Children's data under section 20 of the Thai PDPA: who must give consent Section 20 of the Thai PDPA says that when the data subject is a minor who has not reached majority, and the matter is not one a minor can do alone, consent must also come from the holder of parental responsibility. For children up to ten years old, consent is requested from the holder of parental responsibility. The same rule applies to withdrawing consent, notices and exercising rights, so you first need to know where children's data sits in your register.
A tutoring school let students sign up online on their own and then used their photos in adverts. A parent asked who had allowed it, and the school found it had not a single consent from a parent.
What you need to know
The 5 points that matter most, drawn from the law and guidance cited at the end of this guide. Read just this part and you can decide your next move.
- Children up to ten: ask the holder of parental responsibility for consent
- Older minors also need that holder's consent unless the matter is one they can do alone
- The same rule covers withdrawal and exercising rights
- Children's data often hides in unlabelled activities such as event photos
- Keep proof of who gave consent
How to do it in 6 steps
Work through these 6 steps in order. Each one is written so a team in a Thai organisation can act on it without waiting for a consultant, and keep the evidence an auditor will ask for.
- Find children's dataCheck the register for students, child customers or employees' children among your data subjects.
- Split by ageSeparate children up to ten from older minors, because the person who consents differs.
- Check the lawful basisActivities that do not rely on consent, such as contract or legal duty, do not use the section 20 mechanism but still need a notice.
- Collect consent from the right personRecord the parent's name, relationship, how consent was given and the date.
- Make withdrawal easyLet parents withdraw as easily as they gave consent.
- Review as children growSet reviews when a child passes ten or reaches majority.
Where does children's data usually hide?
Beyond enrolment forms, it sits in event photos, CCTV, health records from the school nurse, app accounts and employees' children in benefits systems.
- Event photos and videos
- CCTV
- Health and allergy records
- App or game accounts
- Children in employee benefits
Can a child over ten consent alone?
Only for matters a minor can do alone under the Civil and Commercial Code provisions that section 20 refers to. Otherwise the holder of parental responsibility must also consent. When in doubt, involve the parent.
What extra applies to sensitive children's data?
Health or other sensitive data under section 26 needs explicit consent or a specific exception, and a DPIA is worth considering because a vulnerable group is involved.
Common problems and how to fix them
Most organisations slip on the same 3 points. The table shows how to fix each one yourself, and how AIPDPA gets it done faster with the evidence in place.
| Problem | Fix |
|---|---|
| ✗ Children tick the consent box themselves online | ✓ Add a parent confirmation step and keep the parent's name and relationship. |
| ✗ The register does not mention children | ✓ Add minors as a data-subject group and review the related activities. |
| ✗ No review as children grow | ✓ Set age-based review dates and ask for fresh consent when needed. |
Find every trace of children's data at once
AIPDPA finds where children's data may sit even when the register is silent, shows who must consent under section 20, splits must from should, and issues a numbered report.
Included in every plan, from 2,900 THB/year · demo account, no sign-up
Frequently asked questions
The questions people search for most on this topic. Each answer is short, direct and stands on its own.
We don't sell to children. Does section 20 matter?
Yes. Employees' children, young visitors and CCTV footage are all minors' data.
If we rely on contract, not consent, does section 20 apply?
The section 20 consent mechanism applies when you rely on consent, but notices and rights requests for minors still need the parent in mind.
How do we keep proof of parental consent?
Record who consented, their relationship to the child, how and when, and the version of the wording used.
Can a parent withdraw consent?
Yes, and withdrawal must be as easy as giving consent.
Sources
This guide relies on 3 sources. Statutes are cited by section or clause; guidelines and standards are guidance, not law.
- Personal Data Protection Act B.E. 2562 (2019), s. 20 — consent of minors, incompetent and quasi-incompetent persons
- Personal Data Protection Act B.E. 2562 (2019), s. 19 — conditions for consent
- Thailand Data Protection Guidelines (TDPG) 4.0 — consent from minors (guidance, not statute)
The law cited here comes from AIPDPA's legal knowledge base, transcribed from the Royal Gazette · This is general information; if your situation has unusual facts, our lawyers can review it with you.
Tools and services that help right now
Want to do it yourself, faster? Use the tools in AIPDPA. Want a lawyer to handle it, or to learn the skill yourself? Pick the service in our network that fits.
Finds where children's data may sit even when the register is silent, shows who must consent under section 20, and splits must from should.
Get started →See which activities rely on consent, where the proof is and who has withdrawn.
Get started →The register fills itself from your org chart, picks the lawful basis with its section, and prints a Section 39 report in one click.
Get started →40 ready-to-use documents in Thai and English, with all 88 AI-added clauses confirmed, filled from your registers, with a QR to verify the approved copy.
Get started →A lawyer-led team checks your readiness and sets up PDPA end to end — ideal for SMEs without the time.
See the service →
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)
Keep reading
Guides that usually come next after this one. Read them in the order your organisation needs.