THAILAND Trends and Developments Contributed by: Jutharat Anuktanakul, Suphakorn Chueabunchai and Pitchaya Roongroajsataporn, Chandler Mori Hamada Limited
Chandler Mori Hamada Limited 31st and 36th Floors Sathorn Square Office Tower 98 North Sathorn Road Silom Bangrak Bangkok 10500 Thailand Tel: +662 009 5000 Fax: +662 009 5080 Email: business-development@morihamada.com Web: chandler.morihamada.com
Thailand’s Personal Data Protection Act B.E. 2562 (2019) (PDPA) has moved decisively from a “com - pliance-building” phase into a more enforcement- oriented phase. Although enacted in 2019, the PDPA only became fully effective in 2022, placing 2025 at a critical inflection point: long enough for organisa - tions to have built baseline compliance frameworks, yet recent enough that regulatory expectations are still being shaped through early precedent, subordinate legislation and case-based enforcement. Against this backdrop, 2025 stands out as a year of visible regulatory momentum, characterised by: • a meaningful expansion in administrative enforce - ment, including multiple fines across the public and private sectors; • a sharper focus on breach preparedness and ven - dor governance; • a more proactive monitoring posture, including the continued operationalisation of PDPC Eagle Eye and attention to high-risk processing activities such as biometric data; and • sustained development of the PDPA “ecosystem”, especially reform discussions, voluntary certifica - tion (“Trust Mark”) and cross-border transfer mech - anisms such as Binding Corporate Rules (BCRs). This article highlights four core developments from 2025 that will shape the trends and developments landscape in 2026:
• the Personal Data Protection Committee’s (PDPC) five-case wave of administrative penalties; • proactive enforcement via PDPC Eagle Eye, includ - ing the widely reported “iris scan in exchange for crypto tokens” case involving World/Worldcoin; • the public consultation process on potential amendments to the PDPA; and • the maturation of compliance infrastructure, most notably preparations for Trust Mark and the formal - isation of the BCR certification framework. Enforcement in 2025: From Warning Signals to Repeatable Precedent Eight administrative fines across five cases (public and private sectors) On 1 August 2025, Thailand’s PDPC publicly announced the imposition of eight administrative fines across five non-compliance cases involving both pub - lic and private entities. The announcement was nota - ble not only for the aggregate value involved (reported at approximately THB21.5 million to date), but also for the diversity of fact patterns, ranging from cyber- attacks affecting online public services to operational failures in document destruction and vendor-managed reservation systems. A key signal from this enforcement wave is the PDPC’s willingness to treat the PDPA as an operational gov - ernance framework, encompassing security controls, vendor oversight and incident response, rather than merely as a documentation exercise focused on pri - vacy notices and consent forms. In several cases, the
504 CHAMBERS.COM
Powered by FlippingBook