Thailand PDPA compliance
In Thailand, a bad consent request counts as no consent.
The PDPA sets out exactly what a consent request has to look like: explicit, separate from everything else, in plain language, and as easy to withdraw as it was to give. Get it wrong and the law says you may not process the data at all. ConsentBit asks the way the Act describes.
Google-certified CMP · IAB Europe registered CMP (ID 502) · 9 languages · Webflow, Framer, WordPress and any website builder
First visit to your site
We value your privacy
We use necessary cookies to run this site. With your permission, we’d also like to measure traffic and show relevant ads.
Until they choose, only necessary cookies run. The floating icon reopens their settings any time.
One clear request, separate from everything else.
Withdrawing is as easy as agreeing was.
Thailand’s privacy law, enforced by the PDPC.
The Personal Data Protection Act B.E. 2562 (2019) has been in full force since June 2022. The Personal Data Protection Committee enforces it. It reaches businesses outside Thailand that offer goods or services to people there, or monitor their behaviour in the country.
Maximum administrative fine
THB 5 million
for sensitive data violations. Other breaches carry up to THB 3 million or THB 1 million.
Consent must be explicit, in writing or by electronic means
Courts can add punitive damages of up to twice the actual compensation
Five things the PDPA expects from your website
These come straight from the consent rules in the Act.
What PDPA requires
A consent request made explicitly, in writing or electronically
How ConsentBit handles it
The banner is the request, and the visitor’s click is the record.
What PDPA requires
A request clearly distinguishable from everything else
How ConsentBit handles it
The banner sits on its own, not folded into terms or a policy.
What PDPA requires
Plain language that is not deceptive about the purpose
How ConsentBit handles it
Each category says what it covers in ordinary words.
What PDPA requires
Withdrawal as easy as giving consent
How ConsentBit handles it
A floating button on every page reopens the panel, and withdrawing is as easy as agreeing was.
What PDPA requires
The purpose stated when you ask
How ConsentBit handles it
Every category names its purpose before anything runs.
The Act is blunt about the consequence. A consent request that doesn’t follow these rules has no binding effect, and you can no longer collect, use or disclose the data.
What a visitor sees, step by step
Nothing optional runs until the visitor agrees.
They land on your site
The banner appears on its own, explains the purposes, and holds Analytics and Marketing back.
They choose
Accept all, Reject all, or set each category in the preferences panel.
The choice takes effect
Allowed categories run. Anything they didn’t allow stays blocked.
They can withdraw just as easily
A floating button on every page reopens the panel. Withdrawing is as easy as agreeing was. The choice is saved at once, marketing cookies are deleted, and anything already running on that page is blocked from the next page on.
WHAT THE PDPA ASKS FOR, AND WHAT IT DOESN’T
Consent is the default, with six ways around it.
Thailand’s law reads like GDPR in structure. Consent is the starting point, but the Act lists six other grounds, and legitimate interest is one of them. Where you do rely on consent, the formal rules are strict.
If withdrawing consent will affect the visitor in some way, the Act says you have to tell them what the consequences are.
Blocked until they agree
Nothing optional runs until the visitor answers, on every plan including the free one. Here is what that looks like.
Invalid consent is worse than no consent
Under the Act, a consent request that breaks the form rules has no binding effect at all, and the data controller may no longer collect, use or disclose the data. A tidy banner is the cheapest insurance there is.
The fines come in tiers
Administrative fines run to THB 1 million, THB 3 million or THB 5 million depending on what was breached, with the top tier reserved for sensitive data. Misusing sensitive data can also be a criminal offence.
Also selling into Singapore? See what the PDPA there requires →
Add a PDPA-ready banner to your site, free.
Records
A record of every consent, ready if the PDPC asks
Every choice is recorded with when it was made and which categories the visitor accepted or rejected. You can export the log as a CSV file whenever you need it.
The visitor opted out, so advertising scripts were blocked.
The visitor didn’t opt out, so scripts ran as normal.
Consent log
Because an invalid request voids the consent, being able to show what was asked and what was answered is the whole point of the log.
FAQ
Thailand privacy questions, answered
Can't find what you need? Talk to our team at web@consentbit.com.
It applies to the collection, use and disclosure of personal data in Thailand, and to businesses outside Thailand that offer goods or services to people there or monitor their behaviour in the country. There is no size threshold.
The PDPA doesn’t name cookies. It requires a lawful basis before you collect personal data, and consent is the usual basis for analytics and advertising cookies. A banner is how most sites make that request and record the answer.
It has to be explicit, made in writing or by electronic means, presented separately from other matters, in clear and plain language, and not misleading about the purpose. It must be freely given, and withdrawal has to be as easy as giving it.
The Act says a request that doesn’t follow those rules has no binding effect, and the controller may no longer collect, use or disclose the data. In other words, a badly built banner leaves you with nothing to rely on.
Yes. Section 24 lists six alternatives, including legitimate interests of the controller, performance of a contract, legal obligations, and preventing danger to life or health. Sensitive data is treated separately and usually needs explicit consent.
Administrative fines go up to THB 1 million, THB 3 million or THB 5 million depending on the provision breached, with the highest tier for sensitive data. Courts can also order punitive damages of up to twice the actual compensation, and misuse of sensitive data can carry imprisonment.
They share a name and little else. Thailand follows the GDPR structure, with explicit consent and formal rules about how it is requested. Singapore allows browser settings to stand in for consent and treats cookies supporting a requested service as not needing it.
See what Singapore’s PDPA requires →
Yes. ConsentBit has a free plan, and every paid plan comes with a 14-day free trial. See pricing for what each plan includes. See pricing →
Ask the way the Act describes
ConsentBit makes the request separate and plain, holds the trackers until a visitor agrees, makes withdrawing as easy as agreeing, and records every choice.
This page is a general overview of Thailand’s Personal Data Protection Act B.E. 2562 (2019), not legal advice. The PDPA covers far more than website tracking, including data subject requests, breach notification, data protection officers and transfers outside Thailand, which sit outside what a consent banner handles.