What must a privacy notice contain under Thailand's PDPA (Section 23)?

You run three cafés and have just launched a loyalty app. At the counter, a customer asks why you need her phone number and birthday, and how long you will keep them. Your staff have no answer, because the app only says “We respect your privacy.”

What you need to know

The 5 points that matter most, drawn from the law and guidance cited at the end of this guide. Read just this part and you can decide your next move.

• Give the notice before or at the moment you collect the data, not afterwards (Section 23).
• List every purpose, including those that Section 24 lets you pursue without consent.
• State a retention period; if you cannot fix one, give the period that can reasonably be expected under the collection standard.
• If you have a representative or a Data Protection Officer (DPO), include their details and contact channel.
• Data obtained from another source requires notice without delay and within 30 days, plus consent, unless Section 24 or 26 exempts it (Section 25).

↑ Back to contents

How to do it in 7 steps

Work through these 7 steps in order. Each one is written so a team in a Thai organisation can act on it without waiting for a consultant, and keep the evidence an auditor will ask for.

1. Map whose data you collectGroup your data subjects, such as customers, members, staff and job applicants, and list what you collect from each and through which channel. Your Record of Processing Activities (RoPA) is the best starting point.
2. Write out every purposeSay why you collect, use or disclose the data, and include the purposes that Section 24 allows without consent.
3. Flag data people must provideIf people must give the data to comply with a law or contract, or to enter into a contract, say so and explain what may happen if they refuse, for example that they cannot open an account.
4. List the data and how long you keep itName the data you actually collect and the retention period. If no fixed period is possible, give the period reasonably expected under the collection standard instead of vague wording like “as long as necessary”.
5. Name recipients and contact detailsDescribe the categories of people or organisations that may receive the data, and give the controller's identity, address and contact method, plus those of any representative or DPO.
6. Explain rights and how to use themList the data subject rights referred to in Section 23(6) and give a request channel that actually works, such as a link or QR code.
7. Show it where you collect dataPlace the notice at the point of collection, such as a sign-up page, job application form or front counter. A good practice is to keep a version number and date so you can prove which notice each person saw.

↑ Back to contents

When do you have to give a privacy notice?

Before or at the time you collect personal data, under Section 23 of the Personal Data Protection Act B.E. 2562 (2019). The only exception in that section is where the data subject already knows the details.

A good practice is to place the notice, or a link to it, exactly where data is collected: next to the sign-up button, inside the job application form or at the registration desk. A single policy page on your website with no link from your collection points makes it hard to prove that people were informed.

↑ Back to contents

What must a PDPA privacy notice include?

Section 23 lists six items the data controller must tell the data subject. A notice that leaves one out is incomplete under that section.

• The purposes of collection, use or disclosure, including purposes permitted without consent under Section 24.
• Any case where the person must provide data to comply with a law or contract, or to enter into a contract, and the possible effects of not providing it.
• The data to be collected and the retention period, or the period reasonably expected under the collection standard.
• The categories of people or organisations the data may be disclosed to.
• The controller's details, address and contact method, and those of any representative or DPO.
• The data subject's rights under Section 19 paragraph 5 and the first paragraphs of Sections 30 to 34, 36 and 73.

↑ Back to contents

What if you got the data from someone else?

Section 25 bars collecting personal data from a source other than the data subject unless you tell the person about it without delay and within 30 days of collection and obtain their consent, or the collection is exempt from consent under Section 24 or Section 26.

Where consent is needed, the Section 23 details must reach the person within 30 days of collection. If you use the data to contact them, give the details at the first contact; if you will disclose the data, give them before the first disclosure.

• No notice is needed if the person already knows the new purpose or the details.
• No notice is needed if you can prove notice is impossible or would obstruct the use, especially for scientific, historical or statistical research, provided appropriate safeguards are in place.
• No notice is needed if the law requires urgent use or disclosure and appropriate safeguards are in place.
• No notice is needed if you obtained the data through your duties or profession and the law requires you to keep those details confidential.

↑ Back to contents

Common problems and how to fix them

Most organisations slip on the same 4 points. The table shows how to fix each one yourself, and how AIPDPA gets it done faster with the evidence in place.

↑ Back to contents

Who stands behind this guide?

Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel

Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)