Is Your Website Breaking Thailand's PDPA? A 10-Minute Compliance Check

Thailand's Personal Data Protection Act, usually called the PDPA, has been fully in force since June 2022. Many small business owners assume it only matters for banks and hospitals. In reality, if your website has a contact form, a booking form, analytics, a chat widget or a newsletter sign-up, you are collecting personal data and the law applies to you. Here's a quick, practical check you can run on your own site.

This article is a general guide, not legal advice. For anything high-risk, such as health data or large customer databases, speak to a Thai lawyer who specialises in data protection.

What counts as personal data on a website

Under the PDPA, personal data is any information that can identify a person, directly or indirectly. On a typical business website that includes:

• Names, phone numbers, email addresses and LINE IDs from forms.
• Booking details, addresses and payment records.
• IP addresses and cookie identifiers used by analytics and advertising tools, when they can be linked to a person.
• Chat transcripts from website widgets and messenger bots.
• Photos or documents that customers upload.

The PDPA penalties are not symbolic

The PDPA allows administrative fines of up to 5 million baht, criminal penalties for certain serious offences, and civil claims in which courts can award punitive damages of up to twice the actual damage. Enforcement started slowly, but Thailand's Personal Data Protection Committee has begun issuing fines, and many cases start with a single complaint from a customer.

The 10-minute PDPA check for your website

• Privacy notice: is there a clear, easy-to-find privacy policy that explains what you collect, why, how long you keep it and who you share it with?
• Forms: does every form say why you're collecting the data, with a link to the privacy notice next to the submit button?
• Marketing consent: if you'll send promotions, is there a separate, unticked checkbox for that, not bundled into 'I agree to everything'?
• Cookies: do analytics and advertising cookies wait for consent, with an easy way to reject them, or do they load the moment the page opens?
• Third parties: do you know which tools receive visitor data, such as Google Analytics, the Meta Pixel, chat widgets or booking engines?
• Data requests: if a customer asks to see or delete their data, do you know who handles it and how?
• Security: is the site on HTTPS, are admin logins protected, and is the software up to date?
• Breach plan: do you know that a data breach that puts people at risk generally has to be reported to the regulator within 72 hours?

Consent is not the only legal basis

A common mistake is asking for consent for everything. The PDPA allows other lawful bases, such as performing a contract (you need an address to deliver an order) or legitimate interest. Overusing consent creates long, confusing forms, and consent can be withdrawn at any time. Use it where it's genuinely needed, typically for marketing and non-essential cookies, and explain the other purposes in your privacy notice.

Don't forget LINE, chat and booking tools

Many Thai businesses collect most of their customer data outside the website: LINE Official Account chats, Facebook Messenger, booking platforms and spreadsheets. The same rules apply there. Know where the data lives, who on the team can access it, and how long you keep it. A chatbot that stores every conversation forever is a liability, not an asset.

What to fix first

If your check found gaps, start with what visitors see: a proper privacy notice, honest form wording, a separate marketing checkbox and a cookie banner that actually blocks non-essential cookies until the visitor agrees. Then work inward: access controls, retention periods and a simple process for handling data requests.

OutDept builds websites, forms and bots with PDPA-friendly consent and data handling from the start, and can review an existing site and fix what's missing. We aren't a law firm, so when the questions get complex we work alongside your legal adviser.