Thailand · PDPA
Thailand PDPA compliance for small businesses
Thailand's Personal Data Protection Act has been fully in force since June 2022, and enforcement started in earnest on 1 August 2025, when the PDPC announced eight administrative fines totaling about THB 21.5 million in a single day. The largest, THB 7 million, hit a computer retailer no bigger than an average SME, for having no Data Protection Officer and failing to report a breach. Notifiable breaches must be reported within 72 hours, and the PDPC's 2026 priorities are e-commerce, healthcare, and telecom. MapleNorthIT runs remote PDPA readiness audits for businesses with 5 to 100 employees and sells a self-serve Thailand compliance kit for teams that want to start on their own.
Last updated: July 2026 · MapleNorthIT
PDPA enforcement era: Active since 1 August 2025
The grace period is over. Eight fines in five cases landed on one day in August 2025, covering a state agency, a private hospital, a cosmetics company, a toy retailer, and, notably, a data processor fined THB 3 million directly. Since April 2025 an Emergency Decree adds criminal liability, up to one year in prison, for personal data misuse tied to technology crimes.
What Thailand businesses need to know
- The PDPC fined a computer retailer THB 7 million for having no DPO and not reporting a breach. The company was no bigger than an average SME.
- A private hospital was fined THB 1.21 million after a contractor mishandled the destruction of over 1,000 patient records.
- Data processors carry direct liability: one vendor was fined THB 3 million in the August 2025 batch.
- Notifiable breaches must be reported to the PDPC within 72 hours, and 2026 enforcement priorities are e-commerce, healthcare, and telecom.
Two ways to get compliant
Compliance Readiness Audit
A one-hour remote call plus a review of your setup. Written report within 48 hours, with every gap ranked Critical, Important, or Recommended and a rough cost to fix each one.
Book an auditThailand PDPA Compliance Kit
A self-serve bundle with the policies, registers, and breach response templates the PDPA expects, written in plain language your team can adopt this week.
View the kitPay in CAD by card via Stripe. A $400 CAD audit is roughly THB 9,500.
Common questions
Does Thailand's PDPA apply to a small business?
Yes, at any size. Small businesses received exemptions from some record-keeping duties in 2025, but the security requirements, breach reporting, consent rules, and DPO obligations still apply in full where triggered. The THB 7 million fine against an SME-sized computer retailer settled the question of whether size protects anyone.
How fast must a data breach be reported in Thailand?
Within 72 hours of becoming aware of a notifiable breach. Failure to report was cited in every one of the five cases fined in August 2025. Meeting that clock requires being able to detect a breach in the first place, which is where most small businesses fail, and exactly what a readiness audit checks.
My company is a vendor or agency. Does the PDPA affect us?
Directly, yes. In the August 2025 enforcement batch a data processor was fined THB 3 million, and a system developer was fined alongside the state agency that hired it. If you build, host, or manage systems holding other people's customer data, you carry your own liability, and your clients will increasingly ask for data processing agreements and proof of security.
What does a remote PDPA readiness audit include?
A one-hour call covering security controls, access rights, breach readiness, and vendor arrangements, plus a check of your email authentication and external exposure. You receive a written report within 48 hours with findings ranked Critical, Important, and Recommended, each with estimated effort and rough cost. Bangkok mornings line up with Vancouver evenings, so scheduling is easy.