How to obtain valid consent under Section 19 of Thailand's PDPA Valid consent under Section 19 of the Personal Data Protection Act B.E. 2562 (2019) is consent that is obtained before or at the time of collection, given explicitly in writing or electronically, states the purpose, stands clearly apart from other text in plain language, is not a condition for unrelated services, and is as easy to withdraw as to give. Consent that misses these rules does not bind the data subject.
An online cosmetics shop has a single sign-up checkbox: “I accept the terms, the privacy policy and marketing messages.” Customers who do not want ads cannot sign up at all. Those who want to stop the emails have to write to customer service and wait for days.
What you need to know
The 6 points that matter most, drawn from the law and guidance cited at the end of this guide. Read just this part and you can decide your next move.
- Ask before or at the time of collection, explicitly, in writing or through an electronic system.
- Keep the request separate from other text, in plain language, and never misleading about the purpose.
- Do not make a contract or service conditional on consent to data that is not necessary or relevant to it.
- People can withdraw consent at any time, and withdrawing must be as easy as giving it.
- For a minor aged 10 or under, consent must come from the person exercising parental power (Section 20).
- Consent obtained in breach of these rules does not bind the person and gives you no right to collect, use or disclose the data.
How to do it in 8 steps
Work through these 8 steps in order. Each one is written so a team in a Thai organisation can act on it without waiting for a consultant, and keep the evidence an auditor will ask for.
- Check you actually need consentSection 19 does not require consent where the Act or another law permits the processing. If another basis applies, a good practice is not to ask for consent as well, because it signals that people can refuse.
- Separate the requestSet the consent request clearly apart from your terms of service. A good practice is one checkbox per purpose, for example marketing separate from sharing with partners.
- State the purpose plainlySay exactly why you will collect, use or disclose the data, in words an ordinary customer understands, without anything that could mislead them about the purpose.
- Let people opt in themselvesCollect consent in writing or electronically. A good practice is an unticked box the person ticks, so you can show the consent was explicit.
- Unbundle consent from your serviceIf the data is not necessary or relevant to the contract or service, customers must still be able to use the service without agreeing.
- Build an easy withdrawal routeWithdrawal must be as easy as giving consent: if it took one click to agree, one click should undo it. If withdrawing affects the person, tell them how.
- Check age and legal capacityFor minors, incompetent persons and quasi-incompetent persons, obtain consent from the parent with parental power, the guardian or the curator as Section 20 requires.
- Keep the evidenceRecord who agreed, when, to which purpose, through which version of the wording, and when they withdrew. This is good practice that lets you answer an auditor at once.
What makes consent valid under the PDPA?
Consent must be explicit, in writing or through an electronic system, state the purpose, and be clearly separate from other text, under Section 19 paragraphs 2 and 3. Another method is allowed only where, by its nature, consent cannot be obtained in those ways.
- Obtained before or at the time of collection, use or disclosure.
- Accompanied by the purpose of the collection, use or disclosure.
- In an accessible, understandable form, written in easy-to-read language.
- Not deceptive or misleading about the purpose.
- The Personal Data Protection Committee may prescribe the form and wording to be used.
Can you require consent before someone signs up for a service?
Not if the data is unnecessary or irrelevant to the contract or service. Section 19 paragraph 4 requires the controller to take the utmost account of the person's freedom to give consent.
The most common example is forcing customers to accept marketing messages before they can register. The fix is to make marketing a separate, optional checkbox, so anyone who leaves it blank can still sign up as normal.
How do you get consent from a child?
Under Section 20, for a minor aged 10 or under you must obtain consent from the person exercising parental power who can act for the child. For an older minor, if giving consent is not something the minor may do alone under Sections 22, 23 or 24 of the Civil and Commercial Code, you also need consent from the person exercising parental power.
The same approach applies to incompetent persons, through their guardian, and quasi-incompetent persons, through their curator. It also covers withdrawing consent, notices, exercising rights and complaints under the Act.
Common problems and how to fix them
Most organisations slip on the same 4 points. The table shows how to fix each one yourself, and how AIPDPA gets it done faster with the evidence in place.
| Problem | Fix |
|---|---|
| ✗ One checkbox covering the terms of service, the privacy policy and marketing. | ✓ Split consent by purpose and keep the service available to people who decline the optional parts. AIPDPA Ready-to-use documents includes Thai and English consent forms, ready to use straight away. |
| ✗ Consent takes one click, but withdrawing it needs an email or a phone call. | ✓ Section 19 requires withdrawal to be as easy as giving consent, so offer the same channel. On websites, the AIPDPA cookie banner gives equal-weight Accept and Reject buttons and keeps a consent evidence log without storing IP addresses. |
| ✗ Nobody can say which activities rely on consent or where the evidence is kept. | ✓ Keep a register of consent-based activities and their evidence. The AIPDPA consent register puts both in one place, so you can show an auditor in minutes. |
| ✗ Letting children tick the consent box themselves in an app or school activity. | ✓ Check age first. At 10 or under, consent must come from the person exercising parental power; above that, if the act is not one the minor may do alone, you need that person's consent as well, under Section 20. |
See which activities rely on consent, and where the proof is
The AIPDPA consent register keeps your consent-based activities and their evidence in one place, alongside Thai and English consent forms. See the demo account, no sign-up needed.
Included in every plan, from 2,900 THB/year · demo account, no sign-up
Frequently asked questions
The questions people search for most on this topic. Each answer is short, direct and stands on its own.
Is verbal consent valid under the PDPA?
Section 19 requires consent in writing or through an electronic system, unless by its nature it cannot be obtained that way. If you truly must take it verbally, a good practice is to record why and keep evidence.
If a customer withdraws consent, was our earlier use unlawful?
No. Withdrawal does not affect collection, use or disclosure lawfully carried out before it. If the withdrawal affects the person, you must tell them what the effects are.
Can we force customers to accept promotions before they register?
No, if promotions are not necessary to provide the service. Section 19 forbids making a contract or service conditional on consent to data that is unnecessary or unrelated to it.
Can a 12-year-old give consent on their own?
It depends on whether giving that consent is an act the minor may do alone under Sections 22 to 24 of the Civil and Commercial Code. If it is not, Section 20 requires consent from the person exercising parental power as well.
What happens if our consent request does not meet Section 19?
The consent does not bind the data subject and does not allow you to collect, use or disclose the data. In effect, the activity has no consent behind it.
Do we need consent for every activity?
No. Section 19 paragraph 1 excludes cases where the PDPA or another law permits the processing. Check the other lawful bases first and ask for consent only when none applies.
Sources
This guide relies on 2 sources. Statutes are cited by section or clause; guidelines and standards are guidance, not law.
- Personal Data Protection Act B.E. 2562 (2019), Section 19
- Personal Data Protection Act B.E. 2562 (2019), Section 20
The law cited here comes from AIPDPA's legal knowledge base, transcribed from the Royal Gazette · This is general information; if your situation has unusual facts, our lawyers can review it with you.
Tools and services that help right now
Want to do it yourself, faster? Use the tools in AIPDPA. Want a lawyer to handle it, or to learn the skill yourself? Pick the service in our network that fits.
See which activities rely on consent, where the proof is and who has withdrawn.
Join the waitlist →40 ready-to-use documents in Thai and English, with all 88 AI-added clauses confirmed, filled from your registers, with a QR to verify the approved copy.
Join the waitlist →Equal-weight accept/reject buttons, 10 skins, Thai/English, consent evidence without storing IP, and an auto-generated cookie policy page.
Join the waitlist →A lawyer-led team checks your readiness and sets up PDPA end to end — ideal for SMEs without the time.
See the service →Courses to build PDPA, DPO and AI-governance skills, plus ready-to-use digital toolkits.
See courses & products →
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)
Keep reading
Guides that usually come next after this one. Read them in the order your organisation needs.