Data protection
Does Thailand's PDPA Apply to Overseas Companies?
Published 6 Oct 2026
Yes, in two situations. Thailand's Personal Data Protection Act B.E. 2562 (PDPA) applies to a controller or processor outside Thailand that collects, uses or discloses personal data of people in Thailand when it offers them goods or services, whether or not they pay, or when it monitors their behaviour in Thailand (section 5). Such an overseas controller must generally appoint a representative in Thailand.
Who this is for
Software, platform, e-commerce and digital-asset businesses based outside Thailand that have Thai users or customers, and Thai companies that use overseas group entities to process customer data.
When the PDPA reaches a company outside Thailand
| Situation | Does the PDPA apply? | Source |
|---|---|---|
| Controller or processor in Thailand | Yes, wherever the processing takes place | Section 5 para 1 |
| Overseas company offering goods or services to people in Thailand, paid or free | Yes | Section 5 para 2(1) |
| Overseas company monitoring the behaviour of people in Thailand | Yes | Section 5 para 2(2) |
The representative in Thailand
An overseas controller caught by section 5 must appoint a representative in Thailand in writing, located in Thailand and authorised to act for it without limitation of liability (section 37(5)). Section 38 exempts state agencies designated by the regulator, and controllers that do not process sensitive data and do not hold large volumes of personal data as the regulator defines.
Questions to answer first
- Do we offer goods or services to people in Thailand, or monitor their behaviour there?
- Which personal data do we collect from them, for what purposes, and on what basis?
- Are we a controller, a processor, or both?
- Do we need a representative in Thailand, or does an exemption fit?
- Where is the data stored and transferred?
What Corporly does here
For software and platform businesses, data questions are part of Technology Business Support and Platform and Online Business Support: an issue map first, then the notices, processing records and agreements it calls for. Each stage is scoped and quoted before work starts.
Frequently asked questions
Questions about Data protection
It can. Section 5 covers offering goods or services to people in Thailand whether or not they pay.
Map your data position before you scale in Thailand
Describe what you collect and from whom. The first conversation is free; any written work is scoped and quoted first.