How different are PDPA and GDPR?
Thailand's PDPA and the EU's GDPR are close but not identical. A website that meets GDPR properly has done most of the PDPA work; the differences sit in age thresholds for consent, how cookies are regulated, the size of fines, how cross-border transfers are approved, and notices your Thai visitors can read.
Thailand's Personal Data Protection Act B.E. 2562 was drafted with the EU's General Data Protection Regulation (GDPR) as its model, and it shows. Both laws define personal data broadly, both reach businesses outside their borders, both rely on lawful bases rather than consent for everything, and both give people similar rights.
This page is for a Thai company that sells to European customers, or a European firm opening in Bangkok, who already knows one law and needs to know what changes under the other. For PDPA alone, start with the PDPA guide for website owners. This comparison is general information, not legal advice.
PDPA and GDPR side by side
The table summarises the points that most often affect a website. Article and section numbers refer to the official texts listed in the sources at the end of this page.
| Topic | PDPA (Thailand) | GDPR (EU) |
|---|---|---|
| In force | Fully enforced from 1 June 2022 | Applies from 25 May 2018 |
| Regulator | Personal Data Protection Committee (PDPC) | National supervisory authorities in each member state |
| Reach abroad | Businesses offering goods or services to, or monitoring, people in Thailand | Businesses offering goods or services to, or monitoring, people in the EU |
| Lawful bases | Consent, contract, legal obligation, vital interest, public task, legitimate interest, plus research and archives | Consent, contract, legal obligation, vital interest, public task, legitimate interest |
| Cookies | Handled through the general consent and notice rules | GDPR plus the separate ePrivacy rules on cookies |
| Children | Guardian consent needed below age 10, with limits for other minors | Parental consent below 16, which member states may lower to 13 |
| Breach reporting | Notify PDPC without delay, where feasible no later than 72 hours after awareness | Notify the authority without undue delay, where feasible no later than 72 hours after awareness |
| DPO | Required for large-scale regular monitoring or core sensitive data processing, and some public bodies | Similar triggers: large-scale monitoring, special category data, public authorities |
| Transfers abroad | Destination must meet PDPC adequacy rules, or appropriate safeguards (such as group rules or standard contract clauses recognised by the PDPC) or an exception must apply | Adequacy decisions, standard contractual clauses or other safeguards |
| Maximum fines | Administrative fines in THB by offence, plus criminal penalties and punitive damages | Up to EUR 20 million or 4% of global annual turnover, whichever is higher |
Who must comply with each law?
Both laws follow the person, not just the company. The PDPA applies to a business in Thailand, and also to one abroad that offers goods or services to people in Thailand or monitors their behaviour there. GDPR works the same way for people in the EU.
In practice this creates overlap. A Bangkok boutique hotel that takes direct bookings from German and French guests through its website is likely within GDPR's reach as well as the PDPA. A Dutch software reseller with a Thai-language site aimed at Thai buyers is within the PDPA's reach even with no office here. Neither law cares where your server sits; what counts is whose data you collect and why.
A quick test: look at who your site is written for. Local currency, a local language version, local delivery options such as Thai couriers, or ads aimed at a country are signs you are targeting people there.
Consent, cookies and lawful bases
The lawful bases are close to identical. Both laws let you process data without consent when you need it for a contract, a legal duty or a legitimate interest that does not override the person's rights. The PDPA adds explicit bases for research, statistics and archives, which rarely matter for a business website.
What valid consent looks like
Both require consent to be freely given, specific, informed and as easy to withdraw as to give. Pre-ticked boxes and consent buried in terms fail under either law. The age rules differ: the PDPA needs a guardian's consent for children under 10 and sets limits for older minors, while GDPR sets 16 by default, with member states allowed to go as low as 13.
Cookies
This is the biggest structural difference. In Europe, cookie consent comes mainly from the ePrivacy rules sitting alongside GDPR. Thailand has no separate cookie law, so cookies fall under the PDPA's general rules on notice and consent. The practical outcome is similar: block analytics and ad cookies until the visitor opts in. A banner configured for GDPR usually works for the PDPA if it also runs in Thai. Our guide to building a PDPA consent form and cookie banner covers the set-up, and PDPA consent management platforms compared helps if you are choosing a tool that serves both regions.
Rights, breaches and officers
Rights
The list of rights is almost the same: access, correction, deletion, restriction, objection, portability and withdrawal of consent. Both laws expect a reply to an access request within about a month. One process on your website, a named email address or a request form, can serve both audiences, as long as your privacy notice explains it in the languages your visitors read. Our article on writing a PDPA policy shows how to structure a notice that covers these rights.
Breach notification
Both laws use the same 72-hour benchmark for telling the regulator about a breach, counted from when you become aware of it, and both require telling affected people when the risk to them is high. If you are covered by both, one incident may need two reports: one to the PDPC and one to the relevant European authority.
Data protection officers
The triggers for appointing a DPO are similar: large-scale regular monitoring of people, core activities involving sensitive data, and certain public bodies. Most small hotel, restaurant or shop websites do not meet those triggers under either law, though a clinic processing health data at scale might.
Transfers abroad
Sending data out of Thailand, to a head office in Europe or a cloud tool in the US, needs the destination to meet PDPC adequacy rules, appropriate safeguards such as standard contract clauses recognised under PDPC rules in force since March 2024, or an exception. GDPR has its own adequacy list and standard contractual clauses. Check both if data moves in both directions.
Fines and enforcement
GDPR's top tier of fines is up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher, set out in Article 83.
The PDPA works differently. Administrative fines are set in Thai baht per type of breach and are much lower in absolute terms, but the Act adds two things GDPR leaves to national law: criminal penalties for serious misuse of sensitive data, and punitive damages in civil claims on top of actual losses. For the specific amounts and how the PDPC has applied them, see our breakdown of PDPA penalties and fines.
For a small business website, the practical lesson from both laws is the same: be able to show your work. A clear notice, a working consent banner and a record of consents are the evidence you would want to hand over if a complaint ever arrived.
One website for both laws
If your site serves Thai and European visitors, build to the stricter point on each topic and you will usually satisfy both. That means:
- a cookie banner that blocks non-essential scripts until consent, in Thai and English, with reject as visible as accept;
- one privacy notice, written for your real systems, available in both languages and naming both the PDPA and GDPR where relevant;
- unticked, separate marketing checkboxes on every form, and stored consent records;
- a single channel for rights requests, with someone responsible for answering;
- a breach plan that names which regulators you would notify;
- a list of tools that receive data and where they store it, to cover transfer rules.
To check an existing site against this list, our PDPA website audit checklist goes item by item, and you will find more reading under PDPA and compliance. When you want it built in from the start, we make PDPA-compliant websites in English and Thai: PDPA cookie consent is included in the Starter package (from THB 10,000), and the Business package (from THB 30,000) adds bilingual pages and the forms and enquiry flows where consent matters most, with the consent scope set in your written quote. Prices are indicative; get a written quote for your site, or WhatsApp or call +66 93 004 4098.
More on PDPA
Sources
- Personal Data Protection Act B.E. 2562 (2019), English translation, Ministry of Digital Economy and Society
- PDPC Thailand: Personal Data Protection Committee (PDPA B.E. 2562)
- EUR-Lex: Regulation (EU) 2016/679 (GDPR)
- Tilleke & Gibbins: Thailand's regulations for cross-border personal data transfer come into force
- EUR-Lex: Directive 2002/58/EC (ePrivacy Directive)
Builds and ranks the websites: the systems behind the 17 client sites whose Search Console numbers we publish. This guide was written by the Website Development Bangkok team. More about us