Thailand: Privacy

Thailand's data protection regulator has published draft guidance on lawful bases for processing personal data and marketing practices under the PDPA. The guidance introduces a five-step process for selecting lawful bases, emphasizes separating marketing consent from core services, and addresses AI-driven marketing transparency. Organizations processing personal data in Thailand face new expectations around accountability, consent management, and documentation of compliance efforts.

On June 18, 2026, Thailand’s Office of the Personal Data Protection Committee (PDPC) published two notifications in the Government Gazette establishing Thailand’s first formal certification framework for personal data...

Much of the discussion around artificial intelligence ("AI") regulation in Thailand focuses on future legislation. Less attention is paid to the obligations that already exist. For businesses deploying AI systems, Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA") is already engaged and, in practice, any system involving personal data falls within its scope