How to Make Your Website Thailand PDPA Compliant in Less than 1 week

The Thailand PDPA stands for the new Personal Data Protection Act B.E.2562 of the Kingdom of Thailand. It was passed in 2019 and was scheduled to take full effect on 27 May 2020.

However, In May 2020, the Thai Cabinet approved a royal directive granting a one-year exemption from certain provisions of the Personal Data Protection Act 2019 (PDPA) up to May 31, 2021, when the new law will be expected to be fully implemented.

PDPA is the most comprehensive Thai data privacy law to date. It expands on the rights of users whose data you collect, which means expanding on your obligations as well.

The Thailand PDPA follows the trend set by the GDPR. It has many similarities with this regulation, as well as with data protection laws of East and South-East Asia. If your business complies with the GDPR, it would be easy to comply with the PDPA as well.

The Thailand PDPA applies to:

• Thai businesses that collect or process personal data in Thailand from users from anywhere in the world
• Any business from all around the world that collects or processes personal data of Thai citizens for the purposes of:

1. the offering of goods or services to data subjects on the territory of Thailand, irrespective of whether the payment is made by them or not
2. the monitoring of the data subject’s behaviour, where the behaviour takes place in Thailand.

There are two types of penalties for violation of the Thailand PDPA: administrative and criminal penalties.

Most of the violations lead to administrative penalties imposed by the Personal Data Protection Committee. Depending on the severity of the violation, fines may go up to 5 million baht, which is around USD 150,000.

For some violations, PDPA prescribed criminal penalties including imprisonment of up to one year and fines of up to 5 million baht. You may face such penalties if you:

• Disclose to another person the personal data obtained while performing the duties under this Act
• Disclose sensitive personal data without data subject’s consent or for a purpose other than what the consent has been given for a personal benefit or in a way that may cause them damage, or
• Transfer sensitive personal data to a country without adequate personal data protection standards for a personal benefit or in a way that may cause damage to data subjects.

In addition to the penalties, you are liable for the damages that the data subject has suffered due to your non-compliance with the law. If proven responsible, you’d have to compensate them for the damages.

According to Section 6 of the law, personal data is any information relating to a person, which directly or indirectly enables the identification of such a person. This includes names, address, email address, phone number, ID number or another number that identifies a specific person, and others.

Although there is no explicit definition in the PDPA, the law implies that sensitive data is any personal data related to racial, ethnic origin, political opinions, cult, religious or philosophical beliefs, sexual behavior, criminal records, health data, disability, trade union information, genetic data, biometric data, or of any data which may affect the data subject in the same manner.

PDPA protects only living individuals. It excludes deceased persons from protection.

Yes, you have to obtain explicit user’s consent before collecting or processing their data. The request must be presented in a way that clearly differentiates the request from the other content on the website. In addition, you have to inform the user about the purpose of data collection or processing in a clear and non-deceptive way.

This means that you need a cookie banner requesting consent for using cookies. Inserting a link to your privacy policy on that banner is a practical way to inform users about the purpose of data collection.

Like the GDPR and other similar laws, the PDPA requires a proactive and risk-based approach. You need to put in place all the preventive measures you can in order to protect your business from non-compliance.

For start, ensure that you have a PDPA-compliant privacy policy and that you collect consent from every single user who visits your website.

You can make your website PDPA-compliant by using a risk-based approach, in the same way as with the GDPR or the LGPD. You need to implement a set of preventive measures suitable for the data collection and data processing activities you undertake. The more data you collect and process, the more serious measures you should take.

The PDPA introduces principles such as transparency, accountability, purpose limitation, data minimization, security measures, and others we’ve seen already in other laws.

For a start, any website owner should update the privacy policy, analyze the data trackers they use, and ensure they collect consent for data collection the right way. 

Your website is affected by the Thailand PDPA if:

• Your business is based in Thailand and you collect or process personal data in Thailand from people from anywhere in the world
• Your business is based anywhere in the world and you collect or processes personal data of Thai citizens for the purposes of offering products and services to users in Thailand or monitor their behavior

Many websites use tracking technologies for gathering data that could help them make data-driven decisions for business improvement. If you have installed any plugins on your website, you are likely to use such tracking technologies already.

Laws such as Thailand PDPA aim to regulate the way data is being collected and processed, hence they prescribe certain obligations to website owners. That’s why you, as a website owner, have to be aware of the trackers you have on your website. Only if you know what trackers you use, you can meet your obligations under the Thailand PDPA.

If you are not aware of these trackers, use our free tool to audit your website. It will provide you with the results in less than 5 minutes at no cost at all.

Obtaining consent for collection and processing of personal data must meet the following requirements:

• The consent must be given freely
• It must be obtained in a written form, including electronic means
• The user must be informed about the purpose of collection and processing of data
• The request must be clear, in plain language, non-deceptive, and non-misleading

Since implied consent is not valid, you have to ensure that your cookie banners are affirmative. You have to include buttons for giving explicit consent for the use of cookies.

To learn how our cookie blocking works, please see this guide.

Yes, we offer PDPA readiness tests, website audits, training and more. Please schedule a call here.

Yes, we offer full support for a wide range of privacy laws including GDPR, CCPA and LGPD.

Yes, we offer volume discounts. Please schedule a call here.

Yes, you can. We offer a FREE trial. You can cancel anytime.

You sure can. Go to your administration panel at any time, and you will find cancel in the account section.