Thailand PDPA: Enforcement Trajectory and Compliance Cost

Questions this report answers

What changed in 2025? Per DLA Piper, Mondaq, and Lexology: PDPC publicly announced 8 administrative fines across 5 non-compliance cases on 1 August 2025 — the first major public-enforcement batch since PDPA full enforcement in June 2022. Total fines exceeded THB 21.5M🔒. The largest single fine was THB 7M🔒 for a customer-data leak that was subsequently exploited in call-centre scams. The structural signal: PDPC moved decisively from awareness-building to active enforcement, transitioning the regulatory tone from compliance-coaching to compliance-enforcement.^{[1, 8, 5]}

What's the penalty structure? Per the Personal Data Protection Act B.E. 2562 (2019) and Chambers practice guides: civil fines up to THB 5M🔒 for serious violations is the headline ceiling. Sensitive-data violations carry imprisonment up to 6 months and / or fine up to THB 500K🔒, doubled if undertaken for undue commercial benefit (12 months / THB 1M🔒). The Aug 2025 fines exceeded the THB 5M🔒 ceiling in the leak case — likely combining penalties for multiple violations or entities under the controller-and-processor extension.^{[4, 9]}

Does PDPA reach data processors as well as controllers? Yes — and the August 2025 toy-seller case made this explicit. Per Lexology and AustChamThailand: a collectible-toy seller (data controller) was fined THB 500K🔒 and its data processor was fined THB 3M🔒 for failing to implement appropriate security measures. The structural implication for Thai outsourcing vendors and SaaS providers is significant: PDPA-compliance is no longer just the customer's problem; the processor faces direct exposure. This brings Thai data-protection enforcement closer to GDPR's controller-and-processor co-liability framework.^{[5, 6]}

What are the most-common compliance failures? Per Hogan Lovells and DLA Piper: (1) inadequate security measures — weak passwords, no risk assessment, poor system oversight; (2) failure to appoint a Data Protection Officer (DPO) when required by sector or processing-volume threshold; (3) failure to notify PDPC and affected individuals of data breaches within the statutory timeframe; (4) poor handling and destruction of sensitive data. These four categories accounted for the majority of August 2025 fines. The compliance-cost implication is that PDPA programmes need budget for technical security, DPO hiring, breach-response process, and sensitive-data lifecycle management.^{[7, 1]}

Executive summary

Thailand's PDPA enforcement is now live. After multiple deferrals between 2019 and 2022, the Personal Data Protection Act B.E. 2562 reached full enforcement on 1 June 2022. The Personal Data Protection Committee (PDPC) operating under the Ministry of Digital Economy and Society spent 2022-2024 in awareness-building mode; 2025 marks the structural shift to active enforcement. Per HSF Kramer's six-year enforcement timeline, the August 1 2025 PDPC announcement — 8 administrative fines across 5 cases totalling over THB 21.5M🔒 — is the inflection point. Foreign and Thai businesses operating in Thailand should now treat PDPA compliance with the same operational seriousness as GDPR.^{[3, 1]}

Penalty structure: civil fines up to THB 5M🔒 for serious violations; sensitive-data violations carry imprisonment up to 6 months and THB 500K🔒 fines (doubled for undue commercial benefit). The August 2025 THB 7M🔒 fine for the customer-data leak case (which was subsequently exploited in call-centre scams) demonstrates PDPC's willingness to combine penalties or apply per-entity fines that exceed individual ceilings. Enforcement reaches data processors, not just controllers — the toy-seller case (controller THB 500K🔒, processor THB 3M🔒) confirmed this explicitly per Lexology, with structural implications for Thai SaaS vendors, outsourcing providers, and any entity processing personal data on behalf of controllers.^{[5, 4]}

Common compliance failures across the August 2025 enforcement batch: inadequate security measures (weak passwords, no risk assessment, poor oversight), failure to appoint Data Protection Officers, failure to meet breach-notification timeframes, and poor sensitive-data handling. The compliance-budget implication for Thai operators is structural: PDPA programmes require investment in technical security, DPO hiring or outsourcing, breach-response capability, and sensitive-data lifecycle management. For foreign operators, the practical posture should align with global GDPR-compliant infrastructure where feasible, plus Thai-specific elements (Thai-language privacy notices, PDPC-recognised legal bases for processing, local DPO presence where required).^{[1, 7]}

PDPA penalty structure and August 2025 enforcement