Personal Data Protection Act B.E. 2562 (2019)

Closely modeled on the GDPR. Section 5 applies the Act to controllers and processors located in Thailand regardless of where processing occurs, and extraterritorially to controllers and processors outside Thailand where the activities involve offering goods or services to data subjects in Thailand (payment required or not) or monitoring their behavior taking place in Thailand. Section 4 excludes personal/family-use processing, certain public-authority security functions, the courts, credit bureaus operating under their own act, and House/Senate proceedings. Foreign controllers in scope must appoint a Thailand-based representative. Enforcement sits with the Personal Data Protection Committee and its office (PDPC), which became operationally active after the June 2022 in-force date; penalties combine administrative fines, civil punitive damages, and criminal liability for sensitive-data misuse.