THAILAND Law and Practice Contributed by: Jutharat Anuktanakul, Suphakorn Chueabunchai and Pitchaya Roongroajsataporn, Chandler Mori Hamada Limited
• ensuring the preparation and implementation of the master plan for the promotion and protection of personal data; • promoting and supporting government agencies and the private sectors in evaluating the opera - tional results of such master plan; • determining measures or guidelines relating to data protection operations in order to comply with the PDPA; • issuing notifications or rules for the implementation of the PDPA; and • providing advice or consultancy to any persons. In addition, the PDPC shall appoint expert committees to consider any complaints under the PDPA, includ - ing investigating any acts in connection with personal data, settling disputes and carrying out other tasks assigned by the PDPC. 1.8 Enforcement Proceedings and Fines As mentioned in 1.7 Regulators , an expert committee is responsible for considering and investigating any complaints on behalf of the PDPC in accordance with the PDPC’s rules. If any complaint does not comply with such rules, the expert committee will not accept such complaint for consideration. If, following consideration or investigation, the expert committee finds that such complaint is capable of set - tlement and the relevant parties are willing to settle, the expert committee must proceed with dispute set - tlement before issuing any order mandating the opera - tor (whether the controller or processor) to perform or rectify their act, or prohibiting the operator from carrying out an act that would cause damage to a data subject. If the operator fails to comply with the expert commit - tee’s order, administrative procedures will be applied (including powers to order seizure, attachment and sale by auction, as allowed by law). The expert com - mittee’s order is final, although any party may appeal such order in accordance with administrative proce - dure within 15 days of receiving such order. In this regard, a PDPC Notification on Administrative Penalties governs the enforcement of administrative penalties and sets out the criteria for how administra -
tive penalties (as determined by the expert committee) are used. The expert committee will determine and apply administrative penalties based on the serious - ness of such offence. Offences are categorised into two groups: serious and non-serious offences. Under the Notification on Administrative Penalties, the expert committee is empowered to impose administrative penalties accordingly. Serious Offences The expert committee can impose administrative fines on a controller and/or processor. In addition, admin - istrative fines can be imposed on offenders who fail to comply with an order of the expert committee to remedy a violation, including orders to remedy, stop, suspend or seize related processing activities. Non-Serious Offences The expert committee may issue orders to remedy, stop, suspend or seize related processing activities, or may take other actions to stop/minimise damage within a specified period. 1.9 Enforcement Trends Significant Enforcement Actions and Trends January 2024 to January 2026 From “awareness-building” to real fines and public case summaries Thailand’s PDPC has moved into visible enforcement through administrative fines. This includes a landmark fine of THB7 million (the first high-profile fine under the PDPA) linked to a customer data leak that was later exploited in call centre scams. The findings included insufficient security measures and a failure to appoint a DPO. Multi-case enforcement across sectors, including healthcare and processors On 1 August 2025, the PDPC publicly highlighted five cases spanning both the public and private sec - tors (state agency online services, a private hospital’s mishandling of medical record destruction, consumer businesses, and a reservation-system incident). Total fines to date amount to approximately THB21.5 mil - lion. Importantly, enforcement also extended to data processors (not only controllers), and repeatedly tar - geted deficiencies in security controls, breach report - ing and DPO appointment as core failures.
497 CHAMBERS.COM
Powered by FlippingBook