A company that must appoint a DPO is one that falls within section 41 of Thailand's PDPA, which applies in only three situations: a public authority, core activities requiring regular monitoring of large-scale data, or core activities involving sensitive data. The PDPC's 2023 notification treats 100,000 or more data subjects as large scale. This is for business owners and legal teams who want to check whether they must appoint one.
- Section 41 requires a DPO in three cases: listed public authorities, large-scale regular monitoring, and core activities built on sensitive data.
- The large-scale case has two tests that must both be met: regular monitoring of people (Clause 5) and large-scale data (Clause 6).
- 100,000 or more data subjects in a core activity is large scale by definition under Clause 6, paragraph two (1), of the 2023 notification.
- Internal HR and IT work is supporting activity, so a big workforce alone does not trigger the duty.
- Failing to designate a required DPO carries an administrative fine of up to 1 million baht (Sections 82 and 85).
Since the PDPA came into force, one question keeps landing on Thai compliance desks: do we need a DPO? The answers people hear tend to come in two flavours. Everyone needs one, or only big companies do. Neither matches the statute.
Section 41 of the Personal Data Protection Act B.E. 2562 (2019) requires a data protection officer in just three situations. The one that catches most private companies, Section 41(2), only got detailed criteria when the Personal Data Protection Committee issued a notification in 2023.
This article reads Sections 41 and 42 alongside that notification, clause by clause, and turns them into a screening table by business type. It pairs with our guide Do we need a DPO?.
When does Thai law require a DPO?
Section 41 paragraph one applies to both data controllers and data processors, and names three triggers. The first is being a public authority listed by the Committee. The second is processing that requires regular monitoring of personal data or systems because of large-scale data. The third is short and often overlooked:
(3) the core activity of the Data Controller or the Data Processor is the collection, use, or disclosure of the Personal Data according to section 26.
There is no headcount threshold in Section 41(3). Health data, criminal records and biometric data are all on the Section 26 list. A clinic or a health-screening lab whose core work is handling health data may therefore need a DPO even with a modest patient base.
The PDPC's consultation subcommittee made the same point in its answer to the Office of the National Anti-Corruption Commission, using criminal records as the example. The compilation has no English version, so the extract is quoted in the original Thai:
กรณีหากภารกิจของสำนักงาน ป.ป.ช. เป็นการเก็บรวบรวม ใช้ หรือเปิดเผยข้อมูลส่วนบุคคลตามมาตรา ๒๖ (เช่น ประวัติอาชญากรรม) เป็นกิจกรรมหลัก สำนักงาน ป.ป.ช. ต้องจัดให้มีเจ้าหน้าที่คุ้มครองข้อมูลส่วนบุคคลโดยคำนึงถึงความรู้หรือความเชี่ยวชาญเกี่ยวกับการคุ้มครองข้อมูลส่วนบุคคลIn plain English: if the agency's core mission involves Section 26 data such as criminal records, it must designate a DPO with knowledge or expertise in personal data protection. The test is whether sensitive data sits at the heart of the business. Size does not enter into it.
What is a core activity, and why doesn't HR count?
A core activity is work that is necessary and essential to the main purpose of the business. Clause 3 of the PDPC Notification on the Designation of a Data Protection Officer under Section 41(2), B.E. 2566 (2023), which we will call the 2023 DPO notification, gives two examples.
The first is a freight carrier that must use customer data to provide its service and record deliveries. The second is a security contractor that uses CCTV footage. Clause 3 then carves out supporting work in clear terms:
but it does not include supporting activities that are merely support work in the operations of the data controller or the data processor, which are not undertakings that are necessary and essential in order to achieve the principal objectives or principal goals of the operations, business or mission of the data controller or the data processor, such as human resources and information technology support work
The practical effect: a factory with 3,000 employees does not fall under Section 41(2) just because it holds thousands of personnel files. Payroll, social security filings and time clocks are all supporting work.
Look instead at the data the business earns its money from: customers, users, service recipients. If HR or IT is itself the product, as with a payroll bureau or a cloud provider, that work is likely a core activity for that company, because the notification covers data processors too.
What does the 2023 DPO notification actually test?
Two things, and an organisation must meet both. Clause 4 sets out the rule:
For the benefit of personal data protection, a data controller and a data processor whose activity of collecting, using or disclosing personal data, being part of the core activities, requires regular monitoring of the personal data or of the system by reason of holding personal data on a large scale, as provided in Clause 5 and Clause 6 of this Notification, shall designate their own data protection officer.
Put as two questions. First, does our core activity track, monitor or analyse people systematically (Clause 5)? Second, is the data in that activity large scale (Clause 6)? Two yeses mean a DPO is required under Section 41(2).
Test one: regular monitoring (Clause 5)
Clause 5 paragraph one sets the general rule. A core activity that tracks, monitors, analyses or predicts people's behaviour, attitudes or characteristics in a systematic and regular way is deemed to require regular monitoring. Paragraph two then lists cases that qualify automatically.
| Item | Activity in the notification | Businesses likely affected |
|---|---|---|
| (1) | Usage data of membership cards, public transport fare cards and electronic cards that the card provider can examine | Retailers with loyalty cards, transit fare systems |
| (2) | Routine checks of a customer's status, history or qualifications before contracting, to assess risk: credit scoring, insurance premiums, fraud prevention (credit bureaus and their members excluded) | Lenders, insurers, fintechs |
| (3) | Behavioural advertising | Online shops and apps running behaviour-based ads |
| (4) | Customer data held by computer network service providers or telecom operators | Internet and phone service providers |
| (5) | Surveillance and security at premises | Security contractors running CCTV |
| (6) | Other cases set by the Committee | Awaiting further notification |
(5) the collection, use or disclosure of personal data for surveillance and security purposes at various premises;
Item (5) is often read too broadly. A mall or factory with cameras in its own building uses CCTV to look after the premises, which is usually supporting work. A company whose business is guarding other people's premises is different: Clause 3 itself names it as a core activity. The facts of each site still matter.
Test two: large scale (Clause 6)
Clause 6 paragraph one weighs four factors: the number of data subjects or their share of the possible population, the volume and type of data, the duration or permanence of processing, and the geographic reach or number of countries involved. The quickest answers sit in paragraph two.
(1) the collection, use or disclosure of personal data, being part of the core activities, where the number of data subjects whose personal data is collected, used or disclosed is 100,000 persons or more;
Paragraph two adds three more cases that count as large scale without any headcount: behavioural advertising through a search engine or social media with widespread use; customer data held by life insurers, non-life insurers and financial institutions; and customer data held by type-three telecom licensees.
In considering the criteria under Clause 5 and Clause 6, regard shall also be had to the standards and practices of the business or undertaking concerned, as well as to the risks and the impact upon data subjects.
Some guidance still says there is no number
TDPG 4.0, an industry guideline that does not bind like the Act, includes a case study of a fictional e-commerce platform called MarketDee with 500,000 users that profiles shopping behaviour for personalised offers. Its conclusion: the company must appoint a DPO.
Yet that case study says Thai law has not specified a clear number and leans on international guidance instead. TDPG's own paragraph DPO9, and Clause 6 paragraph two (1) of the 2023 DPO notification, already set the 100,000 threshold. When reading secondary material on DPOs, always check it against the notification itself.
Does my type of business need a DPO? A screening table
Use this table as a first screen based on Section 41 and the 2023 DPO notification. Each organisation still has to weigh its own facts, especially the Clause 6 factors and Clause 7.
| Business type | Test one (Clause 5) | Test two (Clause 6) | First-pass result |
|---|---|---|---|
| Banks and financial institutions | Clause 5(2) if credit checks or scoring precede contracts routinely | Clause 6(3): large scale by definition | Likely required |
| Life and non-life insurers | Clause 5(2): premium assessment | Clause 6(3) | Likely required |
| Type-three telecom licensees | Clause 5(4) | Clause 6(4) | Likely required |
| Other internet or network service providers | Clause 5(4) | Count customers against 100,000 and weigh Clause 6 factors | Required once the threshold is met |
| Online shops, apps and platforms that profile users or run behavioural ads | Clause 5 paragraph one and (3) | Clause 6(1) at 100,000, or 6(2) for behavioural ads via widely used search or social media | Required once a test is met |
| Retailers with loyalty cards or points apps | Clause 5(1) | Clause 6(1) once members reach 100,000 | Required at the threshold |
| Security contractors | Clause 5(5) | Weigh Clause 6 factors, such as people captured and how long footage is kept | Case by case |
| Hospitals, clinics and health labs | Not needed | No headcount test | Required under Section 41(3) if health data is the core activity |
| Processors such as payroll bureaus, call centres and SaaS vendors | Does the service track or analyse people systematically? | Count the data subjects the system handles and weigh Clause 6 | Case by case |
| Factories, wholesalers and B2B firms holding mostly staff and contact data | HR and IT are supporting work under Clause 3 | Not reached | Usually not required; voluntary DPO possible |
| Public authorities | Not needed | Not needed | Check the list annexed to the Committee's notification under Section 41(1), and also Sections 41(2) and (3) |
Once you appoint a DPO, what must the organisation do?
Section 42 paragraph one gives the DPO four duties: advising on PDPA compliance, checking how the controller or processor operates, coordinating with the PDPC Office when problems arise, and keeping confidential what they learn on the job.
The organisation's own obligations sit in the following paragraphs, and these are the ones that carry fines:
- Publish the DPO's details. Tell data subjects and the Office of the Personal Data Protection Committee who the DPO is and how to reach them (Section 41 paragraph five). The privacy notice is the obvious place.
- Give the DPO the tools. Provide adequate equipment and access to the personal data needed for the job (Section 42 paragraph two).
- Do not dismiss the DPO for doing the job, and let the DPO report directly to the chief executive (Section 42 paragraph three).
- Certify to the Office that any other duties given to the DPO do not conflict with the PDPA role (Section 42 paragraph four and Clause 8 of the 2023 DPO notification).
The Data Controller or the Data Processor shall not dismiss or terminate the data protection officer’s employment by the reason that the data protection officer performs his or her duties under this Act. In the event that there is any problem when performing the duties, the data protection officer must be able to directly report to the chief executive of the Data Controller or the Data Processor.
The sanctions are administrative. Section 82 fines a controller that breaches Section 41 paragraph one or Section 42 paragraphs two or three up to 1 million baht, and Section 85 sets the same ceiling for processors.
Who can be the DPO, and who shouldn't be?
Thai law has not yet fixed formal qualifications. Section 41 paragraph six allows the Committee to prescribe them with regard to knowledge or expertise in personal data protection. What is clearer is that the DPO must not have a conflict with the work they are meant to oversee.
Answering the Office of Small and Medium Enterprises Promotion (OSMEP), the PDPC subcommittee said a DPO should know the relevant law, understand security measures and understand how data flows inside the organisation. An insider or an outsourced DPO are both acceptable. On whether a dedicated department is needed, it said:
การพิจารณาความจำเป็นในการจัดตั้งส่วนงานที่มีหน้าที่ความรับผิดชอบเป็นการเฉพาะ เพื่อปฏิบัติงานในหน้าที่ของเจ้าหน้าที่คุ้มครองข้อมูลส่วนบุคคล หรือการกำหนดและมอบหมายหน้าที่ของส่วนงานต่าง ๆ ที่มีอยู่แล้วภายในองค์กร จึงเป็นเรื่องภายในองค์กรที่ผู้เกี่ยวข้องสามารถพิจารณาดำเนินการให้เป็นไปตามพระราชบัญญัติดังกล่าวได้ตามความเหมาะสมIn short: whether to set up a dedicated DPO unit, or to assign the work to existing departments, is an internal matter the organisation may decide as it sees fit, so long as the Act is complied with.
TDPG 4.0 goes further on conflicts of interest and includes a case study on why the head of IT should not be the DPO: they would be auditing systems they chose and approved themselves. Again, TDPG is guidance, not law.
the DPO cannot be the same person as a senior executive of the organization, such as the chief executive officer, the marketing manager, or the head of human resources, because persons in these positions determine the purposes and means of personal data processing
In a mid-sized company, options that fit this view include giving the role to legal, compliance or internal audit, or hiring an outsourced DPO, and writing down why that person's other work does not conflict with Section 42. That record is what backs up the certification to the PDPC Office.
Not caught by the rules: should we appoint a DPO anyway?
You may. TDPG 4.0 paragraph DPO18 notes that nothing prevents an organisation without the duty from appointing a voluntary DPO. Whether a voluntary DPO carries the full Section 42 duties, TDPG records, is not yet spelled out in Thai law.
Without a DPO duty, the organisation still has to answer data subject requests, keep Section 39 records and notify the PDPC Office of breaches within 72 hours where feasible under Section 37(4). Someone has to own that work, whatever the job title. For the incident sequence, see the first 72 hours after a breach.
AIPDPA gives that person a RoPA register that prints a Section 39 report, a data subject request portal with a deadline clock, and a breach register that counts down the 72 hours. A single DPO, or a part-time owner, can keep all of it in hand. See the demo account.
Common DPO misconceptions
Section 41 does not use size or listing status. Look at core activities under Clauses 4 to 6 of the 2023 DPO notification, or Section 41(3).
Clause 3 says HR and IT support work is not a core activity.
Clause 6 paragraph one still weighs proportion, data type, duration and geography, and Clause 6 paragraph two (2) to (4) need no headcount at all.
Section 42 paragraph four requires certifying that other duties do not conflict, and TDPG 4.0 explains why IT heads end up auditing their own choices.
Section 41(3) has no headcount test. If handling health data is the core activity, the duty applies.
Data subjects and the PDPC Office must be given the DPO's details, contact address and contact channels.
Frequently asked questions
Does every Thai company need a DPO?
No. Section 41 of the Personal Data Protection Act B.E. 2562 (2019) requires one only for public authorities listed by the Committee, organisations whose core activities require regular monitoring of large-scale personal data, and organisations whose core activities involve Section 26 sensitive data.
How many people counts as large scale?
Clause 6 paragraph two (1) of the PDPC's 2023 DPO notification treats 100,000 or more data subjects in a core activity as large scale. Smaller numbers can still qualify under the Clause 6 paragraph one factors, and insurers, financial institutions and type-three telecom licensees count as large scale without any headcount.
Can the DPO be an employee or an outside contractor?
Either. Section 41 paragraph seven allows the DPO to be a staff member or a service provider under contract, and in the OSMEP consultation the PDPC subcommittee said the choice depends on the organisation's needs.
Can companies in one group share a DPO?
Yes, under Section 41 paragraph two, if they are in the same affiliated business or group as prescribed under Section 29 paragraph two, and every establishment can easily contact the DPO.
What is the penalty for not appointing a required DPO?
A data controller that fails to comply with Section 41 paragraph one, or Section 42 paragraphs two or three, faces an administrative fine of up to 1 million baht under Section 82. Section 85 sets the same maximum for data processors.
Law and sources
- Personal Data Protection Act B.E. 2562 (2019) — Section 41 · Section 42 · Section 82 · Section 85
- PDPC Notification on the Designation of a Data Protection Officer under Section 41 (2) of the PDPA, B.E. 2566 (2023) — Clause 3 – Clause 8
- Office of the PDPC: Compilation of Expert Committee Orders and Summaries of Consultation Answers (guidance, not law)
- Thailand Data Protection Guidelines 4.0 (industry guideline, not binding like the Act) — TDPG4.0-DPO (DPO1–DPO18 · DPO51)
Text in the "The text" boxes is copied word for word from AIPDPA's legal knowledge base, transcribed from the Royal Gazette and official documents; every edit is checked by the system against that base, character by character. English wording is an unofficial translation; the Thai text prevails. This article is general information, not legal advice for a particular case.
Do it in the system
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)