THAILAND Trends and Developments Contributed by: Jutharat Anuktanakul, Suphakorn Chueabunchai and Pitchaya Roongroajsataporn, Chandler Mori Hamada Limited
Key reported themes in the regulator’s reasoning are directly relevant to compliance expectations for 2026, as follows. • Biometric data is high-risk by default. Iris data is commonly treated as biometric data, which typical - ly attracts heightened compliance scrutiny because it is difficult to change if compromised and can be used for identity verification. • “Consent” must be truly voluntary – financial inducement creates risk. Reporting emphasised concerns that offering crypto tokens in exchange for consent may undermine voluntariness, making consent potentially invalid under PDPA principles. • Purpose limitation and transparency remain core principles. Media coverage reflects regulatory con - cerns that actual data use may extend beyond the purposes communicated at the point of collection. Clear, specific and easily understandable consent language may help mitigate the risk of challenges from data subjects regarding the scope of use. For 2026, the practical takeaway is that the PDPC is willing to take strong action where a processing model is built around high-risk data (biometrics) combined with incentives that may compromise “freely given” consent and create downstream transfer/security concerns. This is a clear warning for any business operating digital ID, fintech-onboarding, biometric access control or consumer-facing “reward for data” models. PDPA Reform Discussions: Public Consultation on Proposed Amendments in 2025 2025 also saw a rise in momentum toward possible legislative reform of the PDPA. As the PDPA has now been in force for approximately five years, policymak - ers have begun reviewing whether certain provisions should be refined or adjusted in light of practical implementation and enforcement experience. Toward the end of 2025, a draft amendment bill relating to the PDPA was released for public consultation, although the process was not completed. During the consultation process, stakeholders expressed both supporting and opposing views in relation to the proposals put forward by the drafting committee. This diversity of feedback suggests that
the content of any final amendments may differ from the draft, and reinforces the need to closely monitor the version that is ultimately promulgated. Even without predicting the final form of any amend - ments, the consultation materials provide useful insight into the types of issues under consideration, including the following examples: • repositioning the PDPA as the primary legal frame - work for personal data processing, rather than merely a baseline compliance standard, to ensure greater legal clarity and consistency across sec - tors; • clarifying and refining the definitions of “data con - troller” and “data processor” to reduce interpretive uncertainty in complex processing and outsourcing arrangements; • revisiting the list of sensitive personal data to bet - ter align it with Thailand’s legal, social and cultural context; and • improving the clarity of consent requirements, particularly to prevent practices where consent is effectively exchanged for goods, services or ben - efits in a manner that undermines its voluntariness. These proposed areas of adjustment are illustrative only, and the scope and substance of any amend - ments may evolve as deliberations continue. Fur - ther changes may be introduced as part of the final outcome, and close attention will need to be paid to future guidance and decisions issued by the PDPC. Looking ahead to 2026, this reform dialogue is rel - evant in two key respects. • First, it signals that Thailand may be entering a “second-stage PDPA” phase: following initial implementation and early enforcement, attention is shifting toward refinement, clarification and the reduction of practical compliance friction for both private and public sector use cases. • Second, the legislative review process is likely to interact with enforcement practice. As regulatory precedent develops, recurring ambiguities and operational challenges become more visible, creat - ing a feedback loop between enforcement experi - ence and legislative fine-tuning.
507 CHAMBERS.COM
Powered by FlippingBook