PDPA compliance for small shops and SMEs is the same set of duties a large company carries: notice, a lawful basis, security and answering requests. Only parts of the record-keeping duty are relaxed. This guide is for shop owners and SME managers, and gives the first ten steps in order plus the real scope of the 2024 exemption.
- A shop collecting customer data to trade is not covered by the personal-use exemption in section 4(1), so the PDPA applies in full.
- The 2024 small-business notification exempts only some RoPA items, as TDPG D15–D17 summarise it. No other duty is waived.
- The exemption falls away for regular, risky or sensitive (section 26) processing, and refused requests must still be recorded.
- Delivering an order relies on the contract basis in section 24(3); promotional messages usually need separate consent.
- Access requests are due within 30 days (section 30); a risky breach must be reported to the PDPC Office within 72 hours (section 37(4)).
Many Thai shop owners assume the PDPA is for banks, hospitals and listed companies. But a shop that writes down customers' names and numbers for delivery, runs a LINE group for regulars or has a camera over the till is processing personal data.
This is not a tour of every section. It ranks the ten things a small business should do first, starting with tasks done once for the whole shop, and is candid about how much the small-business exemption actually helps.
Does a small shop really fall under the PDPA?
Yes. The personal-use exemption in section 4(1) is narrower than people think: it covers collection for personal benefit or household activity “only”.
(1) the collection, use, or disclosure of Personal Data by a Person who collects such Personal Data for personal benefit or household activity of such Person only;
The PDPC Office drew the line in a consultation from a police station about someone who posted a divorce certificate on TikTok. The opinion says the Act is aimed at people who collect, use or disclose data systematically or regularly for their own or their organisation's purposes. The consultation book has no English version, so the original Thai is quoted below.
จึงเห็นได้ว่า บทบัญญัติและเจตนารมณ์แห่งกฎหมายดังกล่าวมุ่งประสงค์จะใช้บังคับแก่บุคคลธรรมดาหรือนิติบุคคลที่มีการเก็บรวบรวม ใช้ หรือเปิดเผยข้อมูลส่วนบุคคลอย่างเป็นระบบหรือเป็นประจำสม่ำเสมอเพื่อวัตถุประสงค์อย่างใดอย่างหนึ่งขององค์กรหรือของบุคคลนั้นIn plain terms: the Act targets natural or juristic persons who process personal data in a systematic or regular way for a purpose of their own. A shop that logs delivery numbers every day or keeps a loyalty list does exactly that. A sole trader can be a data controller; there is no need to incorporate first.
What does the 2024 small-business exemption actually exempt?
Less than the rumours suggest. Its legal footing is section 39 paragraph three, which lets the Committee exempt small businesses from some items of the record of processing (RoPA). It does not touch any other PDPA duty.
The provisions in (1), (2), (3), (4), (5), (6) and (8) may not apply to the Data Controller who is a small organization pursuant to the rules as prescribed by the Committee, unless the collection, use, or disclosure of such Personal Data is likely to result in a risk to the rights and freedoms of data subjects, or not a business where the collection, use, or disclosure of the Personal Data is occasional, or involving in the collection, use, or disclosure of the Personal Data pursuant to section 26.
The notification in force is the 2024 (B.E. 2567) one, which replaced the 2022 version; dates and the repeal are covered in getting your RoPA finished. The notification itself is not yet in our verified corpus, so this section relies on TDPG 4.0 D15 to D17.
| Group | Typical small-business example |
|---|---|
| Small or medium enterprises under the SME promotion law | Retailers, service shops and small factories within the ministerial size thresholds |
| Community enterprises, social enterprises | Community food-processing groups |
| Cooperatives, farmer groups, foundations, associations, religious and non-profit organisations | A cooperative store, an alumni association |
| Condominium and housing-estate juristic persons | A small condominium juristic person |
| Household businesses | A shop run from the front of a home |
| Businesses run by a data controller who is a natural person | An unincorporated online seller |
TDPG D16 adds that an exempt business must not be one required to appoint a data protection officer under section 41(1), (2) or (3). D17 says that even within the groups above, a RoPA is still required in three situations.
D17 However, a data controller that is a small enterprise exempted above still must prepare a record of personal data processing activities, if it appears that personal data processing occurs in the following manner
“Regular” is where most shops lose the exemption. An online store taking orders with names and addresses every day, or a shop running payroll every month, will struggle to call its processing occasional. A pharmacy or small clinic holding health data is caught by the sensitive-data condition from the start.
The safer course is to keep a short RoPA anyway. TDPG D14 accepts paper or a spreadsheet. A small shop usually has only a handful of activities, so it takes little time and doubles as the map for the other nine steps.
What are the first ten steps, in order?
Ordered from groundwork done once for the whole shop to things you do when a request or incident arrives. The table is the overview; the steps people most often get wrong follow.
| # | Step | Provision | What you should end up with |
|---|---|---|---|
| 1 | List what you collect, from whom and where it lives | Sections 22, 39 | A short list of activities |
| 2 | Cut unnecessary fields from forms | Section 22 | Shorter forms |
| 3 | Publish a privacy notice | Section 23 | A sign at the till and a page or link online |
| 4 | Pick a lawful basis for each activity | Sections 24, 26 | A basis on every row |
| 5 | Ask for consent only where you need it, e.g. promotions | Section 19 | A separate tick box, easy to withdraw |
| 6 | Lock phones, accounts and notebooks | Section 37(1) | No shared passwords |
| 7 | Sign agreements with vendors who touch the data | Section 40 | Agreements with your bookkeeper, courier, web developer |
| 8 | Set retention periods and actually delete | Section 37(3) | A short retention schedule |
| 9 | Prepare for customer requests | Sections 30, 33, 39(7) | A request channel and a refusal log |
| 10 | Know what to do if data leaks | Section 37(4) | A one-page plan with contacts |
Which steps do small shops get wrong most often?
Steps 3 and 4: notice and lawful basis
A small shop does not need a ten-page notice. Section 23 lists six topics: why you collect, what you collect and for how long, who you share it with, how to contact you, and the customer's rights. A sign and a one-page link can cover them; see the privacy notice guide.
The most common misunderstanding is that you need consent every time you take a phone number. Taking a name, address and number to deliver what the customer ordered is necessary to perform the sale, and section 24(3) covers it.
(3) it is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract;
Step 5: promotions need their own consent
A number collected for delivery cannot simply be reused for promotions. Where marketing fits no other basis, consent is needed, and section 19 requires it to be explicit, separate from other terms and as easy to withdraw as to give. Existing customers and legitimate interest are covered in marketing to past customers.
A request for consent shall be explicitly made in a written statement, or via electronic means, unless it cannot be done by its nature.
Step 6: the one phone the whole shop uses
Many small shops run one phone or one LINE business account that every employee logs into with the same password. Section 37(1) requires appropriate security measures, and for a small shop “appropriate” starts simply: screen locks, separate staff accounts, a password change whenever someone leaves, and a notebook kept where customers cannot read it.
(1) provide appropriate security measures for preventing the unauthorized or unlawful loss, access to, use, alteration, correction or disclosure of Personal Data
Step 7: the bookkeeper and the courier
An outside bookkeeper running payroll, or a freelancer maintaining your web shop, usually acts as a data processor. Section 40 paragraph three requires the controller to put an agreement in place governing the processor's work. It need not be long, but it should limit how the data is used and require the processor to report a breach. A model is in our guide to processor agreements.
Step 9: a customer asks to see their data
Small shops rarely receive requests, so they rarely prepare. When one arrives, few know there is a deadline: section 30 requires access and copy requests to be met without delay and within 30 days of receipt.
When the data subject makes a request as in paragraph one, and such request cannot be rejected based on the reasons in paragraph two, the Data Controller shall fulfill the request without delay, but shall not exceed thirty days from the date of receiving such request.
Step 10: a lost phone, a hacked account
For small shops, leaks rarely come from hackers. They come from a lost shop phone, a lost notebook, or a customer list sent to the wrong group. Section 37(4) requires notice to the PDPC Office without delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to pose a risk; high-risk breaches must also be told to customers. The full sequence is in the first 72 hours of a breach.
How long does it take to do all ten?
For a shop with a handful of staff, about a month if you take it a week at a time. The plan below is our suggestion, not a legal deadline.
- Week 1List activities (step 1) and strip unnecessary fields from forms and order slips (step 2)Sections 22, 39
- Week 2Write the privacy notice (step 3), add a lawful basis to every row (step 4), separate the consent box for promotions (step 5)Sections 19, 23, 24
- Week 3Set passwords and split staff accounts (step 6); send agreements to your bookkeeper and vendors (step 7)Sections 37(1), 40
- Week 4Set retention periods and delete old data (step 8), open a request channel (step 9), write the breach plan (step 10)Sections 30, 37(3), 37(4)
Does a small shop need a DPO?
Usually not. Section 41 requires one in three cases: designated public bodies, controllers whose activities require regular monitoring because of a large volume of data as the Committee prescribes, and controllers whose core activity is processing sensitive data under section 26.
The third case matters for some small businesses, such as clinics or shops whose main work involves health data. If section 41(3) applies, you must appoint a DPO, and under TDPG D16 you also lose the RoPA exemption. The full test is in who must appoint a DPO.
Frequently asked questions
Does an unincorporated online seller need to comply?
Yes. Section 4(1) exempts only personal or household processing. Collecting customer names and addresses to sell is trade, so a sole trader can be a data controller, though they may benefit from parts of the 2024 RoPA exemption.
If we are exempt from RoPA, is there nothing else to do?
No. Section 39 paragraph three waives only some record-keeping items. Notice, lawful basis, security, answering requests and breach notification all still apply, and refused requests must still be logged.
Do customers have to sign a consent form before we note their number for delivery?
Generally no. Using data to deliver what a customer ordered is necessary to perform the contract under section 24(3). You must still give notice under section 23, and reusing the number for promotions needs a new basis, usually consent.
What about a CCTV camera over the till?
Put up a notice, set how many days you keep footage and limit who can view it. TDPG G7.4 notes that a restaurant can keep footage for a shorter time than a bank, unless an incident has been reported to the police. See the CCTV guide.
What happens if a small shop breaks the PDPA?
The PDPA provides civil liability, criminal penalties for certain sections and administrative fines. Being small does not remove liability. See the PDPA penalties guide.
Law and sources
- Personal Data Protection Act B.E. 2562 (2019) — Section 4 (1) · 19 · 22 · 23 · 24 (3) · 26 · 30 · 37 (1) (3) (4) · 39 · 40 · 41
- TDPG 4.0 (Thailand Data Protection Guidelines) — guidance, not law — Clause D14 · D15–D17
- PDPC Office: summaries of consultation answers under the PDPA
Text in the "The text" boxes is copied word for word from AIPDPA's legal knowledge base, transcribed from the Royal Gazette and official documents; every edit is checked by the system against that base, character by character. English wording is an unofficial translation; the Thai text prevails. This article is general information, not legal advice for a particular case.
Do it in the system
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)