How to Answer Data Subject Requests (DSR) in Thailand within 30 Days The deadline for answering a data subject's request to access or copy their personal data is without delay and within 30 days of the controller receiving it, under Section 30 of the Personal Data Protection Act B.E. 2562 (2019). A 2026 PDPC notification, published in the Royal Gazette on 16 July 2026 and in force since mid-September 2026 (60 days after publication), adds a 15-day identity check and allows an extension of up to 30 more days with reasons.
A former employee of a logistics company emails HR asking for a copy of all the personal data the company holds about her. The email sits unanswered for three weeks because nobody knows how to verify her identity, which systems to search, or how many days are left.
What you need to know
The 5 points that matter most, drawn from the law and guidance cited at the end of this guide. Read just this part and you can decide your next move.
- Access and copy requests must be completed within 30 days of receipt (Section 30).
- The 2026 DSR notification was published in the Royal Gazette on 16 July 2026 and has been in force since mid-September 2026 (60 days after publication).
- Check the request and the requester's identity within 15 days; if documents are missing, allow at least 10 days to fix them.
- You may extend by up to 30 more days for large volumes or other necessary reasons, but you must tell the requester why.
- Every refusal must be explained to the requester and logged in your Section 39 record.
How to do it in 6 steps
Work through these 6 steps in order. Each one is written so a team in a Thai organisation can act on it without waiting for a consultant, and keep the evidence an auditor will ask for.
- Open request channelsClause 5 of the 2026 notification requires in-person and postal submission at the contact address given under Section 23; you may add electronic channels.
- Log the date receivedRecord the date each request arrives, because the 15-day and 30-day limits run from receipt, or from the date a complete, corrected request arrives.
- Verify identity within 15 daysCheck the request and ID documents, such as a national ID card or passport. A representative needs a power of attorney (Clauses 6 and 7).
- Ask for missing documentsNotify the requester in writing or electronically and allow at least 10 days. If nothing arrives, the request is treated as abandoned and you must tell the requester.
- Gather the data and respond within 30 daysSearch every system, including data obtained from other sources and where it came from (Clause 4), then allow inspection, send a copy or provide it electronically as requested (Clause 9).
- Document extensions and refusalsTell the requester the reasons for any extension; a good practice is to do so before the first 30 days end. Explain any refusal and log it in your Section 39 record (Clauses 8 and 10).
What rights do data subjects have under the PDPA?
Sections 30 to 36 of the Personal Data Protection Act B.E. 2562 (2019) give data subjects six main groups of rights, and require controllers to log certain refusals, with reasons, in the Section 39 record.
- Access, a copy, or disclosure of how data was obtained without their consent (Section 30)
- Receive or transfer data in a machine-readable format, where the controller holds it in that format (Section 31)
- Object to collection, use or disclosure, for example for direct marketing (Section 32)
- Erasure, destruction or anonymisation (Section 33)
- Restriction of use (Section 34)
- Data kept accurate, up to date, complete and not misleading (Sections 35 and 36)
How many days do you have to respond?
Access and copy requests must be handled without delay and within 30 days of receipt, under Section 30 paragraph four. Clause 10 of the 2026 notification allows an extension of up to 30 more days from the original deadline for large volumes or other necessary reasons, if you tell the requester why.
For objections, Section 32 says the controller may no longer collect, use or disclose the data once the data subject objects, and must act immediately on notice. The other rights in Sections 31 to 36 do not state a number of days, so a good practice is to apply the same 30-day clock to every request.
What does the 2026 DSR notification add, and when did it take effect?
The PDPC Notification on Criteria for Access to and Copies of Personal Data B.E. 2569 (2026) was published in the Royal Gazette on 16 July 2026 and has been in force since mid-September 2026 (60 days after publication). It covers Section 30 requests: access, copies and disclosure of how data was obtained.
- In-person and postal channels are mandatory; electronic channels are optional (Clause 5)
- Requests must be written or electronic, with ID; representatives need a power of attorney (Clause 6)
- Verify within 15 days and allow at least 10 days to fix missing documents (Clause 7)
- Refusal is allowed under law or court order, where others' rights and freedoms would be harmed, or where a request is manifestly unfounded or unreasonably burdensome (Clause 8)
- Respond within 30 days, extendable by up to 30 more days with reasons (Clause 10)
Common problems and how to fix them
Most organisations slip on the same 3 points. The table shows how to fix each one yourself, and how AIPDPA gets it done faster with the evidence in place.
| Problem | Fix |
|---|---|
| ✗ Requests sit in one employee's inbox and nobody sees the deadline. | ✓ Set one official channel and a clear owner. AIPDPA's DSR portal gives data subjects a public link and QR code, emails them a tracking code, and shows your team a deadline clock for every request. |
| ✗ A copy goes out containing other people's data or trade secrets. | ✓ Clause 8 requires you to fulfil the request as far as possible while removing or redacting what would harm others. Check every file before sending, and use your AIPDPA RoPA register to see which activities and systems hold that category of data. |
| ✗ A request is refused by phone with no record. | ✓ Give the requester your reasons and log the refusal with reasons in your Section 39 record, as Clause 8 requires. AIPDPA's DSR portal keeps a log of every request and outcome: the evidence an auditor asks for. |
Take every data subject request through one link, on time
AIPDPA's DSR portal gives data subjects a link and QR code, emails a tracking code, counts down every deadline and keeps a request log as evidence. See the demo account, no sign-up needed.
Included in the GROWTH, PRO and ENTERPRISE plans, from 4,900 THB/year · demo account, no sign-up
Frequently asked questions
The questions people search for most on this topic. Each answer is short, direct and stands on its own.
How long do I have to respond to a data subject access request in Thailand?
30 days from receipt for access and copy requests under Section 30. Clause 10 of the 2026 notification allows up to 30 more days for large volumes or other necessary reasons, provided you tell the requester why.
Do we have to accept data subject requests by email?
Clause 5 of the 2026 notification requires in-person and postal channels. Electronic channels, such as email or an online form, are an additional option that a controller may provide.
Can someone submit a request on behalf of the data subject?
Yes. Under Clause 6 of the 2026 notification, the representative must attach a power of attorney with the correct stamp duty, signed by both parties, plus certified copies of ID documents.
Can we refuse a request that seems pointless?
Yes. Clause 8 of the 2026 notification allows refusal of a request that is manifestly unfounded or unreasonably burdensome, but you must tell the requester your reasons and log the refusal in your Section 39 record.
Must we delete data every time a customer asks?
No. The Section 33 right does not apply where data is kept to establish, exercise or defend legal claims, to comply with the law, or in the other cases that section lists. If a controller fails to act without such a reason, the data subject can complain to the expert committee.
Sources
This guide relies on 3 sources. Statutes are cited by section or clause; guidelines and standards are guidance, not law.
- Personal Data Protection Act B.E. 2562 (2019), Section 30
- Personal Data Protection Act B.E. 2562 (2019), Sections 31–36
- PDPC Notification on Criteria for Access to and Copies of Personal Data, and Disclosure of Its Acquisition without Consent, B.E. 2569 (2026), Clauses 4–10
The law cited here comes from AIPDPA's legal knowledge base, transcribed from the Royal Gazette · This is general information; if your situation has unusual facts, our lawyers can review it with you.
Tools and services that help right now
Want to do it yourself, faster? Use the tools in AIPDPA. Want a lawyer to handle it, or to learn the skill yourself? Pick the service in our network that fits.
A public link and QR for requests, a built-in deadline clock, tracking codes by email and a complete request log.
Join the waitlist →The register fills itself from your org chart, picks the lawful basis with its section, and prints a Section 39 report in one click.
Join the waitlist →A professional DPO on retainer, without a full-time hire.
See plans →Courses to build PDPA, DPO and AI-governance skills, plus ready-to-use digital toolkits.
See courses & products →
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)
Keep reading
Guides that usually come next after this one. Read them in the order your organisation needs.