PDPA 2026 — Real Enforcement, Real Fines, Real Cases: What Thai Businesses Must Know
August 1, 2025 marked a turning point for data protection in Thailand. The Personal Data Protection Committee (PDPC) announced its first major round of administrative fines — over THB 21.5 million across 5 cases and 8 penalties, covering both public agencies and private companies.
The era of warnings and grace periods is officially over. The PDPC is now enforcing the law with real consequences, and businesses that are not prepared face tangible risks.
The Current Landscape: From Paper Law to Active Enforcement
Thailand's Personal Data Protection Act (PDPA), B.E. 2562, has been fully effective since June 2022. However, for the first 2-3 years, the PDPC focused on awareness-building rather than penalization, leading many organizations to adopt a "wait and see" posture.
The answer is now clear — enforcement is real.
The August 2025 fines signaled a decisive shift from PDPC as an "educator" to PDPC as an "enforcer." No organization is exempt — neither government agencies nor private enterprises.
Real Cases: 5 Landmark Enforcement Actions Thai Businesses Must Learn From
Case 1: Government Agency — 200,000 Records Leaked
A state-run web application suffered a cyberattack, exposing 200,000 personal data records. Both the agency and its system developer were fined a combined THB 153,120 for:
- Lack of privacy-by-design in system development
- No breach prevention or response protocols
- Failure to notify the PDPC and data subjects within the required timeframe
Lesson: Even government agencies face penalties, and Data Processors (system developers) are held accountable alongside Controllers.
Case 2: IT Retailer — THB 7 Million Fine
An IT products retailer was fined THB 7 million after customer data leaked and was exploited by fraudulent call center operations. Key failures:
- No Data Protection Officer (DPO) appointed despite processing large volumes of personal data
- Failed to report the data breach
- Inadequate security safeguards
Lesson: Failure to appoint a DPO when legally required is a severe violation carrying multi-million baht penalties.
Case 3: Cosmetics Company — THB 2.5 Million Fine
A cosmetics company was fined THB 2.5 million for failing to implement adequate security measures and not notifying the PDPC of a data breach.
Lesson: Regardless of company size, if you handle significant volumes of customer personal data, you must maintain robust security standards.
Case 4: Toy Company and Data Processor — THB 3.5 Million Combined
A toy company and its data processor were fined THB 500,000 and THB 3 million respectively after an online reservation system breach affected 200,000 records.
Notably, the Data Processor was fined more heavily than the Data Controller because:
- Failed to notify the Controller of the breach
- Did not take swift remedial action
- Lacked accountability as a data processor
Lesson: Vendors and outsourced partners acting as Data Processors bear direct legal liability under the PDPA.
Cross-Border Data Transfer Rules: Significantly Tightened
What Has Changed
In 2025, the PDPC issued several critical new regulations on cross-border data transfers:
1. Binding Corporate Rules (BCRs) Framework
The PDPC published its Regulations on the Review and Certification of BCRs (B.E. 2568) on September 29, 2025, and approved the first two companies' BCRs the following day — a landmark shift from theory to practice.
2. Legal Pathways for Data Transfers
- Adequacy Route (Section 28): Transfer data to jurisdictions recognized by the PDPC as having adequate protection — but no adequacy list has been published yet
- Appropriate Safeguards (Section 29): Use BCRs or Standard Contractual Clauses (SCCs) based on ASEAN or EU models
3. Business Impact
Since the PDPC has not yet published an adequacy list, all cross-border transfers must be treated as going to non-adequate jurisdictions, requiring appropriate safeguards in every case.
What Businesses Must Do
- Review all cloud services with servers located outside Thailand
- Create comprehensive Data Flow Mapping
- Prepare SCCs or apply for BCRs for intra-group transfers
- Audit vendor agreements for adequate data protection provisions
PDPA vs GDPR: 2026 Comparison Update
Businesses operating across borders need to understand the differences between PDPA and GDPR to plan comprehensive compliance strategies.
Key Differences
| Topic | PDPA (Thailand) | GDPR (EU) |
|---|---|---|
| Maximum Fine | THB 5 million (~EUR 130,000) per case | EUR 20 million or 4% of global revenue |
| Criminal Penalties | Yes — up to 1 year imprisonment | None at EU level |
| Consent | Implied consent allowed in some cases | Explicit consent always required |
| Right to Data Portability | In the law but lacking practical guidance | Fully enforced |
| DPO Requirement | Per PDPC conditions | Based on processing activities |
| Breach Notification | 72 hours (to PDPC) | 72 hours (to Supervisory Authority) |
| Cross-Border Transfer | Developing — no adequacy list yet | Adequacy decisions for multiple countries |
