy: which is which
People use three names for documents that overlap, and the confusion leads to sites with either three half-finished pages or one page that tries to do everything.
Privacy notice
The PDPA talks about informing the data subject. The document that does this for visitors, customers and enquirers is the privacy notice. It faces outward and describes what happens to their data. Most Thai businesses label it "Privacy Policy" in the footer, and that is fine: the label matters less than the content.
Internal privacy policy
Larger organisations also keep an internal policy for staff: who may access customer records, how long HR files are kept, what to do after a breach. That document is not published on the website and is not what this article covers.
Cookie policy
A cookie policy lists the cookies and similar trackers your site sets, what each does, and how long it lasts. Some sites keep it as a section inside the privacy notice; others give it its own page linked from the cookie banner. Either works, as long as the two documents agree with each other and with what the banner actually loads.
A simple rule: one public privacy notice for all personal data the website touches, plus a cookie section or page that goes into tracker detail.
What must a PDPA privacy notice cover?
Section 23 of the PDPA lists what the controller must tell a person when collecting their data. Rights appear in Sections 30 to 36 (access, portability, objection, erasure, restriction and correction), and Section 19 gives the right to withdraw consent. Your notice should address every item below in words your visitors understand.
- Purposes and lawful basisWhy you collect each type of data, and the legal basis you rely on when it is not consent, such as a contract or legitimate interest.
- What happens if they refuseWhere data is needed for a contract or a legal duty, say so and explain what happens if it is not provided.
- Data collected and retentionThe categories of data you collect and how long you keep them, or the criteria you use to decide.
- RecipientsThe kinds of people or companies you share data with: couriers, payment providers, email and hosting services.
- Who you areYour business name, address and contact details, plus your representative or data protection officer where you have one.
- Rights and how to use themAccess, correction, erasure, restriction, objection, portability, withdrawing consent and complaining to the PDPC, with the contact route to use.
A section-by-section outline
This order works for most small and mid-sized Bangkok businesses. Keep each heading, and write only what is true for your site.
- Who we are. Registered business name, address, email and phone, and the date this version took effect.
- What this notice covers. The website, its forms and any linked booking or shop pages. Say if offline data (walk-in customers, staff) is covered elsewhere.
- Data we collect. Group it by source: data you type into forms, data created when you buy, data collected automatically through cookies and server logs.
- Why we use it and on what basis. A short table works well: purpose in one column, data used in the next, lawful basis in the third.
- Who we share it with. Name the types of processor: hosting, email delivery, payment gateway, courier, analytics.
- Transfers outside Thailand. Which services store data abroad and how you protect it.
- How long we keep it. A period per category, not one vague line.
- Cookies. A summary plus a link to the full cookie list and the settings panel.
- Your rights. Each right in one plain sentence, and the exact channel to use, such as a dedicated email address.
- Security. What you do in general terms, without publishing details that help an attacker.
- Changes to this notice. How you announce updates and where earlier versions can be requested.
Third parties and data sent abroad
A typical business website quietly hands data to several outside services. Before writing this section, list every one of them. Owners are often surprised by the count.
- Hosting and backups: the server that stores form entries and orders, which may sit in Singapore, Europe or the US.
- Email delivery: the service that sends form notifications and order emails.
- Analytics and tag tools: Google Analytics, Meta Pixel and similar scripts.
- Chat and messaging buttons: WhatsApp or LINE links pass the conversation to those platforms once the visitor taps.
- Payments and delivery: card gateways, PromptPay QR providers, and couriers such as Thailand Post, KEX Express (formerly Kerry Express) or Flash Express, which receive names, phone numbers and addresses.
Sections 28 and 29 of the Act set conditions for sending personal data to other countries, broadly that the destination has adequate protection or that an exception or safeguard applies. Your notice should say that data may be transferred abroad, to which kinds of services, and on what basis. Do not claim a safeguard you have not checked in the provider's terms.
If your customers include Europeans, compare the two regimes before you draft; our page on how the PDPA differs from GDPR sets out where one notice can serve both and where it cannot.
Writing it clearly in Thai and English
A notice only informs people if they can read it. Most notices fail here, not on legal coverage.
- Write for a customer, not a court. "We keep your booking details for two years so we can handle disputes" beats a paragraph of conditional clauses.
- Use short headings that match questions. "What we collect", "Who sees it", "How to delete it".
- Put retention in real numbers. Decide per category: enquiries you never converted, customer orders you need for tax records, newsletter lists until someone unsubscribes. Where a law fixes a period, such as accounting records, check the current requirement with your accountant.
- Publish both languages. Thai visitors expect Thai, and a clinic or hotel with foreign guests needs English too. Keep them as matched versions with the same date, and state which one prevails if they differ.
- Avoid copied templates. A template from another company lists tools you do not use and misses the ones you do. It may name the wrong country's law or promise rights processes you never set up. That is worse than a short, accurate notice.
Where should the notice go, and when should you update it?
Link the notice from the footer of every page, beside the submit button on every form, inside the cookie banner and on the checkout page, so visitors are never more than one tap away from it. Show an effective date, update it whenever the site changes how it handles data, and review it once a year.
Placement
Visitors should never be more than one tap from the notice at the point where they hand over data:
- the footer of every page, in both language versions;
- beside the submit button on every form, with a short line such as "We use these details to reply to your enquiry. See our privacy notice.";
- inside the cookie banner and the cookie settings panel;
- on the checkout page of a shop, before payment.
The banner itself is only half the job. If you are choosing a tool to run it, our comparison of consent management tools for PDPA covers how each one links the notice and logs choices.
Versions and updates
Show an "effective from" date at the top. Review the notice whenever the site changes in a way that touches data: a new booking plugin, a new analytics or ad tag, a switch of email provider, a move to a new host, or a new country you sell to. A yearly check catches the rest. Keep old versions on file so you can show what a visitor was told at the time. More articles on this topic are grouped under PDPA and website compliance.
Checking the rest of your site
A good notice on a site that behaves differently is a liability, because the notice becomes evidence of what you promised. Once your draft is ready, compare it with what the site really does. Our step-by-step PDPA website audit walks through forms, trackers, plugins and stored data so the notice and the site match.
It also helps to know what is at stake. The Act sets out civil liability, criminal penalties and administrative fines; we summarise them, with sources, in our article on PDPA penalties and fines.
If you would rather have the technical side handled, our PDPA-ready website builds include cookie consent, a privacy notice page wired into every form and banner, and consented forms. Your lawyer signs off the wording; we make sure the site does what the notice says. You can ask for a quote with your current site address and we will tell you what needs to change.
More on PDPA and websites
Sources
- Personal Data Protection Act B.E. 2562 (2019), English translation, Ministry of Digital Economy and Society
- Personal Data Protection Committee (PDPC) Thailand
Builds and ranks the websites: the systems behind the 17 client sites whose Search Console numbers we publish. This guide was written by the Website Development Bangkok team. More about us