Thailand PDPA: Practical consent and privacy choices for your website

Does Thailand’s PDPA apply to your business?

The law applies to relevant controllers and processors in Thailand, including where the processing takes place elsewhere. It can also apply to organisations outside Thailand when they offer goods or services to people in Thailand or monitor their behaviour there.

There is no general revenue threshold that removes all smaller businesses from the law. Particular exemptions and obligations require their own assessment.

Section 5 of the PDPA published by Thailand’s Ministry of Digital Economy and Society sets out territorial scope. The publication includes an English translation. Start with your audience and activities, not just the address on your company registration.

What the law means for cookies

A cookie can support a requested function or collect information for analytics, personalisation or advertising. Where the resulting information identifies a person directly or indirectly, personal-data rules may apply.

Thailand’s PDPA should not be treated as a word-for-word copy of EU cookie legislation. Consent is one route, while other permitted grounds can be relevant to specific processing.

For optional behavioural advertising, a clear opt-in is a practical starting point. Keep the legal assessment tied to the actual purpose and data. Calling a tool “necessary” because it helps your marketing team does not establish legal necessity.

Five things to get right

1. Map the data and purpose

List your tools and the information each receives. Include identifiers, event data, form fields, account details and any links to customer records.

For each use, identify the relevant legal basis or statutory permission. The PDPA provides grounds beyond consent, including specified contractual, legal and legitimate-interest circumstances, but their conditions must be met.

Separate delivering the requested service from optional profiling. This makes it easier to explain choices and avoids treating one consent as permission for every later use.

2. Obtain valid consent where needed

Section 19 requires a clear, distinguishable consent request in accessible language, generally in writing or electronically. It must explain the purpose and respect a freely given choice.

Do not make unnecessary personal-data processing a routine condition of receiving a service. Avoid preselected optional settings or an unclear statement that browsing accepts everything.

Make withdrawal as easy as giving consent, and explain relevant consequences. Keep appropriate evidence of the choice and the information shown at the time. A record marked “accepted” is less useful if it cannot be connected to a specific purpose or notice.

3. Provide useful privacy information

Section 23 addresses information to provide before or at collection, including purposes, relevant data, retention, recipients, controller contact details and rights.

Turn that into a readable customer experience. Explain what happens in a short first layer and make fuller detail easy to reach. Use language appropriate for the audience, including Thai where needed for understanding.

Align the information across the banner, forms and privacy notice. If a form collects details for a booking, distinguish that purpose from optional advertising or additional marketing.

4. Apply choices to the real implementation

Keep consent-dependent tracking off until the relevant permission is given. Test a fresh visit, rejection, selected categories and later withdrawal.

Check all entry points: campaign pages, mobile layouts, embedded content and checkout. A script loaded directly by a plugin may behave differently from a tag controlled by your main consent setup.

Include server-side destinations and customer-platform exports. Moving information away from the browser does not remove the need to respect the purpose and legal basis under which it was collected.

5. Support rights and responsible data handling

The PDPA provides rights including access and copy, correction, objection, erasure, restriction and portability in applicable circumstances. Sensitive data has stricter rules, including explicit consent where the relevant exception does not apply.

Use the official PDPA text, including sections 26–37 to assess the right or category involved. Avoid promising that every request will produce the same outcome regardless of exceptions.

Review retention, security, processor arrangements and international transfers. A cookie choice does not automatically authorise every later disclosure or cross-border transfer.

A practical campaign example

A travel business offers bookings to people in Thailand and uses an advertising tool to build audiences from browsing activity. A visitor accepts the booking terms but rejects optional advertising tracking.

The booking process should use the information it is permitted to process for that service. The rejected advertising activity should remain off, including through a second integration or later audience export that relies on the refused consent.

Keep booking confirmation, cookie choices and unrelated promotional communications distinct. This helps customers understand what they agreed to and helps your team maintain accurate records.

Make ongoing reviews part of launches

Before introducing a new analytics or advertising feature, check whether it changes the purpose, data categories or recipients. Decide whether the current information and permissions still cover the activity.

Keep a simple record of the assessment and test outcome. A small, current inventory is more useful than a long policy that no longer matches the website.

Where services involve children, sensitive information or systematic monitoring, review the additional rules and any relevant officer or representative obligations. Do not assume a standard adult cookie interface answers those questions.

Website checklist

• Check scope: assess operations, offers and behavioural monitoring involving Thailand.
• Check legal bases: record a valid route for each processing purpose.
• Check consent wording: keep requests clear, separate and understandable.
• Test before consent: inspect storage and requests on a fresh visit.
• Test rejection and withdrawal: verify the relevant activity stops.
• Check notices: align purposes, retention, recipients and contact information.
• Test rights: confirm requests can reach the relevant systems.
• Review suppliers: assess security, sensitive data and overseas transfers.

FAQ