Personal Data Protection Act B.E. 2562 (2019) — consent where the data subject is a minor

Thailand's age line is not 13, 16 or 18 — it is 20, because s. 20 keys consent to the Civil and Commercial Code's age of majority. That produces a three-tier scheme with no analogue elsewhere in this dataset. A data subject aged 20 or over consents for themselves. Below 10, consent must come from the holder of parental responsibility. Between 10 and 20, the PDPC's guidelines expect consent from BOTH the minor and their legal guardian, except where the consent relates to an act the minor is permitted to perform under the Civil and Commercial Code. s. 20 also covers incompetent and quasi-incompetent persons, whose custodian or curator consents on their behalf. A business applying a GDPR-style 16-or-over rule will systematically under-collect consent for Thai users aged 16 to 19. Marked 'check': the primary text is Thai-language and the three tiers were triangulated across independent legal-reference sources and PDPC guideline summaries.