PDPA in plain English
PDPA is Thailand's Personal Data Protection Act B.E. 2562 (2019). It sets the rules for collecting, using and disclosing personal data about people in Thailand, and it has been fully enforced since 1 June 2022.
The regulator is the Personal Data Protection Committee, usually called the PDPC. If your website has a contact form, a booking form, a newsletter sign-up, analytics or advertising cookies, the PDPA applies to it.
For a website, the law boils down to a few practical duties: tell people what you collect and why, have a lawful reason for each use, ask for consent where consent is the reason (most non-essential cookies and marketing), keep the data safe, and let people exercise their rights. The rest of this guide turns those duties into decisions you can make about your own site.
One honest caveat before we start: we build websites, we are not lawyers, and this guide is not legal advice. It explains the law as it applies to typical business sites and points to the PDPC for the official text. For anything unusual, such as health data at a clinic or cross-border transfers to a head office, speak to a Thai data protection lawyer.
Who and what the PDPA covers
The PDPA covers personal data about living people, with stricter rules for sensitive data such as health information. It applies to your business as the data controller and to the processors who handle data for you, such as your host or booking engine, and it can reach businesses abroad that serve people in Thailand.
Personal data
Personal data is any information that identifies a living person directly or indirectly: a name, phone number, email address, LINE display name tied to a booking, IP address, or a cookie ID that follows one visitor around. Data about companies is not personal data, but the name and email of the person who filled in your B2B enquiry form is.
Sensitive data
The Act gives a stricter category for sensitive data, including health information, religious or philosophical beliefs, racial or ethnic origin, criminal records, biometric and genetic data. Collecting it generally needs explicit consent. A clinic website asking about symptoms on an appointment form, or a spa asking about medical conditions, is handling sensitive data and should design that form with care.
Controllers and processors
Your business is the data controller: you decide why and how data is used. Companies that handle data on your behalf, such as your hosting company, email marketing tool or booking engine, are data processors. You remain responsible for choosing processors who keep the data safe, so it is worth knowing where your form submissions actually go.
Reach outside Thailand
The PDPA can apply to a business based abroad if it offers goods or services to people in Thailand or monitors their behaviour there. A foreign-run hotel group or an overseas online shop selling to Thai buyers should not assume it is out of scope.
Lawful bases and consent
A common misunderstanding of the PDPA law in Thailand is that every piece of data needs consent. It does not. The Act lists several lawful bases, and consent is only one of them. The main ones a website uses are:
- Contract: you need the data to do what the person asked, such as delivering an order or confirming a room booking.
- Legal obligation: you must keep the data by law, for example tax invoice records.
- Legitimate interest: a reasonable business need that does not override the person's rights, such as basic security logs.
- Consent: the person freely agrees, for a specific purpose, and can withdraw as easily as they agreed.
On a website, consent is usually the right basis for marketing emails, advertising and analytics cookies that are not strictly necessary, and sensitive data. Consent must be a clear action, not a pre-ticked box, and it cannot be a condition for a service that does not need it. Record when and how each consent was given, because you may have to prove it later.
Cookies and consent banners
Many business sites in Thailand load cookies from Google Analytics, Meta, TikTok or a chat widget. Strictly necessary cookies, such as the one that keeps a shopping cart working, can run without asking. Analytics and advertising cookies generally should not load until the visitor agrees.
That is the job of a cookie banner, and the banner has to actually control the scripts. A banner that says "we use cookies" while Meta Pixel fires in the background does not meet the standard. A good banner offers accept and reject with equal prominence, lets visitors choose by category, and remembers the choice. Our guide to cookie consent under the PDPA covers banner wording and set-up in detail, and PDPA consent management platforms compared looks at the tools that handle it.
Keep the banner in Thai and English if your site is bilingual. A Thai visitor should not have to read an English legal notice to decline tracking.
Your privacy notice
The PDPA requires you to tell people, at or before the time you collect their data, what you are doing with it. On a website that means a privacy notice, linked from the footer and from every form. At a minimum it should explain:
- who you are and how to contact you (and your data protection officer, if you must appoint one);
- what personal data you collect, and from where;
- why you collect it and the lawful basis for each purpose;
- how long you keep it;
- who you share it with, including processors and any transfers abroad;
- the rights people have and how to use them.
A copied template from another company is a risk, because it describes their systems, not yours. Our article on writing a PDPA policy for your website walks through each part. Your privacy notice is also different from website terms and conditions, which set the rules for using the site and buying from it; most sites that sell online need both.
What data should your forms collect?
Forms are where most websites collect personal data, and where most problems start. A few habits make a large difference.
Ask only for what you need
A contact form rarely needs a date of birth or ID card number. Every extra field is data you must protect and justify. A restaurant website taking reservations needs a name, a phone number, a date and the party size; that is usually enough.
Separate the marketing tick box
If you want to send promotions, add an unticked checkbox for it, separate from the submit button. Sending the enquiry should never sign someone up to a newsletter by default.
Know where submissions go
Form entries may be stored in the WordPress database, emailed to a shared inbox, copied to a spreadsheet and pushed to a CRM. Each copy is a place data can leak. Map the flow once and delete what you do not need.
If you are planning a new site or a rebuild, this is the moment to fix forms properly; our website redesign guide covers how to plan that work, and the notes on website layout explain where notices and consent checkboxes sit so they are seen without cluttering the page.
Rights requests and data breaches
Data subject rights
People whose data you hold can ask to access a copy of it, correct it, delete it, object to certain uses, restrict processing, move it to another provider, and withdraw consent. Your website should make it easy to send such a request, usually through an email address or form named in the privacy notice. The Act sets deadlines for some responses, such as access requests, so decide in advance who in your team handles them and how you check the requester's identity.
When something goes wrong
A breach can be as ordinary as a hacked WordPress plugin exposing form entries, or a staff member forwarding a customer list to the wrong address. Under the PDPA, a controller must notify the PDPC of a personal data breach without delay and, where feasible, no later than 72 hours after becoming aware of it, unless the breach is unlikely to put people's rights and freedoms at risk. Where the risk is high, the affected people must be told as well, along with the steps you are taking.
Practical preparation helps: keep plugins updated, limit who can see form data, keep backups, and write a short breach plan that names who decides and who contacts the PDPC.
What happens if a website breaks the PDPA?
The PDPA has three kinds of consequence. Administrative fines are imposed by expert committees under the PDPC for breaches such as failing to give a proper notice or collecting data without a lawful basis. Criminal penalties, including fines and possible imprisonment, apply to the more serious misuse of sensitive data. Civil liability means people who suffer damage can claim compensation, and courts can add punitive damages on top.
The amounts vary by offence and have been reported and interpreted in different ways, so we keep the figures, how they apply, and published enforcement cases in a separate article on PDPA penalties and fines, checked against the official text. For most small business websites the bigger practical risk is not the maximum fine; it is a complaint, a lost customer, or a breach that damages trust.
If you also deal with European customers, the rules overlap but are not identical. Our comparison of PDPA vs GDPR shows where one set of work covers both and where it does not.
PDPA website checklist
Use this list to check where your site stands today. It covers the website itself, not your whole business. For a deeper, item by item review that includes staff access and processors, work through our PDPA audit checklist.
- Privacy noticeWritten for your site, in Thai and English if the site is bilingual, linked from the footer and every form.
- Cookie bannerBlocks analytics and ad scripts until consent, with an equally visible reject option.
- Consent recordsStores when, how and to what each visitor or subscriber agreed.
- Lean formsOnly the fields you need; marketing opt-in unticked and separate.
- Sensitive dataHealth or similar details collected only with explicit consent and extra care.
- Processor listYou know which hosting, email, CRM and booking tools receive data, and where they store it.
- Rights channelA named email or form for access, correction and deletion requests, with an owner in your team.
- Security basicsSSL, updated plugins, strong admin passwords, limited admin accounts and tested backups.
- Breach planA short written plan for assessing and reporting a breach to the PDPC.
Who reviewed this guide
This guide was written by the Website Development Bangkok team and reviewed by Litesh Dhir from a website builder's point of view. It is general information, not legal advice. Laws and PDPC guidance change, so check the current official text on the PDPC website and take legal advice for your specific situation.
Who builds your site
Litesh Dhir
Builds and ranks the websites: the systems behind the 17 client sites whose Search Console numbers we publish.
More about usGetting a PDPA-ready website
Our Starter package, from THB 10,000, includes PDPA cookie consent, and our Business package, from THB 30,000, adds the forms, booking or enquiry flows and bilingual pages where consented collection matters most. Final prices are set in the written quote. If you already have a site, a redesign is the natural moment to set up PDPA-ready consent, notices and forms properly. To get going, send us your brief, or WhatsApp or call +66 93 004 4098.
Read next
Sources
- Personal Data Protection Act B.E. 2562 (2019), English translation published by the Ministry of Digital Economy and Society (the Thai text prevails)
- PDPC Thailand: Personal Data Protection Committee (PDPA B.E. 2562)