Personal Data Protection Act B.E. 2562 (2019)
Sets lawful bases, data-subject rights, controller duties and breach notification.
Central Thailand — Bangkok
PDPA & Data Protection Compliance in Bangkok
Building data protection practices that match Thailand’s PDPA.
Why Bangkok matters are different
Bangkok concentrates the courts, central government departments, embassies and most corporate head offices in Thailand. A legal matter arising in Bangkok therefore usually touches several authorities at once — the court with territorial jurisdiction, the Department of Business Development, the district land offices, the Immigration Bureau and the Department of Consular Affairs. Sequencing the steps correctly from the start saves far more time than correcting them later.
The Personal Data Protection Act B.E. 2562 (2019) requires data controllers to have a lawful basis for collecting, using and disclosing personal data, to give notice of purposes, to keep records of processing activities and to maintain appropriate security measures. We translate those requirements into workable documents and procedures — privacy notices, processor agreements and a route for handling data subject requests.
- Bangkok cases require choosing the court by territorial jurisdiction — the defendant’s domicile or where the cause arose. Filing in the wrong court costs weeks.
- Documents for overseas use usually pass through the MFA and the relevant embassy, each with its own queue and requirements.
- Most companies are registered in Bangkok, so corporate searches and filings are typically faster here.
- Bangkok serves many foreign clients, so bilingual documents and interpreted appointments are routine.
Courts and authorities in Bangkok
Jurisdiction and filing requirements should be confirmed for each matter, because practice and required attachments differ between offices.
| Court / authority | What it handles |
|---|---|
| Civil Court, Criminal Court and Bangkok municipal courts | Hear civil and criminal cases according to territorial jurisdiction in Bangkok |
| Central Labour Court | Dismissal, severance and employment-contract disputes |
| Central Administrative Court | Challenges to state orders and administrative action |
| Central Intellectual Property and International Trade Court | Trademark, copyright, patent and international trade cases |
| Central Bankruptcy Court | Bankruptcy and business rehabilitation |
| Legal Execution Department | Seizure, garnishment, auction and execution-stage mediation |
| Department of Business Development | Company registration and registered changes |
| Department of Consular Affairs, MFA | Legalisation of documents for overseas use |
| Immigration Bureau | Visas, extensions of stay and residence notification |
What we handle in Bangkok
- Data flow mapping and records of processing activities
- Drafting privacy policies, notices and consent forms
- Data processing agreements with vendors
- Procedures for handling data subject rights requests
- Data breach response and notification procedures
- Advice on cross-border transfers of personal data
- Staff training and internal handbooks
The local process, step by step
- 1Initial case assessment of the business and the data it holds
- 2Interviewing each department to build the data flow map
- 3Identifying the lawful basis for each activity and the gaps to close
- 4Delivering the document set and procedures with training for the actual users
- 5Periodic review when services or vendors change
Documents to prepare
- Inventory of systems and applications holding personal data
- Contracts with vendors that access personal data
- Forms and channels used to collect customer and employee data
- Existing information security policies
Points to watch
- Consent is not the only lawful basis; asking for it unnecessarily creates avoidable burden.
- Sensitive data such as health and criminal records carries stricter conditions than ordinary data.
- Having policy documents is not enough; practice must match them and be auditable.
- Cross-border transfers must be assessed case by case against the statutory conditions.
Typical timeframe
Mapping data flows and producing the core document set for a small to mid-sized organisation typically takes some weeks, depending on the number of departments and systems. Organisations handling sensitive data or transferring data abroad need longer.
Timeframes are indicative and depend on the court calendar and the authority handling the matter in Bangkok.
Areas of Bangkok we regularly serve
สาทรสีลมบางรักวัฒนาคลองเตยห้วยขวางจตุจักรลาดพร้าวบางนาพระโขนงดินแดงปทุมวันบางกะปิดอนเมืองมีนบุรี
Laws that govern this matter — Bangkok
Summarised for general understanding only. The application of each provision depends on the facts of your case.
PDPC subordinate notifications
Provide operational detail such as security measures and records of processing.
Example situations and how they are handled — Bangkok
These are constructed examples used to explain procedure. They are not client matters, and no outcome is implied or guaranteed.
Illustrative scenario: a customer demands full deletion
Situation: A customer exercises the right to erasure, but accounting and tax law still require retention.
Usual approach: Separate legally mandated records from marketing data and reply in writing explaining the retained basis and retention period. (Hypothetical.)
Advice for your specific situation — Bangkok
Businesses collecting customer data online
- Make the processing records reflect the systems actually used, not a copied template.
- Review vendor contracts — liability stays with the controller.
Every matter — what to do in the first 7 days
- Gather every original document in one place, keep scanned copies, and note the date you received each one.
- Write a dated timeline — the date you received a notice or learned of the event usually starts the limitation or appeal clock.
- Do not sign a settlement, debt acknowledgement or withdrawal before a lawyer reviews it — it may extinguish existing rights.
- Preserve digital evidence unaltered (full screenshots, original files, emails with headers) — edited files are easy to challenge.
Questions people in Bangkok ask
Which Bangkok court will hear my case?
It depends on the case type and territorial jurisdiction. General civil and criminal cases go to separate courts, while labour, administrative, IP and bankruptcy matters each have a specialised court. We verify jurisdiction from the parties’ domicile and the place of the events before filing.
I live upcountry but the case is in Bangkok — must I attend every hearing?
Not every hearing. With a proper appointment of counsel and power of attorney, your lawyer can act for you in many steps, but hearings where you must testify require your attendance. We tell you in advance which dates are mandatory.
Certifying a document in Bangkok for use abroad — what comes first?
Always start from the receiving authority’s requirement — it dictates whether you need signature certification, translation, MFA legalisation and embassy endorsement, and in what order. For Thailand, the Apostille Convention enters into force on 28 February 2027; until then MFA and embassy legalisation continues to apply.
Does the PDPA apply to small businesses?
The Act applies to data controllers without a general exemption by business size, though what counts as appropriate measures scales with the risk and volume of data held.
Do we need a Data Protection Officer?
It depends on the organisation’s activities as defined by the Act — for example large-scale processing requiring regular monitoring, or processing of sensitive data. We assess this organisation by organisation.
Can we keep copies of customers’ ID cards?
Yes where a lawful basis applies and only to the extent necessary for the stated purpose, with clear notice and a defined retention period. Keeping copies without a justification is a common exposure.
Same service in other provinces
Other legal services in Bangkok
Litigation & Court Representation — BangkokCivil, criminal, labour, family, succession and land disputesCorporate & Commercial — BangkokIncorporation, contracts, foreign business, BOI and complianceImmigration & Foreign Nationals — BangkokVisas, work permits, residency and lawful statusIntellectual Property — BangkokTrademarks, copyright, patents and enforcementLand & Real Estate — BangkokTitle due diligence, sale, lease and transfer at the Land OfficeFamily & Succession — BangkokMarriage, divorce, custody, wills and estate administrationMediation, Arbitration & Enforcement — BangkokResolving disputes outside court and making awards effectiveNotarial Services & International Documents — BangkokSignature and document certification, translation, consular and embassy legalisation
Discuss your Bangkok matter with an attorney
Tell us the facts and we will explain which authority applies, what documents are needed and the realistic timeframe.