PDPA (Thailand Personal Data Protection Act)
PDPA (Personal Data Protection Act) is a law in Thailand that regulates the collection, use, storage, and transfer of personal data, serving as Thailand's equivalent of the EU's GDPR in terms of data protection legislation.
For companies operating in Thailand, PDPA compliance is unavoidable. This fully enforced law applies to all organizations handling personal data within Thailand—not only Thai legal entities, but also foreign companies that process data of Thailand-based residents.
Similar to the GDPR, it mandates obtaining consent from data subjects (individuals), prohibits use beyond the stated purpose, and requires notification of data breaches within 72 hours. At the same time, there are differences from the GDPR in the interpretation of Lawful Basis and enforcement frameworks, meaning that "GDPR compliance does not automatically equal PDPA compliance."
In the context of AI adoption, the handling of personal information contained in training data becomes a key issue. When training models using customer data, it is necessary to clearly state the purpose and obtain consent, and the choice of anonymization or pseudonymization methods also becomes a governance-level decision.
Penalties for violations can reach a maximum of 5 million baht (approximately 20 million yen), which, while not as substantial as GDPR fines, cannot be taken lightly given the associated reputational risks. Japanese companies with operations in Thailand are required to coordinate with local legal counsel to ensure appropriate compliance.
Articles covering this term
- Thailand PDPA Compliance Checklist: Balancing Regulatory Requirements with AI UtilizationChecklist for leveraging AI while complying with Thailand's Personal Data Protection Act (PDPA). Key points for data collection, processing, and storage explained.
- How AI Streamlines HR and Recruitment for Thai Companies — From Applicant Response to Turnover PredictionAI in HR & recruitment for firms in Thailand: applicant screening, attendance/labor query automation, attrition prediction, PDPA compliance, and practical implementation steps.
- Guide to AI Investment Decisions for Thai Businesses — Implementation Priorities Based on ROI Comparisons by IndustryA sector-by-sector guide for Thai B2B companies choosing AI investments. Compare manufacturing, logistics, tourism, healthcare & retail by ROI, complexity, and talent needs.
- AES-256 Encryption Implementation Guide for Thailand PDPA Compliance — Key Management and Audit Readiness for AI SystemsStep-by-step guide to implementing Thailand PDPA "appropriate technical safeguards" with AES-256. Covers AI-specific encryption targets, key management, and audit log design.
Related Terms
Deepfake
Deepfake is a technology that uses deep learning to realistically manipulate and synthesize a person
Mesh VPN (Mesh VPN)
Mesh VPN is a VPN architecture in which each node communicates directly with encrypted connections w
Shadow AI
Shadow AI refers to the collective term for AI tools and services used by employees in their work wi
Zero Trust Network Access (ZTNA)
Zero Trust Network Access is a security model that continuously verifies users and devices, controll