Thailand: Privacy

Thailand’s Office of the Personal Data Protection Committee (PDPC) recently released draft guidance on records of processing activities (ROPA) for personal data controllers and processors under the Personal Data Protection Act B.E. 2562 (2019) (PDPA).

On 6 July 2026, the Personal Data Protection Committee of Thailand (PDPC) issued a new Notification, setting out detailed requirements for handling requests by data subjects to access and obtain copies of their personal data, as well as requests for information on the source of personal data collected without consent.

Thailand's Personal Data Protection Act faces significant amendments that could reshape how government agencies and private organizations handle personal data. The proposed changes introduce new exemptions for anticorruption operations, clarify which entities qualify as government agencies, and fundamentally restructure the legal framework for data processing to align with international standards like the GDPR. These modifications would shift consent from a default requirement to one of seven equal lawful b