Answering data subject requests on time means matching each request to its deadline: access and copy requests within 30 days under section 30, erasure requests within 90 days under the PDPC's 2024 notification, and direct marketing objections immediately under section 32. This is for DPOs and customer-service teams, who get the deadlines and how to record every refusal under section 39.
- Access or copy: fulfil within 30 days of receiving the request (section 30 paragraph four).
- Erasure, destruction or anonymisation: within 90 days, including copies and backups (2024 erasure notification, clause 3).
- Objection to direct marketing: set the data apart immediately; it cannot be refused (section 32).
- 2026 access notification: verify the requester within 15 days; extend by up to 30 more days only with reasons.
- Any refusal must be explained to the requester and logged in the section 39 record, item (7).
Suppose that on Monday morning customer service receives three emails. One asks for a copy of everything the company holds about the sender. One asks for the account to be deleted. One says: stop sending me promotions. All three cite the PDPA, and each has a different deadline.
Many organisations apply a single deadline to every request, and that fails in two ways. Use 90 days across the board and copy requests go overdue. Use 30 days across the board and you stay within the law, but the marketing objection that needed action on day one sits for weeks. This article takes each right's deadline from the legal text and turns it into a workflow a team can run.
What is the deadline for each right?
The fastest is an objection to direct marketing, which must be acted on immediately. Next come access and copy requests, at no more than 30 days. Erasure requests have up to 90 days under a PDPC notification. For the remaining rights, the Personal Data Protection Act B.E. 2562 (2019) sets no number of days.
| Right | Section | Deadline | Source |
|---|---|---|---|
| Access and copy | 30 | Without delay, within 30 days of receipt; extendable by up to 30 more days for good reason, with notice | s.30 para. 4; 2026 access notification, clause 10 |
| Data portability | 31 | No number of days in the Act | TDPG H2 recommends 30 days |
| Objection to direct marketing | 32 (2) | Set the data apart immediately on notice | s.32 para. 2 |
| Erasure, destruction or anonymisation | 33 | Without delay, within 90 days of receipt | 2024 erasure notification, clause 3 |
| Restriction of use | 34 | No number of days in the Act | TDPG H2 recommends 30 days |
| Rectification | 35–36 | No number of days; if not corrected, log the request with reasons | s.36 |
| Withdrawal of consent | 19 para. 5 | At any time, as easy as giving consent | s.19 |
When the data subject makes a request as in paragraph one, and such request cannot be rejected based on the reasons in paragraph two, the Data Controller shall fulfill the request without delay, but shall not exceed thirty days from the date of receiving such request.
Where the Act gives no number, the TDPG 4.0 guidelines apply one window to every request. The guideline does not bind like the Act, but it works well as an internal standard and gives the team a single number to remember for almost every request.
For each step in acting on the data subject's request, you must complete all steps without delay, and no later than 30 days from receipt of the request
What did the 2026 access notification add?
The PDPC notification on criteria for access to and copies of personal data, B.E. 2569 (2026), issued under section 30 paragraph five, took effect on 15 September 2026. It applies only to access and copy requests under section 30. The points an intake team needs are these:
- Requests must be accepted in person at the controller's premises and by post; an electronic channel is optional (clause 5).
- Check the request and verify the requester within 15 days of receipt (clause 7, paragraph one).
- If the request or documents are incomplete, ask for corrections with at least 10 days to respond; the request counts as received on the date the complete version arrives (clause 7, paragraph two).
- If no correction arrives in time, the request is treated as abandoned, though the person may file again (clause 7, paragraph three).
- For large volumes or other necessity, the deadline may be extended by up to 30 days, with the reasons given to the data subject (clause 10, paragraph two).
- No fee may be charged when data is provided electronically with no media or direct delivery cost (clause 11, paragraph one).
- Keep records of requests, documents and outcomes or refusals for at least 2 years (clause 12).
The list above is a summary. For the deadlines and the record-keeping duty, here is the wording of the 2026 access notification itself (Royal Gazette, volume 143, special part 175 D), starting with the 15-day window for checking the request and the requester.
This shall be completed without delay, and in any case within fifteen days from the date the request was received.
Once the check is done, the 30-day window for providing the data still runs from the date the request was received, not from the date the check finished.
the data controller shall act on the request without delay, and in any case within thirty days from the date the request was received.
Where the request involves a large volume of data, or there is another necessary cause that prevents the data controller from acting on the request within the period under paragraph one, the data controller may extend the period for acting on the request by not more than a further thirty days from the date the period under paragraph one expires, but shall notify the data subject or the authorised representative of the necessary reasons and the related particulars that prevented it from acting on the request in time within the period under paragraph one.
All of this has to be kept so it can be checked later. Clause 12 sets the minimum period and allows electronic records.
The data controller shall record the particulars of requests and documentary evidence received under this notification, and of the data controller's action on or refusal of those requests, and shall keep those records for not less than 2 years for the purposes of examination and reference. The records may be kept in electronic form.
Erasure requests are outside this notification. They remain under the 2024 erasure notification and its 90-day limit.
How do you verify the requester without creating a barrier?
You need to be sure the person is the data subject or someone authorised to act for them. Sending a copy of someone's data to the wrong person is an unauthorised disclosure and can itself become a personal data breach. TDPG 4.0 places identity checks as the second step, right after intake.
In the case where the data subject submits the request themselves, consider the relevant documents to identify that the person is indeed the true data subject.
When someone else files, TDPG says to check their authority: a power of attorney, a parent for a child, or a custodian or curator. Clause 6 of the 2026 access notification adds that an authorised representative must attach a power of attorney with the correct duty stamps and certified copies of identity documents.
For electronic requests, the same notification lets the controller use another verification method instead of ID copies, provided it does not create an unreasonable obstacle. If the customer asks from an account they are already logged into, confirming through that account or a code sent to the registered email may be enough, without collecting yet another copy of a national ID card.
TDPG also recommends keeping a minimal trail of the verification, such as the date, time, form of request and result, as evidence in case of a later dispute. Copies of documents gathered along the way should not be kept longer than needed.
A playbook from intake to closure
Every deadline runs from the date the request is received, not the date it reaches the legal team. A request sitting for two weeks in a salesperson's inbox has already used two weeks. That is why TDPG H3 says whoever receives a request must pass it on immediately, and that the organisation needs a log of the date received, the requester and the recipient.
- Day 0Accept requests through every channel, log the date, requester and recipient, and route to the owner at once. For a direct-marketing objection, add the person to the suppression list in every system the same day.TDPG H3; s.32 para. 2
- Within 15 daysCheck completeness and verify identity. If incomplete, ask for corrections with at least 10 days to respond.2026 access notification, clause 7
- While checkingIf the data subject asks for use to be restricted while you verify accuracy or test an objection, restrict it.s.34 (1), (4)
- Within 30 daysProvide the copy or access, or refuse with reasons. If you need an extension, tell the data subject why and give the details.s.30 para. 4; 2026 notification, clause 10
- Within 90 daysDelete, destroy or anonymise across all systems, including copies and backups, then tell the data subject it is done.2024 erasure notification, clauses 3 and 8
- CloseRecord the outcome; log any refusal under section 39 (7); keep access-request records for at least 2 years.s.39 (7); 2026 notification, clause 12
How thorough does erasure have to be?
It must reach copies and backups, and the data must not be recoverable. The PDPC Notification on Criteria for the Deletion or Destruction of Personal Data, or Rendering It Non-Identifiable, B.E. 2567 (2024) sets both the time limit and the scope.
the data controller shall carry out the action requested by the data subject without delay, but in any event not later than ninety days from the date of receipt of the request.
The action under paragraph one must be carried out so as to cover personal data that has been copied or backed up as well (if any), and it must be ensured that no person is able, by any means that may reasonably be anticipated, to recover the personal data or to cause such data to become capable once again of identifying the data subject, whether directly or indirectly.
If backups cannot be purged in time for technical reasons, for example data waiting to be overwritten in a rotation cycle, clause 4 does not let you simply wait. In the meantime the data must be made hard to access or use, protected so that no one relies on it for decisions about the person, and deleted as soon as that becomes possible.
Delete or anonymise: can the company choose?
Usually, yes. Clause 3 paragraph three lets the controller use another method under the notification even if it differs from what was asked, provided the data subject is told. The key exception is data that was collected or used unlawfully under section 33 (4).
the data controller must delete or destroy the personal data only, and may not instead render the personal data into data by which the data subject cannot be identified under Clause 6.
If you do anonymise, clause 6 asks for more than removing the name. Every direct identifier must go: names, ID numbers, customer codes, phone numbers, email addresses, vehicle plates, facial images and user account names. Then the risk of re-identification from indirect identifiers such as date of birth, job title, address or IP address must be brought down to a sufficiently low level.
Where some data cannot be erased because another law requires it to be kept, such as computer traffic data, our article on 90-day logs and erasure shows how to split the record into what stays and what goes. Retention periods are covered in the retention and erasure guide.
When can you refuse, and what must you do when you do?
Only on the grounds the law provides for that particular right, and every refusal must be explained and recorded. The grounds differ from right to right, so check section by section. Access requests, the most common, come first.
The Data Controller shall perform as requested in paragraph one. The request can be rejected only where it is permitted by law or pursuant to a court order, and such access and obtaining a copy of the Personal Data would adversely affect the rights and freedoms of others.
Clause 8 of the 2026 access notification explains that harm to others includes other people's personal data, official secrets, trade secrets and other parties' intellectual property, and it asks the controller to comply as far as possible by redacting the affected parts rather than refusing the whole request.
| Right | May refuse when | What to log or tell |
|---|---|---|
| Access and copy (s.30) | Refusal permitted by law or court order, and disclosure would harm others' rights and freedoms | Log reasons in the s.39 record (s.30 para. 3) |
| Portability (s.31) | Public-interest task or legal duty, or it would violate others' rights and freedoms | Log reasons in the s.39 record (s.31 para. 3) |
| Objection (s.32) | Data on s.24 (4) or (5): compelling legitimate grounds or legal claims. Research: necessary for a public-interest task. Direct marketing: cannot be refused | Log reasons in the s.39 record (s.32 para. 3) |
| Erasure (s.33) | Retention for freedom of expression, purposes under s.24 (1) or (4) or s.26 (5) (a) or (b), legal claims, or legal compliance | Tell the data subject, with reasons (erasure notification, clause 8 para. 3) |
| Rectification (s.35–36) | The Act lists no grounds, but a decision not to correct must have reasons | Log the request and reasons in the s.39 record (s.36) |
In the case where the data controller is unable to comply with the request to exercise the right under paragraph one, the data controller shall notify the data subject who exercised the right thereof, together with the reasons.
TDPG H5 adds that a refusal should also tell the data subject about the right to complain to the regulator and to seek a judicial remedy. Grounds such as unfounded or manifestly excessive requests, listed in TDPG H20, should be used sparingly and with evidence, because they come from guidance rather than the wording of the Act.
Silence is the worst option. For erasure and restriction requests, sections 33 and 34 let the data subject complain to the expert committee, which can order the controller to act. A reasoned, recorded refusal is always safer than no answer.
The mistakes that most often blow a deadline
Section 30 paragraph four sets 30 days. The 90-day limit is for erasure only.
Section 32 paragraph two requires the data to be set apart immediately on notice. Pausing sends harms no one.
Clause 3 paragraph two of the erasure notification covers copies and backups.
Clause 7 requires deletion or destruction only in a section 33 (4) case.
Matches section 30 paragraph three and clause 8 of the access notification, which prefers redaction to refusing outright.
Request forms and sample replies are in our data subject requests guide. How to log a refusal in item (7) of the processing record is covered in our RoPA article, and if most of your requests are unsubscribes, see how to run a suppression list in our article on customer lists and cookies.
Frequently asked questions
How long do we have to answer a request for a copy of personal data?
Without delay and within 30 days of receipt under section 30 paragraph four. Clause 10 of the 2026 access notification allows up to 30 more days for large volumes or other necessity, provided the data subject is told why.
A customer asks us to delete their account. How long do we have?
Without delay and within 90 days of receipt under clause 3 of the 2024 erasure notification, including copies and backups, unless an exception in section 33 paragraph two applies, such as retention required by law.
Can we ask for a copy of a national ID card to verify identity?
For access requests, clause 6 of the 2026 notification has in-person requesters show their ID and postal requesters attach a certified copy. For electronic requests the controller may use another verification method instead, as long as it is not an unreasonable obstacle.
Can we charge a fee for handling requests?
Not for access requests fulfilled electronically with no media or direct delivery cost. Otherwise a reasonable fee not exceeding actual cost is allowed, and the rate must be disclosed before or when the right is exercised, under clause 11 of the 2026 notification.
What happens if we never respond?
For erasure and restriction requests, sections 33 and 34 let the data subject complain to the expert committee, which can order the controller to act. A reasoned refusal recorded under section 39 is always better than silence.
Law and sources
- Personal Data Protection Act B.E. 2562 (2019) — Section 19 · Section 30–36 · Section 39 (7)
- PDPC Notification on Criteria for the Deletion or Destruction of Personal Data, or Rendering It Non-Identifiable, B.E. 2567 (2024) — Clause 3 · Clause 4 · Clause 6 · Clause 7 · Clause 8
- PDPC Notification on criteria for access to and copies of personal data B.E. 2569 (2026), Royal Gazette vol. 143, special part 175 D — Clause 5 · Clause 6 · Clause 7 · Clause 8 · Clause 10 · Clause 11 · Clause 12
- TDPG 4.0 (Thailand Data Protection Guidelines) — guidance, not law — H2–H5 · H20
Text in the "The text" boxes is copied word for word from AIPDPA's legal knowledge base, transcribed from the Royal Gazette and official documents; every edit is checked by the system against that base, character by character. English wording is an unofficial translation; the Thai text prevails. This article is general information, not legal advice for a particular case.
Do it in the system
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)