A café with a loyalty programme, an online shop that writes down names and addresses for delivery, a clinic that keeps client histories, a shop with CCTV: all of them collect personal data, and all of them have duties under Thailand's Personal Data Protection Act B.E. 2562 (PDPA), fully in force since 1 June 2022. This guide covers what a small business has to do, with a focus on customer data.
Does the PDPA apply to a small shop?
Yes. The Act applies to every data controller: the person or company that decides how personal data is collected, used or disclosed, whatever its size. Personal data is any information about a person that identifies them, directly or indirectly (Section 6), such as a name, phone number, address, e-mail or a camera image showing a face.
The Act also applies whatever the owner's nationality, and it reaches businesses outside Thailand that offer goods or services to people in Thailand (Section 5).
Three basic rules:
- Collect only what is necessary for a lawful purpose (Section 22).
- Use and disclose data only for the purpose you stated; a new purpose needs a new notice and consent unless the law allows it (Section 21).
- Have a lawful basis: consent, or one of the exceptions in Section 24.
You do not need consent for everything
Many people believe the PDPA requires consent every time. In fact Section 24 allows collection without consent in several cases. The ones most businesses rely on:
- Necessary to perform a contract with the person, or to act on their request before a contract, such as the name, address and phone number needed to deliver an order.
- Compliance with a law, such as the details needed for tax documents.
- Necessary for the legitimate interests of the business, unless they are outweighed by the person's fundamental rights, such as keeping the premises secure.
Anything outside the exceptions needs consent, and Section 19 sets the standard:
- Ask explicitly, in writing or electronically, before or at the time of collection.
- State the purpose, keep the request clearly separate from other text, and use plain language that does not mislead.
- Do not make consent to unnecessary data a condition of selling goods or providing a service.
- The customer may withdraw consent at any time, as easily as it was given.
For a child aged 10 or under, consent must come from the parent or guardian (Section 20).
Sensitive data, such as health data, disability, religion, criminal records and biometric data like fingerprints or face scans, may not be collected without explicit consent unless one of the specific exceptions in Section 26 applies.
What a privacy notice must say
Whatever basis you rely on, you must tell people the following before or at the time of collection (Section 23):
- The purposes of collection, including where you rely on a Section 24 exception.
- Whether the customer must provide the data for a contract or by law, and what may happen if they do not.
- What data is collected and how long it is kept.
- The types of persons or organisations the data may be disclosed to.
- The name of the business and how to contact it.
- The data subject's rights.
CCTV in your shop
Camera images that identify people are personal data. A shop that installs cameras for security can rely on legitimate interests, so it does not need each customer's consent, but the duty to inform under Section 23 remains. The usual way is a clearly visible sign saying that recording takes place, why, and how to contact the shop. Cameras at home for purely personal use fall outside the PDPA under Section 4.
Customers' rights and what you must do
| The data subject's right | What the business must do |
|---|---|
| Access and obtain a copy of their data (Section 30) | Act without delay, within 30 days of receiving the request |
| Withdraw consent (Section 19) | Make withdrawal easy and tell the person what effect it has |
| Object to direct marketing (Section 32) | Stop using the data for that purpose |
| Have data erased, destroyed or anonymised (Section 33) | Do so when the conditions are met, for example the data is no longer needed for its purpose, or consent is withdrawn and no other basis remains |
| Have data corrected and kept up to date (Sections 35 and 36) | Correct it, or record the request and your reasons if you do not |
Keeping and sharing data
You must have appropriate security measures to prevent loss and unauthorised access, use, alteration or disclosure, and a system for erasing or destroying data once the retention period ends (Section 37).
When you hire someone to handle data for you, such as a membership-system or messaging provider, that provider is a data processor. It may act only on your instructions, and you must have an agreement with it that governs how it carries out its duties (Section 40).
A data breach: notify within 72 hours
If a personal data breach occurs, for example a customer list leaks, you must notify the Office of the Personal Data Protection Committee (PDPC) without delay and, where feasible, within 72 hours of becoming aware of it, unless the breach poses no risk to people's rights and freedoms. If the risk is high, you must also notify the affected people without delay, together with the remedial measures (Section 37).
The exemption for small businesses
Controllers normally have to keep records of processing, such as the data collected, the purposes and the retention periods, so that data subjects and the PDPC can check them (Section 39). A 2022 notification of the Personal Data Protection Committee exempts small businesses from this duty: small and medium-sized enterprises, community enterprises, social enterprises, cooperatives, foundations, associations and household businesses.
The exemption is narrow:
- It does not apply where the data collected poses a risk to the rights and freedoms of data subjects, or where sensitive data under Section 26 is collected.
- You must still record any refusal of a data subject's request, with your reasons.
- It covers records only. Every other duty in this guide still applies.
A data protection officer (DPO) is required where the core activity is collecting or using sensitive data, or where the business holds personal data on a large scale that needs regular monitoring, as defined by the Committee (Section 41).
Penalties
- Administrative fines: up to 1 million baht, for example for failing to give the Section 23 notice or to act on an access request (Section 82); up to 3 million baht, for example for collecting data without a lawful basis or failing to comply with Section 37 (Section 83); and up to 5 million baht where sensitive data is involved (Section 84). The expert committee may order a correction or issue a warning first, and must take the size of the business into account (Section 90).
- Civil liability: compensation to the data subject, which the court may increase by punitive damages of up to twice the actual amount (Sections 77 and 78).
- Criminal penalties for unlawfully using or disclosing sensitive data in a way likely to cause damage or embarrassment: up to 6 months' imprisonment, a fine of up to 500,000 baht, or both (Section 79).
Talk to a lawyer about the PDPA
A privacy notice, a consent form and a processor agreement should match how your business actually works. If you want a lawyer to review or draft them, you can post your case on Lawmanee for free and interested lawyers will reply in the platform chat, or search lawyers by case type, province and language.
