The Personal Data Protection Act (PDPA) is Thailand’s comprehensive data protection law, which came into full effect on June 1, 2022. The PDPA governs how organisations collect, use, disclose, and transfer personal data of individuals in Thailand.
Modelled in part on the GDPR, the PDPA establishes consent as a primary legal basis for data processing, grants data subjects rights over their personal data, requires the appointment of Data Protection Officers in certain cases, and imposes penalties for violations including fines of up to five million Thai baht and potential criminal sanctions including imprisonment. The law applies to organisations processing data of Thai residents, regardless of where the organisation is located.
The PDPA requires that consent be freely given, specific, informed, and clearly expressed. For cookie-based data collection, this means Thai websites must present consent mechanisms that allow users to make informed choices about non-essential cookies. The PDPA recognises several legal bases for processing beyond consent, including contractual necessity, legitimate interest, and vital interest.
However, for marketing and analytics cookies, consent is typically the most appropriate basis. Organisations must also provide mechanisms for users to withdraw consent at any time.
Seers’ consent management platform supports PDPA compliance through geolocation-based consent rules that present compliant consent banners to Thai visitors. The platform handles the specific consent requirements of the PDPA alongside GDPR, CCPA, and other frameworks, ensuring consistent global compliance.
Seers’ audit-ready consent records and Google Consent Mode v2 integration provide the documentation and technical infrastructure needed to demonstrate PDPA compliance.
Stay PDPA compliant while managing consent across global markets with Seers AI
START FREE TODAY