How to Write a Privacy Notice People Actually Read

Open the websites of ten Thai companies and you will find almost the same privacy notice on each: several pages long, full of "may" and "including but not limited to", copied from one template to the next until nobody can tell what the company actually collects.

A notice like that helps no one. Customers do not read it, and the company ties itself to vague purposes it cannot show it really pursues. This article uses the text of Section 23, a PDPC advisory opinion and examples from TDPG 4.0 to show what a notice that is both lawful and actually read looks like.

What must a Thai privacy notice contain?

Section 23 of the Personal Data Protection Act requires six items, and it also sets the timing: before or at the time of collection, not afterwards once the form is submitted. The only exception in the opening paragraph is where the data subject already knows the details.

The six items are: (1) the purpose, including purposes Section 24 allows without consent; (2) where data must be provided under law or contract, and the effect of not providing it; (3) the data collected and how long it is kept; (4) the categories of people or bodies who may receive it; (5) the controller's contact details, and those of its representative or DPO; (6) the data subject's rights.

Item (3), retention, is where companies slip most often. Many write "kept for as long as necessary", which says nothing. The statute already gives a way out: if you cannot fix a period, state the period that can reasonably be expected.

Does it have to be a long document on the website?

No. The PDPC said so plainly in an opinion for the Marine Department, which was drafting its own notice and wanted to know whether it had to be a formal announcement signed by the Director-General and published in the Royal Gazette.

The PDPC added that notice may be given individually or generally, and may be signed or not. Whether a state agency must publish its notice in the Royal Gazette is a question for the Official Information Commission, so the PDPC declined to answer it.

The most useful line in the opinion is where the PDPC explains what a privacy notice is in legal terms.

What kind of writing gets read to the end?

Chapter E of TDPG 4.0 lists the features of a good notice in detail. TDPG is an industry guideline widely used in Thailand, not law, and it does not bind like the Act. It is still a sound benchmark.

The gist: short sentences and paragraphs, clear headings, no needless jargon or officialese, and no information overload. The point that lands hardest is the warning against vague wording, illustrated with a sentence found in nearly every template.

Instead of "may be transferred", say where the data goes and why. If you use an overseas cloud, write for example that member data is stored on your cloud provider's servers in Singapore. Precision also protects the company, because Section 21 holds it to the purposes it notified.

Where and when should notice appear so people see it?

TDPG 4.0 recommends giving notice through the same channel you collect through: a short line on an online form, a sign at a shop counter, then a route to the full version. TDPG calls this a layered approach combined with just-in-time notice.

TDPG gives another example you can use immediately. An organisation placed its notice on the homepage, but testing with real customers showed that many arrived from search engines straight onto other pages and never saw the homepage. The fix was a notice link on every page that collects data.

Example: a café loyalty scheme using phone numbers

Picture this: a small café lets customers scan a QR code at the counter to join a points scheme with their phone number. A palm-sized standee can serve as the first layer of the notice, and the web page behind the QR code as the second. The Marine Department opinion and TDPG's examples both accept notice through a URL or QR code, as long as the substance covers Section 23.

1. Before scanning
   The counter sign says briefly who the café is, that it collects phone numbers for points, that joining is optional, and that the full notice is behind the QR codes.23 (1) (2) (5)
2. While entering the number
   One line under the field says what the number is used for and how long it is kept, with a link to the full notices.23 (3)
3. Full notice page
   Headings follow the six items, name the membership-system provider the café hires, and explain how to make a rights requests.23 (4) (6)
4. The café wants to send promotions on LINE
   A new purpose: notify before starting, and obtain consent if no other basis appliess.21
5. Each anniversary
   Review whether the notice still matches what the café really does (TDPG E7 guidance)TDPG E7

If the café moves on to cookies or chat promotions, the questions shift to consent and marketing. See Do you need consent every time you market to past customers?

Once written, when must it be revised?

A good notice today becomes a wrong one the day the business changes how it works without updating it. TDPG 4.0 recommends a review at least once a year, and straight away after any significant change.

TDPG also recommends testing with real users: ask a handful of customers to find the notice and read it, then ask what confused them. It is cheaper and more revealing than another round of review inside the legal team.

For data not collected from the customer directly, such as a list received from a partner, Section 25 adds rules. Where consent is required, the data subject must be notified within 30 days of collection, and if the data will be disclosed onward, before the first disclosure.

Common mistakes, and the rule each one breaks

Who stands behind this guide?

Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel

Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)