Personal Data Protection Act B.E. 2562 (2019)
Sets lawful bases, data-subject rights, controller duties and breach notification.
Northern Thailand — Chiang Mai
PDPA & Data Protection Compliance in Chiang Mai
Building data protection practices that match Thailand’s PDPA.
Why Chiang Mai matters are different
Chiang Mai is the administrative, academic and tourism hub of northern Thailand and home to a large long-stay foreign community. Legal work here spans local business and land matters as well as documents, visas, marriage and succession for long-term foreign residents. Because regional courts and agencies are located in the province, many matters can be completed locally without travelling to Bangkok.
The Personal Data Protection Act B.E. 2562 (2019) requires data controllers to have a lawful basis for collecting, using and disclosing personal data, to give notice of purposes, to keep records of processing activities and to maintain appropriate security measures. We translate those requirements into workable documents and procedures — privacy notices, processor agreements and a route for handling data subject requests.
- Many Chiang Mai plots sit in use-restricted zones or carry title documents other than a full chanote, so the title type must be checked before any contract.
- The large long-stay foreign community drives demand for bilingual wills, powers of attorney and documents for use in the client’s home country.
- Hotels, restaurants and tourism businesses rely on long leases, raising lease registration and renewal issues.
- Regional administrative and labour courts sit in the province, so those cases need not be filed in Bangkok.
Courts and authorities in Chiang Mai
Jurisdiction and filing requirements should be confirmed for each matter, because practice and required attachments differ between offices.
| Court / authority | What it handles |
|---|---|
| Chiang Mai Provincial Court and Chiang Mai Municipal Court | Civil and criminal cases within Chiang Mai province |
| Chiang Mai Juvenile and Family Court | Divorce, custody and family matters |
| Labour Court Region 5 | Labour cases in the upper northern region |
| Chiang Mai Administrative Court | Challenges to state decisions in the northern region |
| Chiang Mai Legal Execution Office | Seizure, garnishment and auction of local assets |
| Chiang Mai Provincial Land Office and branch offices | Registration of land and condominium transactions |
| Chiang Mai Immigration Office | 90-day reporting, extensions of stay and residence notification |
| Chiang Mai Provincial Commercial Office | Local business registration services |
What we handle in Chiang Mai
- Data flow mapping and records of processing activities
- Drafting privacy policies, notices and consent forms
- Data processing agreements with vendors
- Procedures for handling data subject rights requests
- Data breach response and notification procedures
- Advice on cross-border transfers of personal data
- Staff training and internal handbooks
The local process, step by step
- 1Initial case assessment of the business and the data it holds
- 2Interviewing each department to build the data flow map
- 3Identifying the lawful basis for each activity and the gaps to close
- 4Delivering the document set and procedures with training for the actual users
- 5Periodic review when services or vendors change
Documents to prepare
- Inventory of systems and applications holding personal data
- Contracts with vendors that access personal data
- Forms and channels used to collect customer and employee data
- Existing information security policies
Points to watch
- Consent is not the only lawful basis; asking for it unnecessarily creates avoidable burden.
- Sensitive data such as health and criminal records carries stricter conditions than ordinary data.
- Having policy documents is not enough; practice must match them and be auditable.
- Cross-border transfers must be assessed case by case against the statutory conditions.
Typical timeframe
Mapping data flows and producing the core document set for a small to mid-sized organisation typically takes some weeks, depending on the number of departments and systems. Organisations handling sensitive data or transferring data abroad need longer.
Timeframes are indicative and depend on the court calendar and the authority handling the matter in Chiang Mai.
Areas of Chiang Mai we regularly serve
เมืองเชียงใหม่นิมมานเหมินท์สันทรายหางดงสารภีแม่ริมดอยสะเก็ดสันกำแพงแม่แตงฝาง
Laws that govern this matter — Chiang Mai
Summarised for general understanding only. The application of each provision depends on the facts of your case.
PDPC subordinate notifications
Provide operational detail such as security measures and records of processing.
Example situations and how they are handled — Chiang Mai
These are constructed examples used to explain procedure. They are not client matters, and no outcome is implied or guaranteed.
Illustrative scenario: a customer demands full deletion
Situation: A customer exercises the right to erasure, but accounting and tax law still require retention.
Usual approach: Separate legally mandated records from marketing data and reply in writing explaining the retained basis and retention period. (Hypothetical.)
Advice for your specific situation — Chiang Mai
Businesses collecting customer data online
- Make the processing records reflect the systems actually used, not a copied template.
- Review vendor contracts — liability stays with the controller.
Every matter — what to do in the first 7 days
- Gather every original document in one place, keep scanned copies, and note the date you received each one.
- Write a dated timeline — the date you received a notice or learned of the event usually starts the limitation or appeal clock.
- Do not sign a settlement, debt acknowledgement or withdrawal before a lawyer reviews it — it may extinguish existing rights.
- Preserve digital evidence unaltered (full screenshots, original files, emails with headers) — edited files are easy to challenge.
Questions people in Chiang Mai ask
Must this be filed in Bangkok, or can it be done in Chiang Mai?
Most matters can be handled locally: Chiang Mai has provincial, municipal, family, regional labour and administrative courts as well as a legal execution office. Exceptions are matters the law assigns to central bodies, such as MFA document legalisation.
Can a foreigner living in Chiang Mai make a will or grant a power of attorney?
Yes. The document must follow the correct Thai statutory form, and if it will also be used abroad, translation and certification should be planned from the outset to avoid redoing it.
Buying land or a house in Chiang Mai — what should I watch for?
Check the title type, legal access, zoning and use restrictions, and any registered encumbrances before paying a deposit — these are hard to fix after signing.
Does the PDPA apply to small businesses?
The Act applies to data controllers without a general exemption by business size, though what counts as appropriate measures scales with the risk and volume of data held.
Do we need a Data Protection Officer?
It depends on the organisation’s activities as defined by the Act — for example large-scale processing requiring regular monitoring, or processing of sensitive data. We assess this organisation by organisation.
Can we keep copies of customers’ ID cards?
Yes where a lawful basis applies and only to the extent necessary for the stated purpose, with clear notice and a defined retention period. Keeping copies without a justification is a common exposure.
Same service in other provinces
Other legal services in Chiang Mai
Litigation & Court Representation — Chiang MaiCivil, criminal, labour, family, succession and land disputesCorporate & Commercial — Chiang MaiIncorporation, contracts, foreign business, BOI and complianceImmigration & Foreign Nationals — Chiang MaiVisas, work permits, residency and lawful statusIntellectual Property — Chiang MaiTrademarks, copyright, patents and enforcementLand & Real Estate — Chiang MaiTitle due diligence, sale, lease and transfer at the Land OfficeFamily & Succession — Chiang MaiMarriage, divorce, custody, wills and estate administrationMediation, Arbitration & Enforcement — Chiang MaiResolving disputes outside court and making awards effectiveNotarial Services & International Documents — Chiang MaiSignature and document certification, translation, consular and embassy legalisation
Discuss your Chiang Mai matter with an attorney
Tell us the facts and we will explain which authority applies, what documents are needed and the realistic timeframe.