Thailand's PDPA: what it requires for cookies and tracking

What is Thailand's PDPA?

The Personal Data Protection Act B.E. 2562 (2019) is Thailand's general data protection law. It was published in the Government Gazette on 27 May 2019. Its substantive chapters were due to apply a year later, but they were postponed twice and have been fully in force since 1 June 2022. The Act was modeled on the GDPR and shares its structure: controllers and processors, legal bases, data subject rights, breach notification and data protection officers. It is supervised by the Personal Data Protection Committee and its Office, known together as the PDPC, which issue subordinate notifications and guidelines and impose administrative fines through expert committees.

Who does the PDPA apply to?

Section 5 applies the Act to controllers and processors in Thailand, wherever the processing takes place. It also applies to controllers and processors outside Thailand that process the personal data of people in Thailand when they offer goods or services to them, whether or not payment is made, or monitor their behavior where that behavior takes place in Thailand. Behavioral advertising and analytics that profile Thai visitors are monitoring. A foreign controller in scope must designate a representative in Thailand in writing, subject to exceptions set by the Committee.

Do cookies need consent in Thailand?

The PDPA has no provision on cookies. It applies to them because personal data is any information relating to a person that enables identification, directly or indirectly, which covers cookie identifiers and device IDs that single out a visitor.

Section 24 lists the bases for collecting personal data without consent: research and archives with safeguards, protecting life or health, performing a contract with the person, public tasks, legitimate interests that are not overridden by the person's fundamental rights, and legal obligations. Everything else needs consent under Section 19. In practice:

• Strictly necessary cookies such as session, security, shopping cart and consent cookies can rest on the contract or on legitimate interests, with a notice.
• Analytics cookies may rely on legitimate interests in limited cases, after a documented balancing of interests, but many Thai sites ask for consent to stay on the safe side.
• Advertising and cross-site profiling cookies are hard to justify without consent, because the interest in targeting is unlikely to outweigh the person's rights.

Whatever the basis, Section 23 requires a notice at or before collection that explains the purpose, the legal basis, the data collected, the retention period, the recipients and the person's rights. A cookie banner or cookie policy is the usual place for it.

What must consent look like?

Section 19 sets the conditions. Consent must be obtained before or at the time of collection and requested explicitly, in writing or by electronic means. The request must state the purpose, be clearly distinguishable from other matters, use clear and plain language and not deceive or mislead. Consent must be freely given: a contract or a service may not be made conditional on consent to processing that is not necessary for it. It can be withdrawn at any time, as easily as it was given, and a request that does not meet these conditions does not bind the person. For children under 10, consent comes from the holder of parental responsibility, and older minors need parental consent for acts they cannot perform alone.

The PDPC's 2022 guidelines on obtaining consent add practical detail. Consent must be a clear affirmative act, such as ticking a box marked as consent or pressing a confirmation button after being told what it means. A single consent covering several unrelated purposes is not specific, and consent buried in contract clauses is not valid. The way to withdraw must be shown prominently and be no harder than giving consent.

How are transfers abroad regulated?

Section 28 allows transfers abroad when the destination country or international organization has adequate data protection standards under the Committee's rules. Without that, a transfer is allowed in listed cases, including legal compliance, consent after the person is told that the destination's standards are inadequate, performance of a contract with the person, and protecting life or health. Section 29 adds two more routes: a personal data protection policy for transfers within a corporate group, reviewed and certified by the Office, and appropriate safeguards that make the person's rights enforceable, in line with the Committee's notifications.

Who enforces the PDPA, and what are the penalties?

Expert committees impose administrative fines and may first order a correction or issue a warning, taking into account the seriousness of the act and the size of the business (Section 90). The maximum fine per violation is THB 1 million for failures such as missing notices or not appointing a data protection officer (Section 82), THB 3 million for processing without a legal basis, deceptive consent or unlawful transfers (Section 83), and THB 5 million for breaches involving sensitive data (Section 84). Criminal penalties of up to one year in prison and a fine of THB 1 million apply to unlawful use or disclosure of sensitive data for gain (Section 79), and courts can award punitive damages of up to twice the actual damage (Section 78).

The PDPC announced its first fine in August 2024: THB 7 million in total against a large online retailer of IT products after a breach, for failing to appoint a data protection officer, to secure the data and to notify the breach. No published PDPC fine has concerned cookies alone.

What should a website serving Thailand do?

• Classify cookies by purpose and legal basis; the cookie scanner lists what your pages set.
• Publish a Section 23 notice in Thai covering purposes, bases, retention and recipients.
• Ask for opt-in consent for advertising cookies, purpose by purpose, with withdrawal as easy as acceptance.
• Check that transfers to analytics and ad vendors abroad fit Section 28 or 29.

Thailand is not in Cookiequiet's default list of regulated countries, but geo-targeting is free on every plan, so you can add Thailand to a custom list. Thai visitors then see the opt-in banner with Reject all, categories stay off until chosen, and the consent log records each choice. The banner's 24 languages do not yet include Thai, and every string is editable per language. See also Singapore and Vietnam.