Thailand’s Personal Data Protection Act B.E. 2562 (2019) has been fully in force since 1 June 2022. For the first two years, enforcement was largely about awareness. That has changed.
In 2024, the Personal Data Protection Committee (PDPC) imposed an aggregate THB 7 million administrative fine on an online retailer for multiple failures, including DPO, security and breach-notification failures.
By the end of 2025, the PDPC had announced six fined cases, covering both data controllers and data processors, in the public and private sectors, with total fines of more than THB 21.5 million. In 2026, enforcement and investigations have continued, including scrutiny of major breach and biometric-data matters.
HR should take note. Few functions hold more personal data, or more sensitive data, than HR.
Why HR is in the front line
Employee records contain national ID numbers, bank details, salary, tax information and family details. Many also contain data the PDPA treats as sensitive: health information from medical certificates and insurance, biometric data from attendance systems, criminal records from background checks, and trade union membership.
Sensitive personal data carries stricter conditions under section 26. It requires explicit consent unless a statutory exception applies, such as obligations under labour protection and social security law.
Consent is not a blanket solution
A common mistake is to rely on a blanket consent form signed at onboarding. Consent given as a condition of employment may not be freely given. The better approach is to identify the applicable legal basis for each purpose.
For ordinary HR processing this may include performing the employment contract, complying with legal obligations such as tax and social security, or legitimate interests. Use consent where the Act requires it or where another basis does not apply. For section 26 sensitive data, separately identify explicit consent or a statutory exception.
The penalties
The PDPA provides for three kinds of liability:
• administrative fines of up to THB 5 million per relevant contravention, so aggregate fines in a single case can be higher;
• civil liability for damage caused, with punitive damages of up to twice the actual compensation; and
• criminal penalties for certain unlawful uses or disclosures of sensitive data.
Failing to notify the regulator of a breach within 72 hours can alone attract an administrative fine of up to THB 3 million.
The 10-point checklist
1. Map your HR data. Record what you collect, from whom, why, where it is stored and who can access it.
2. Identify the legal basis for each purpose. For ordinary HR processing this may be contract, legal obligation or legitimate interests; use consent where the Act requires it or where another basis does not apply.
3. Tag sensitive data. Identify health, biometric, criminal record and trade union data, and confirm the explicit consent or section 26 exception relied on.
4. Issue an employee privacy notice. Explain purposes, lawful bases, retention periods, disclosures and employees’ rights.
5. Keep a record of processing activities. The Act requires data controllers to maintain one.
6. Set retention periods. Keep data only as long as the purpose and the law require, then delete or anonymise it.
7. Secure the data. Apply appropriate security measures, including access controls by role, and review them regularly.
8. Prepare for breaches. Notify the PDPC without delay and, where feasible, within 72 hours of becoming aware of a breach, and tell affected employees where the risk to them is high.
9. Determine each vendor’s role. Where a payroll, HR software or background-check provider acts as a data processor, put the required written controller-processor terms in place. Some providers may act as independent or joint controllers for particular activities.
10. Assess whether section 41 requires a DPO. A DPO is required for prescribed public authorities, and where core activities involve large-scale regular monitoring or section 26 sensitive personal data. Routine HR support processing does not automatically trigger a DPO solely because employee data includes sensitive fields.
Cross-border transfers
Many Thai employers run HR and payroll on regional platforms. For transfers outside Thailand, confirm the applicable adequacy, exception or appropriate-safeguard mechanism under sections 28 and 29 and current PDPC rules, including the 2026 binding corporate rules framework where relevant. Check where your HR data is hosted and on what basis it moves.
Where systems help
Most of the checklist depends on control: knowing where data sits, limiting who sees it and proving what happened. MiHCM Enterprise, delivered in Thailand with our partner iOperation, keeps employee data in one system with role-based access and an audit trail. MiHCM holds ISO/IEC 27001:2022 and ISO/IEC 27701:2025 certifications for its Malaysia and Sri Lanka operations and has a SOC 2 Type II report available to customers on request.
Frequently Asked Questions
Does Thailand’s PDPA apply to employee data?
Yes. The PDPA applies to the personal data of employees and job applicants as well as customers. Employers are data controllers for the HR data they collect.
Do employers need employee consent under the PDPA?
Not always. Employers should identify the applicable legal basis for each purpose; for ordinary HR processing this may be the employment contract, legal obligations or legitimate interests. Consent is used where the Act requires it or no other basis applies. Section 26 sensitive data needs explicit consent unless a statutory exception applies.
How quickly must a PDPA data breach be reported?
Without delay and, where feasible, within 72 hours of becoming aware of the breach. Affected individuals must also be told where the breach is likely to pose a high risk to them.
What are the PDPA penalties in Thailand?
Administrative fines of up to THB 5 million per relevant contravention, civil liability including punitive damages of up to twice the actual compensation, and criminal penalties for certain offences involving sensitive data. Aggregate fines in a single case can be higher.
Has the PDPC fined organisations under the PDPA?
Yes. In 2024 the PDPC imposed an aggregate THB 7 million administrative fine on an online retailer for multiple failures. By the end of 2025 it had announced six fined cases, with total fines of more than THB 21.5 million.
Sources
• DLA Piper, Data protection laws in Thailand – breach notification, enforcement cases, penalties
• DLA Piper, Thailand’s first PDPA enforcement (27 August 2024) – aggregate THB 7 million fine
• Personal Data Protection Act B.E. 2562 (2019), sections 24, 26, 28 to 29, 37, 40, 41 and 82 to 87; PDPC Notification on DPOs under section 41(2) (2023)
• Chambers and Partners, Data Protection & Privacy 2026: Thailand – Trends and Developments – THB 7 million fine
• Securiti, Employer’s Data Obligation Under Thailand’s PDPA – sensitive data and employee consent
