PDPA penalties in Thailand: administrative fines, criminal liability and damages

One Monday morning, the owner of a small beauty clinic learns that a staff member posted a client's treatment records in the wrong LINE group. The client says she will complain and sue. That night the owner searches 'PDPA fine amount' and finds a different number on every website.

What you need to know

The 6 points that matter most, drawn from the law and guidance cited at the end of this guide. Read just this part and you can decide your next move.

• Administrative fines for data controllers come in three tiers: up to THB 1 million (Section 82), THB 3 million (Section 83) and THB 5 million (Section 84).
• Data processors face the same 1, 3 and 5 million baht tiers (Sections 85–87).
• Civil liability applies whether or not the breach was intentional or negligent, unless one of the Section 77 defences applies, such as force majeure.
• The criminal offences in Section 79 concern sensitive data under Section 26 and are compoundable offences.
• A director or manager whose order, act or failure to act caused the company's offence is also liable to the penalty for that offence (Section 81).
• The Expert Committee weighs severity, business size and circumstances, and may order a fix or issue a warning first (Section 90).

↑ Back to contents

How to do it in 6 steps

Work through these 6 steps in order. Each one is written so a team in a Thai organisation can act on it without waiting for a consultant, and keep the evidence an auditor will ask for.

1. Map the duties that carry finesCheck your operations against the duties Sections 82–84 refer to, such as the collection notice in Section 23, the record of processing in Section 39, the Data Protection Officer (DPO) duty in Section 41 and the duties in Section 37. Flag every duty where you have no written evidence.
2. Review sensitive data firstSection 26 data, such as health, criminal record and biometric data, sits in the top THB 5 million fine tier and is the data the criminal penalties in Section 79 target. Check how you collect and share it before anything else.
3. Check overseas transfersTransferring data in a way that does not follow Section 29 can cost up to THB 3 million, or up to THB 5 million for sensitive data, for both controllers and processors. List which data leaves Thailand and through which systems or cloud services.
4. Put processor duties in a contractA processor that fails to comply with Section 40 without reasonable cause faces a fine of up to THB 3 million under Section 86. Writing those duties into a data processing agreement makes each party's responsibilities clear.
5. Record who is responsible and what they orderedBecause Section 81 reaches directors and managers who give orders or fail to act, a good practice is a written appointment of the person in charge and board minutes showing that management has acted on data protection.
6. Answer the Expert Committee on timeIgnoring an order or failing to explain the facts under Section 75 carries an administrative fine of up to THB 500,000 under Section 89. Keep an evidence file you can open the day a summons arrives.

↑ Back to contents

What is the maximum PDPA administrative fine?

The highest administrative fine is THB 5,000,000, for breaches involving sensitive data under Section 26 (Sections 84 and 87). The lower tiers are THB 3,000,000 and THB 1,000,000, depending on which duty was breached.

• Up to THB 1 million (Section 82): a controller fails to comply with Section 23, Section 30 paragraph 4, Section 39 paragraph 1, Section 41 paragraph 1 or Section 42 paragraphs 2–3, does not request consent in the form set by the PDPC, or does not explain the effect of withdrawing consent.
• Up to THB 3 million (Section 83): a controller breaches Sections 21, 22, 24, 25 paragraph 1, 27, 28, 32 paragraph 2 or 37, obtains consent by deception, or transfers data abroad other than as Section 29 allows.
• Up to THB 5 million (Section 84): a controller breaches Section 26 paragraphs 1 or 3, or breaches Sections 27, 28 or 29 in relation to sensitive data.
• Processors (Sections 85–87): up to THB 1 million for the DPO duties in Sections 41–42, up to THB 3 million for Section 40 or overseas transfers, and up to THB 5 million where sensitive data is transferred.
• Representatives of controllers or processors: up to THB 1 million (Section 88). Anyone who ignores an Expert Committee order: up to THB 500,000 (Section 89).

↑ Back to contents

Can you go to jail under the PDPA?

Yes. Under Section 79, a controller that breaches Section 27 or 28 in relation to sensitive data, in a way likely to cause another person damage, loss of reputation, contempt, hatred or humiliation, faces up to 6 months in prison, a fine of up to THB 500,000, or both. If the aim was an unlawful benefit, the maximum rises to 1 year, THB 1,000,000, or both.

Section 79 offences are compoundable, meaning they can be settled with the injured person. Separately, Section 80 punishes anyone who learns another person's data while performing duties under the Act and discloses it, with up to 6 months in prison, a fine of up to THB 500,000, or both, unless an exception applies, such as disclosure as part of official duties, for an investigation or trial, or with the data subject's specific written consent.

Under Section 81, if a company commits an offence because of an order or act of a director, manager or person in charge, or because that person failed to give an order or act when it was their duty, that person is also liable to the penalty for that offence.

↑ Back to contents

How much compensation can a data subject claim under the PDPA?

A data subject can claim their actual damage, including necessary costs spent to prevent or stop the harm (Section 77). On top of that, a court may award punitive damages of up to twice the actual compensation (Section 78).

Controllers and processors are liable whether or not they acted intentionally or negligently, unless they prove that the damage was caused by force majeure, by the data subject's own act or omission, or by following a lawful order of an official.

A claim expires 3 years after the injured person learns of the damage and who is liable, or 10 years after the breach.

• When setting punitive damages, the court considers how serious the harm is.
• It considers the benefit the controller or processor gained.
• It considers the financial status of the controller or processor.
• It considers any steps taken to reduce the harm, and whether the data subject contributed to it.

↑ Back to contents

How does the Expert Committee decide the fine?

Section 90 requires the Expert Committee to weigh the severity of the conduct, the size of the controller's or processor's business and the surrounding circumstances, under criteria set by the PDPC. Where it sees fit, it may first order the organisation to fix the problem or issue a warning.

If a fine is not paid, administrative enforcement applies, and the Expert Committee can sue in the Administrative Court so that assets are seized or attached and auctioned to cover the fine.

An organisation that can immediately show its record of processing, privacy notice, security measures and the fixes it made is in a far better position to explain its conduct than one with nothing in writing.

↑ Back to contents

Common problems and how to fix them

Most organisations slip on the same 3 points. The table shows how to fix each one yourself, and how AIPDPA gets it done faster with the evidence in place.

↑ Back to contents

Who stands behind this guide?

Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel

Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)