Posting about someone online is a PDPA offence far less often than Thai social media claims, according to eight PDPC answers given to police stations. In six of them the regulator said an individual who posts for personal benefit, not systematically or regularly, falls outside the Act under Section 4(1) but may still be liable under other laws. Posters, people posted about, page admins and shops get a comparison table and a pre-posting decision table.
- A photo, a name on a divorce certificate and an ID card copy are all personal data, but that alone does not make the poster liable under the PDPA.
- An individual who posts for personal benefit, not systematically or regularly, is outside the PDPA under Section 4(1).
- Outside the PDPA, the poster may still face the Computer Crime Act, defamation or tort, as the PDPC noted in all six opinions.
- The Section 79 offence needs a data controller and Section 26 data such as health or criminal records: up to 6 months in prison.
- Shops, pages and companies posting customer data for business purposes can rarely rely on the personal-use exemption.
The most widely shared claim about Thailand's Personal Data Protection Act (PDPA) is that posting someone's photo without consent is illegal and can send you to prison. So when a photo, a chat or a document is posted to shame someone, the PDPA is often the first charge that person asks the police to bring.
Investigators and public prosecutors wanted certainty too. Eight police stations wrote to the Office of the Personal Data Protection Committee (the PDPC Office) for its view. The answers appear in the Office's published book of consultation summaries, with station and party names replaced by letters.
This article puts all eight in one table, then separates what the PDPC used as its test from what it did not, what the PDPA's criminal offences actually require, and where shops and page admins stand. Statute text is quoted from the Act; the opinions exist in Thai only, so they are quoted in Thai and explained in English.
What did the eight police stations ask, and what did the PDPC answer?
Six cases involve an individual posting on Facebook or TikTok. Two are different: one is a television news programme and one is an announcement by a local administrative body. Those two show how the media exemption works and what the PDPA's criminal offences need.
| Station | What was published, and where | What the police asked | PDPC answer | Main reason |
|---|---|---|---|---|
| Police Station F | A photo of the complainant with text exposing them to contempt and hatred, on Facebook | Whether the globe and people icons mean the post is public or limited, and whether the poster is a data controller | The police must consider whether it was done for personal benefit; if so, it is outside the PDPA | Section 4(1). The visibility question is not directly a PDPA matter |
| Police Station D | An image of a divorce certificate showing the complainant's name and surname, on TikTok | Is it personal data, which section is breached, can the complainant go to the Committee, is it sensitive data | The name on the certificate is personal data; then the same test as Station F | Sections 6 and 4(1) |
| Police Station E | A person's photo obtained from a data controller without legal authority, posted on Facebook with defamatory text | Whether such a case is governed by the PDPA | The same test | Section 4(1). The source of the photo did not change the test |
| Police Station G | A profile photo of the complainant and family, copied and posted publicly to shame them over an unpaid debt | Is it an offence under Section 27, and can an individual be a data controller | The same test | Section 4(1) |
| Police Station H | Photos of work, comments and a copy of a home-extension contractor's ID card, on public Facebook | Whether the homeowner who posted is a data controller who committed a PDPA offence | The ID card copy is personal data; then the same test | Section 4(1), even though the copy was obtained when the contract was signed |
| Police Station J | Documents identifying the complainant and an allegation that they broke the law, on public Facebook | Is it an offence under Section 27 | The same test | Section 4(1), even though the complainant described it as criminal-record data |
| Provincial Police Station Kor | A television news programme showed the complainant's face with a caption meaning "perpetrator" before any court judgment | Whether the news agency is protected by Section 4 | It may be exempt under Section 4(3), but professional ethics or public interest must be considered first | The media exemption is conditional; the station should consult the professional body the broadcaster belongs to |
| Provincial Police Station Khor | An announcement by a provincial administrative organisation on officials leaving service, which the complainant saw as public shaming | Whether issuing the announcement is a PDPA offence | Only conduct meeting the elements of Sections 79, 80 and 81 is criminal; that is for investigators and prosecutors, and the complainant may complain under Section 73 | Chapter 7 Part 1 and Chapter 5 of the PDPA |
Two things stand out. First, in four of the eight cases (Stations F, E, H and Provincial Station Khor) the question began with a letter from the public prosecutor to the investigator before it reached the PDPC. Second, the content posted varies widely, from an ordinary photo to an ID card copy, yet the first six opinions use almost identical wording.
The consultations themselves explain why the question was asked. Police Station J wrote that the definition of data controller was being read in different ways.
แต่เนื่องจากพระราชบัญญัติคุ้มครองข้อมูลส่วนบุคคล พ.ศ. ๒๕๖๒ เป็นกฎหมายใหม่ ซึ่งคำนิยาม “ผู้ควบคุมข้อมูลส่วนบุคคล” ตามพระราชบัญญัติดังกล่าว นักกฎหมายรวมทั้งพนักงานสอบสวนต่างก็ตีความและมีความเห็นต่างกันA photo, a divorce certificate, an ID card copy: personal data, so why no PDPA offence?
Because the PDPA asks more than whether something is personal data. It asks who is using the data and in what capacity. In every case the PDPC answered the first question with yes: an image or text that identifies a person directly or indirectly is personal data under Section 6, including the name on a divorce certificate and a copy of a national ID card.
The opinions then turn to Section 5, paragraph one, under which the Act applies to collection, use or disclosure by a data controller or data processor. The deciding question is therefore whether the person who posted is a data controller.
“Data Controller” means a Person or a juristic person having the power and duties to make decisions regarding the collection, use, or disclosure of the Personal Data;
Read literally, anyone who decides to post could be a controller. The PDPC did not read it that way. It listed the duties the Act places on controllers: a lawful basis under Section 24 or 26, notice under Section 23, security and breach notification under Section 37, responding to rights requests under Sections 30 to 36, and appointing a data protection officer under Section 41.
Those duties are built for people and organisations that handle data as a routine. The PDPC concluded that the Act is aimed at those who collect, use or disclose personal data systematically or regularly for a purpose of the organisation or of that person, and read this together with the exemption in Section 4(1).
(1) the collection, use, or disclosure of Personal Data by a Person who collects such Personal Data for personal benefit or household activity of such Person only;
When is an individual who posts about someone outside the PDPA?
When the post is for personal benefit and the person is not collecting, using or disclosing data systematically or regularly as a data controller. The passage below appears in all six opinions; only the station's name changes.
หากพิจารณาแล้วเห็นว่า การกระทำของผู้ต้องหาดังกล่าวมีวัตถุประสงค์ในการดำเนินการเพื่อประโยชน์ส่วนตน โดยไม่มีลักษณะเป็นการเก็บรวบรวม ใช้ หรือเปิดเผยข้อมูลส่วนบุคคลอย่างเป็นระบบหรือเป็นประจำสม่ำเสมอเพื่อวัตถุประสงค์อย่างใดอย่างหนึ่งของบุคคลนั้นในฐานะผู้ควบคุมข้อมูลส่วนบุคคล ย่อมไม่อยู่ในขอบเขตการบังคับใช้ของพระราชบัญญัติคุ้มครองข้อมูลส่วนบุคคล พ.ศ. ๒๕๖๒ ตามมาตรา ๔ (๑)What the PDPC used as a test, and what it did not
| Fact | Did the PDPC use it to decide PDPA scope? | Seen in |
|---|---|---|
| Posted for personal benefit or household activity | Yes. It is the first question for the police | All six |
| Systematic or regular processing for one's own purpose | Yes. If present, the poster acts as a data controller | All six |
| Post set to public or to a limited audience | No. The PDPC said this is not directly about enforcing the PDPA | Station F, and the public posts in Stations G, H and J |
| Type of content: photo, divorce certificate, ID card copy | Not at this stage. Every type received the same test | Stations D, H and J |
| How the data was obtained: copied from a profile, received under a contract, or received from another controller | Not at this stage | Stations G, H and E |
| The data subject did not consent | Not at this stage. Consent is a controller's duty, so the person must first be a controller | All six |
Visibility settings are the point people ask about most. Police Station F asked directly whether Facebook's globe and people icons meant the post could be seen by everyone or by a group. The PDPC's reply was brief.
ไม่ใช่กรณีที่เกี่ยวกับการบังคับใช้พระราชบัญญัติคุ้มครองข้อมูลส่วนบุคคล พ.ศ. ๒๕๖๒ โดยตรง พนักงานสอบสวนจึงควรพิจารณาดำเนินการต่อไปตามข้อเท็จจริงที่เกี่ยวข้องWhether a post is public therefore does not switch the PDPA on or off. How much it matters under other laws is not answered; the opinion leaves that to the investigator.
Outside the PDPA, can the poster still break other laws?
Yes, and the PDPC says so at the end of every opinion. Section 4(1) only answers whether the PDPA applies to the act. It does not certify that the act is lawful.
หากการกระทำของผู้ต้องหามีลักษณะเป็นการละเมิดสิทธิในความเป็นส่วนตัวของบุคคลอื่นเกินสมควร หรือเข้าองค์ประกอบความผิดตามกฎหมายอื่นใด ผู้กระทำอาจมีความรับผิดตามกฎหมายเหล่านั้นได้ เช่น พระราชบัญญัติว่าด้วยการกระทำความผิดเกี่ยวกับคอมพิวเตอร์ พ.ศ. ๒๕๕๐ และที่แก้ไขเพิ่มเติม หรือประมวลกฎหมายอาญาในความผิดฐานหมิ่นประมาทหรือหมิ่นประมาทโดยการโฆษณา หรือการทำละเมิดตามมาตรา ๔๒๐ แห่งประมวลกฎหมายแพ่งและพาณิชย์The PDPC names three routes: the Computer Crime Act, the Criminal Code offences of defamation and defamation by publication, and tort under Section 420 of the Civil and Commercial Code. The list of legal provisions attached to each consultation also cites Sections 326 and 328 of the Criminal Code.
The text of those three laws is not in the corpus this article draws on, so their elements and penalties are not explained here. What readers should take away is that a file opened on a PDPA charge can continue on another charge if the facts fit. A poster should not read Section 4(1) and conclude they are safe.
Which posts can attract a criminal penalty under the PDPA?
A much narrower set than most people think. The fullest answer is in the consultation from Provincial Police Station Khor. The PDPC explained that a data controller has many duties, but breaching a duty is not always a crime.
จะมีความผิดอาญาเฉพาะเรื่องที่มีลักษณะตามความในหมวด ๗ ส่วนที่ ๑ แห่งพระราชบัญญัติคุ้มครองข้อมูลส่วนบุคคล พ.ศ. ๒๕๖๒ โดยจะต้องมีองค์ประกอบความผิดตามความในมาตรา ๗๙ มาตรา ๘๐ และมาตรา ๘๑ แล้วแต่กรณี| Section | Who | Data | Further element | Penalty |
|---|---|---|---|---|
| 79, paragraph one | A data controller | Section 26 data only | Breach of Section 27 paragraph one or two, or of Section 28, in a manner likely to cause damage, loss of reputation, contempt, hatred or humiliation | Up to 6 months in prison, a fine of up to 500,000 baht, or both |
| 79, paragraph two | A data controller | Section 26 data only | The same breach, done to obtain an unlawful benefit | Up to 1 year in prison, a fine of up to 1,000,000 baht, or both |
| 80 | A person who learns the data through performing duties under the Act | Another person's personal data | Disclosing it to someone else, outside the five exceptions in paragraph two | Up to 6 months in prison, a fine of up to 500,000 baht, or both |
| 81 | A director, manager or person responsible for the juristic person's operations | As for the juristic person's offence | Ordering or doing the act, or failing to act when under a duty, so that the juristic person offends | The punishment prescribed for that offence |
Any Data Controller who violates the provisions under section 27 paragraph one or paragraph two, or fails to comply with section 28, which relates to the Personal Data under section 26 in a manner that is likely to cause other person to suffer any damage, impair his or her reputation, or expose such other person to be scorned, hated, or humiliated, shall be punished with imprisonment for a term not exceeding six months, a fine not exceeding Baht five hundred thousand, or both.
Section 79 therefore needs three things together: the actor is a data controller, the data is Section 26 data, and the disclosure breaches Section 27 or 28. Section 26 data covers race, ethnic origin, political opinions, cult, religious or philosophical beliefs, sexual behaviour, criminal records, health data, disability, trade union information, genetic data and biometric data.
The Provincial Station Khor opinion also records that, when it was written, the Committee had not yet added any further category to that list. An ordinary photo, a name and surname or an ID card copy are not named in Section 26, and none of the six opinions treats them as Section 26 data.
Police Station J is the only case in which the complainant described the posted material as criminal-record data, which is on the Section 26 list. Even so, the PDPC asked first whether the poster was acting as a data controller. The order of reasoning is the actor first, then the type of data.
Beyond criminal penalties, the PDPC told Provincial Station Khor that administrative fines exist and that the injured person may complain to the expert committee under Section 73. The result can be used in the criminal case.
พนักงานสอบสวนและพนักงานอัยการสามารถนำข้อสรุปและความเห็นของคณะกรรมการผู้เชี่ยวชาญไปพิจารณาประกอบการดำเนินการในคดีอาญาได้ต่อไปHow far does the media exemption protect news outlets and news pages?
Only as far as the conditions in Section 4(3) are met. The Provincial Station Kor consultation concerned a news programme that reported the complainant had cheated on a food bill, showed their face unblurred and labelled them the perpetrator, before any court judgment.
(3) a Person or a juristic person who uses or discloses Personal Data that is collected only for the activities of mass media, fine arts, or literature, which are only in accordance with professional ethics or for public interest;
The PDPC accepted that the news agency was using data collected only for mass media activities, so the disclosure "may" be of an exempt kind. It did not stop there.
แต่สถานีตำรวจภูธร ก. จะต้องพิจารณาเพิ่มเติมด้วยว่า การนำเสนอหรือเผยแพร่ข่าวสารดังกล่าวเป็นไปตามจริยธรรมแห่งการประกอบวิชาชีพหรือเป็นประโยชน์สาธารณะหรือไม่The PDPC advised the station to seek a view on ethics from the professional body the broadcaster belongs to under broadcasting law. For media workers, the exemption depends on whether the coverage follows professional ethics or serves the public interest, not on calling oneself media.
That consultation concerned a television broadcaster with a professional body above it. It does not say whether a social media news page, a video creator or a citizen reporter counts as mass media under Section 4(3). A page admin should not assume the exemption applies automatically.
Can shops, page admins and companies rely on the personal-benefit exemption?
Rarely, where the post is part of the business. The reason lies in two phrases. Section 4(1) exempts collection for personal benefit or household activity "only". And the PDPC describes the Act as aimed at those who process data systematically or regularly for a purpose of the organisation or of that person.
A shop that records customers' names, addresses, phone numbers and payment slips every day already collects data regularly for trade. When it takes that same data and posts it, it is using data it holds as a data controller. For a shop's basic duties, see the first 10 PDPA tasks for small shops and SMEs.
The examples below are hypothetical. They are the AIPDPA team's analysis of the words of the opinions and the Act, not PDPC rulings, and none of the eight consultations involved a shop as the poster.
If done for personal benefit and not regularly, it is outside the PDPA under Section 4(1). Attaching the builder's ID card copy adds risk under the other laws the PDPC names.
The data was collected to sell and deliver. Posting as a shop routine is regular processing for a business purpose. The shop needs a Section 24 basis or consent and risks an administrative fine under Section 83.
The page collects many people's data and discloses it regularly for the page's own purpose, which matches the PDPC's description of a data controller. An admin who is an individual can still be a controller.
The clinic is a data controller. Images revealing treatment are health data under Section 26. Disclosure in breach of Section 27 that is likely to humiliate the patient meets Section 79, paragraph one.
Section 73 lets a data subject complain where an employee or service provider of the controller breaches the Act. The shop should have internal rules on taking customer data out of its systems.
The opinions stress that where no other basis exists, the controller must obtain consent under Sections 19 and 20. Keep the proof, and remove the post if the customer withdraws consent.
Once you are a data controller, what does an unlawful post cost?
| Route | Section | Content |
|---|---|---|
| Civil | 77 | Compensation to the data subject whether or not the act was intentional or negligent, unless the controller proves an exception in (1) or (2) |
| Civil | 78 | The court may add punitive damages of up to twice the actual compensation. Prescription: 3 years from knowing the damage and the liable party, or 10 years from the wrongful act |
| Administrative | 83 | Breach of Section 27 paragraph one or two: administrative fine of up to 3,000,000 baht |
| Administrative | 84 | Breach of Section 27 concerning Section 26 data: administrative fine of up to 5,000,000 baht |
| Criminal | 79 | Section 26 data only: up to 6 months or 1 year in prison depending on the paragraph, as in the earlier table |
| Criminal | 81 | A director or manager who ordered, did or omitted the act is punished as well |
In the case where the offender who commits the offense under this Act is a juristic person and the offense is conducted as a result of the instructions given by or the act of any director, manager or person, who shall be responsible for such act of the juristic person, or in the case where such person has a duty to instruct or perform any act, but omits to instruct or perform such act until the juristic person commits such offense, such person shall also be punished with the punishment as prescribed for such offense.
For a company, the table means one post by an admin can bring three kinds of liability at once. If Section 26 data is involved, the person answering the investigator's questions may be the director or manager who approved the post or let it happen. For the full penalty picture, see PDPA penalties.
What should you do before posting, and if you are posted about?
The first table is for someone about to post. The right-hand column is the AIPDPA team's suggestion, not a legal duty, unless a section is cited.
| Who you are and what you plan to post | Does the PDPA apply, on the opinions' approach? | What to do |
|---|---|---|
| An individual posting once about a private matter: a builder review, a debt, a family dispute | If for personal benefit and not regular, outside the PDPA under Section 4(1) | Other laws named by the PDPC still apply. State facts only; do not attach the other person's ID card copy, divorce certificate or family photos |
| An individual posting repeatedly about the same person or several people | May amount to regular processing; the police assess the facts | Do not assume Section 4(1) covers you. Stop the repeat posts and consult a lawyer |
| A shop, business page or company posting data about customers, staff or suppliers | Use of data for a business purpose: within the PDPA | You need a Section 24 basis or consent under Section 19. Without one, do not post identifying data |
| A data controller about to post health data, criminal records or other Section 26 data | Within the PDPA, with Section 79 criminal risk | You need explicit consent or a Section 26 exception. If unsure, do not post |
| A news agency or programme producer | May be exempt under Section 4(3) if in line with professional ethics or in the public interest | Check your professional body's ethics standard before showing a face or naming a person |
| A news or community page with no professional body above it | Not answered by the consultations | Assume you may be a data controller. Blur faces and remove names where the story does not need them |
If you are the person posted about
Start by working out who posted. The PDPA's own channels open only where the other side is a data controller or data processor.
The data subject has the right to file a complaint in the event that the Data Controller or the Data Processor, including the employees or the service providers of the Data Controller or the Data Processor violates or does not comply with this Act, or notifications issued in accordance with this Act.
- Save the evidence before the post disappears. Screenshots showing the account name, date and time, the post's link and the share count. (A suggestion, not a legal rule.)
- Identify the poster. An individual with a private dispute with you, or a shop, company, page or agency that obtained your data through its work?
- If it is a shop, company or organisation, you may complain to the expert committee under Section 73. Under Section 74 the committee may order the controller to correct its conduct or to stop an act causing damage, and you may claim compensation under Section 77.
- If the data posted is Section 26 data and the poster is a data controller, you may also file a criminal complaint under Section 79. The offence is compoundable, and the time limit for such complaints sits in another law, so see a lawyer quickly.
- If it is an individual posting about a private matter, a PDPA charge may not hold, going by the six opinions. Give the investigator all the facts so that charges under the other laws the PDPC names can be considered.
- Point out facts showing regular conduct: posts about many people, a long series of posts, or posting in the name of a page or business. Those are the facts the PDPC told the police to weigh when deciding whether the poster is a data controller.
What do the eight consultations leave unanswered?
All eight opinions come from the ad hoc sub-committee that answers queries within the Personal Data Protection Committee. They are views given to the body that asked. They are not court judgments or orders of the expert committee, so it matters where each answer stops.
- How many posts make conduct "regular". The opinions give no number and no example; investigators assess each case on its facts.
- The outcome of each case. The summaries do not say what the investigator, prosecutor or court finally decided, so no poster in these cases can be described as guilty or not guilty.
- Some of Station D's questions. Whether a divorce certificate is sensitive data, and whether the complainant could complain to the Committee, receive no separate answer in the published summary.
- The original controller's liability. In the Station E case the photo came from a data controller. The opinion addresses only the poster, not the duties of whoever let the photo out.
- Pages and online creators. Whether they count as mass media under Section 4(3) is not answered in these eight.
- The elements of the other laws. The PDPC names the laws but does not say any case meets them. That is for investigators, prosecutors and the courts.
After reading all eight, a more accurate sentence than the one shared online is this: posting about someone can break several laws, and whether it breaks the PDPA depends on whether the poster is acting as a data controller. A private individual posting about a personal matter usually is not. A shop, a page or a company usually is.
For other PDPC answers, read The PDPC Has Answered: 8 Real PDPA Questions. If you are on the company side and have received a letter from an investigator, read Police Want Customer Data: What a Thai Company May Hand Over.
Frequently asked questions
Is posting someone's photo on Facebook without consent a PDPA offence?
If the poster is an individual acting for personal benefit, without systematic or regular collection or disclosure, the PDPC's view is that the act is outside the PDPA under Section 4(1). The poster may still be liable under other laws such as the Computer Crime Act, defamation or tort.
Can posting someone's ID card copy or divorce certificate lead to prison under the PDPA?
Imprisonment under Section 79 applies to a data controller who discloses Section 26 data. In the Station D and Station H consultations the PDPC first asked whether the poster acted for personal benefit; if so, the PDPA does not apply. Liability under other laws is a separate question.
Does setting a post to friends-only avoid the PDPA?
It is not the PDPA test. In the Station F consultation the PDPC said the question of whether a post is visible to everyone or to a group does not directly concern enforcement of the PDPA. The test is purpose and whether processing is systematic or regular.
Can a shop that shames a non-paying customer online call it a personal matter?
Rarely. Section 4(1) covers personal benefit or household activity only. A shop collects customer data regularly for trade, which fits the PDPC's description of a data controller. This is analysis of the wording; no consultation has yet answered a shop case directly.
A page or company posted my data. Where can I complain?
If the poster is a data controller, you may complain to the expert committee through the PDPC Office under Section 73 and claim compensation under Section 77. If the data is Section 26 data, a criminal complaint under Section 79 is also available.
Is a news outlet that shows an accused person's face always exempt from the PDPA?
No. In the Provincial Station Kor consultation the PDPC said the outlet may be exempt under Section 4(3), but it must be considered whether the coverage followed professional ethics or served the public interest, ideally with a view from the outlet's professional body.
You have read it. Now get it done
Open the demo account to see the real AIPDPA system with a sample company: RoPA, the 72-hour breach clock, data subject requests, cookie consent and ready-to-use documents, all in one place.
From 2,900 THB/year (11 modules) · all 24 modules from ENTERPRISE at 19,900 THB/year · demo account, no sign-up
No time? Have our lawyers handle it →Kooru's lawyers set it up and act as your DPO
Law and sources
- Summaries of PDPC advisory opinions under the Personal Data Protection Act B.E. 2562 (Office of the Personal Data Protection Committee) — D · E · G · H · J
- Personal Data Protection Act B.E. 2562 (2019) — Section 4 (1) (3) · 5 · 6 · 26 · 27 · 73 · 74 · 77 · 78 · 79 · 80 · 81 · 83 · 84
Text in the "The text" boxes is copied word for word from AIPDPA's legal knowledge base, transcribed from the Royal Gazette and official documents; every edit is checked by the system against that base, character by character. English wording is an unofficial translation; the Thai text prevails. This article is general information, not legal advice for a particular case.
Do it in the system
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)