Does Your Organisation Need a Data Protection Officer (DPO) in Thailand? Under Section 41 of the Personal Data Protection Act B.E. 2562 (2019), an organisation must appoint a Data Protection Officer (DPO) in three cases: it is a state agency named by the Personal Data Protection Committee; its activities require regular monitoring of personal data or systems because of large-scale data; or its core activity is processing sensitive data under Section 26. Headcount is not a test; what counts is the nature of your core activities.
The owner of a five-branch gym chain has 40 staff but more than 120,000 members who scan a card at every visit. He always assumed a business this size did not need a data protection officer, until a corporate client asked for the DPO's name and contact details before signing.
What you need to know
The 5 points that matter most, drawn from the law and guidance cited at the end of this guide. Read just this part and you can decide your next move.
- The DPO duty applies to both data controllers and data processors that fall within the three cases in Section 41.
- The 2023 PDPC notification requires a DPO when a core activity involves regular monitoring of data or systems and large-scale data at the same time.
- Core activities involving 100,000 or more data subjects are deemed large scale.
- Support functions such as HR and IT do not count as core activities.
- A DPO may be an employee or an outside contractor, and the DPO's contact details must be given to data subjects and the PDPC Office.
How to do it in 6 steps
Work through these 6 steps in order. Each one is written so a team in a Thai organisation can act on it without waiting for a consultant, and keep the evidence an auditor will ask for.
- List your core activitiesWrite down the activities essential to your main business purpose, such as serving customers, separate from support work like HR and IT, following the definition in Clause 3 of the 2023 notification.
- Check for sensitive dataIf a core activity is collecting, using or disclosing data under Section 26, Section 41(3) requires a DPO.
- Check for behavioural monitoringSee whether core activities track, monitor or profile people systematically and regularly, or match a Clause 5 case such as membership cards, pre-contract customer checks, behavioural advertising or security surveillance.
- Test for large scaleWeigh the number of data subjects, the volume and type of data, duration and geographic reach under Clause 6. Core activities involving 100,000 or more data subjects are deemed large scale.
- Record the outcome and appointDocument your reasoning even if the answer is no. If you need a DPO, appoint an employee or contractor and give the contact details to data subjects and the PDPC Office.
- Let the DPO do the jobProvide adequate tools and access to data and a direct line to top management. If the DPO has other duties, certify to the PDPC Office that they do not conflict (Section 42).
Who must appoint a DPO under Thai law?
Section 41 requires data controllers and data processors to have a DPO in the three cases below, and applies the same rule to representatives appointed under Section 37(5).
- (1) State agencies as prescribed by the Personal Data Protection Committee
- (2) Collection, use or disclosure that requires regular monitoring of personal data or systems because of large-scale data, as prescribed by the Committee
- (3) Core activities that consist of collecting, using or disclosing sensitive data under Section 26
What do 'regular monitoring' and 'large scale' mean?
The PDPC Notification on the Appointment of a DPO under Section 41(2) B.E. 2566 (2023) was published in the Royal Gazette on 14 September 2023 and took effect 90 days after publication. It requires a DPO when a core activity meets both tests at once, and Clause 7 adds that industry standards and the risk to data subjects must be considered.
- Regular monitoring (Clause 5): systematic, regular tracking, monitoring or profiling of people, including card usage data, pre-contract customer status or history checks for risk, behavioural advertising, network or telecom providers, and security surveillance of premises
- Large scale (Clause 6): judged by number of data subjects, volume and type of data, duration and geographic reach; deemed cases include 100,000 or more data subjects, behavioural advertising through widely used search engines or social media, customer data of life insurers, non-life insurers and financial institutions, and Type 3 telecom licensees
What does a DPO do, and what must the organisation provide?
Section 42 gives the DPO four duties: advising the organisation and its staff, monitoring compliance, coordinating and cooperating with the PDPC Office, and keeping confidential the personal data learned on the job.
The organisation must provide adequate tools and access to personal data. It may not dismiss the DPO or end their contract because they performed their duties under the Act, and the DPO must be able to report directly to top management when problems arise.
Common problems and how to fix them
Most organisations slip on the same 3 points. The table shows how to fix each one yourself, and how AIPDPA gets it done faster with the evidence in place.
| Problem | Fix |
|---|---|
| ✗ Assuming a small headcount means no DPO. | ✓ Assess your core activities against Section 41 and the 2023 notification instead. AIPDPA's RoPA register gathers every activity in one place, so you can see which are core and whether sensitive data is involved; for a lawyer-led check, Kooru Data Shield covers the assessment and setup. |
| ✗ Appointing a DPO but never publishing the contact details. | ✓ Section 41 requires you to give the DPO's details, contact address and contact method to data subjects and the PDPC Office. Put them in your privacy notice; AIPDPA includes ready-to-use privacy notice templates in Thai and English,. |
| ✗ The DPO works, but nothing proves it. | ✓ Keep regular duty reports and records of meetings with management. AIPDPA's DPO tools generate a DPO duty report and keep board and committee records in one place. |
Run your DPO programme with the evidence in one place
AIPDPA's DPO tools generate a DPO duty report and keep board and committee records as evidence. See the demo account, no sign-up needed; paid plans start at 2,900 THB a year (no VAT added).
Included in every plan, from 2,900 THB/year · demo account, no sign-up
Frequently asked questions
The questions people search for most on this topic. Each answer is short, direct and stands on its own.
Do I need a DPO if I have fewer than 100 employees?
Possibly. The tests in Section 41 and the 2023 notification are not based on headcount. They ask whether your core activities involve regular monitoring of data or systems at large scale, or processing Section 26 sensitive data.
Does holding data on more than 100,000 customers mean we need a DPO?
Not automatically. 100,000 data subjects is a deemed large-scale case under Clause 6, but the 2023 notification also requires the core activity to involve regular monitoring under Clause 5. Sensitive data as a core activity triggers the duty separately under Section 41(3).
Can we outsource our DPO?
Yes. Section 41 states that a DPO may be an employee of the data controller or processor, or a contractor engaged under a service contract.
Can group companies share one DPO?
Yes, if they belong to the same group of undertakings or businesses as prescribed under Section 29 paragraph two, provided every establishment in the group can contact the DPO easily (Section 41 paragraph two).
Can the DPO hold another role at the same time?
Yes, but the data controller or processor must certify to the PDPC Office that the other duties do not conflict with the DPO role (Section 42 and Clause 8 of the 2023 notification).
Can we dismiss a DPO for doing their job?
No. Section 42 prohibits dismissing a DPO or terminating their contract on the ground that they performed their duties under the Personal Data Protection Act.
Sources
This guide relies on 3 sources. Statutes are cited by section or clause; guidelines and standards are guidance, not law.
- Personal Data Protection Act B.E. 2562 (2019), Section 41
- Personal Data Protection Act B.E. 2562 (2019), Section 42
- PDPC Notification on the Appointment of a Data Protection Officer under Section 41(2) of the Personal Data Protection Act B.E. 2562, B.E. 2566 (2023), Clauses 3–8
The law cited here comes from AIPDPA's legal knowledge base, transcribed from the Royal Gazette · This is general information; if your situation has unusual facts, our lawyers can review it with you.
Tools and services that help right now
Want to do it yourself, faster? Use the tools in AIPDPA. Want a lawyer to handle it, or to learn the skill yourself? Pick the service in our network that fits.
A DPO duty report and committee records, ready to present to the board.
Join the waitlist →A professional DPO on retainer, without a full-time hire.
See plans →A lawyer-led team checks your readiness and sets up PDPA end to end — ideal for SMEs without the time.
See the service →Courses to build PDPA, DPO and AI-governance skills, plus ready-to-use digital toolkits.
See courses & products →
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)
Keep reading
Guides that usually come next after this one. Read them in the order your organisation needs.