Thailand

The Data Controller must notify the Office of any personal data breach without delay and, where feasible, within 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of the affected individuals. Where the breach is likely to cause high risk, the Data Controller must also notify the data subject without delay, together with remedial measures.

This section number is inferred from a cross-reference in the retention clause rather than confirmed against its own article heading directly.

The Personal Data Protection Act (PDPA) is Thailand's comprehensive personal-data statute, published in the Government Gazette 27 May 2019 and, after enforcement of most operative provisions was twice postponed, fully enforceable since 1 June 2022. Lawful basis is consent by default under Section 24, a General Data Protection Regulation (GDPR)-style model, with heightened requirements for sensitive categories under Section 26. The Personal Data Protection Committee and its Office enforce the Act. The text cited is the Ministry of Digital Economy and Society (MDES) copy of the Act.

Section 28 requires that where a Data Controller sends or transfers personal data to a foreign country, the destination country or international organization must have an adequate data protection standard and the transfer must follow rules the Personal Data Protection Committee prescribes, subject to exceptions including legal compliance, informed consent where the data subject is told the destination's standard is inadequate, and contract necessity. This is an adequacy-based restriction; no data-localization mandate was found.

The Personal Data Protection Committee and its Office enforce the Act with administrative fines that vary by provision violated: up to Baht 5,000,000 for Section 26 sensitive-category, Section 27 use or disclosure, and Section 28/29 cross-border transfer violations (Section 84 and Section 87), up to Baht 1,000,000 for data processor non-compliance (Section 85), and up to Baht 3,000,000 under Section 86.

Separately, Section 77 creates civil liability for a Data Controller or Data Processor whose PDPA operation causes damage, subject to narrow defenses of force majeure, the data subject's own act, or compliance with an official order, and Section 78 lets the court additionally order punitive damages up to twice the actual compensation awarded. This is a genuine private right of action with punitive-damages exposure, distinct from the administrative fine regime.

Section 26 prohibits collecting personal data on race, ethnic origin, political opinions, religious or philosophical beliefs, sexual behavior, criminal records, health data, disability, trade union information, genetic data, or biometric data, or any data that may affect the data subject in the same manner, without the data subject's explicit consent, subject to enumerated exceptions such as vital interest and substantial public interest.

Biometric data is defined as data arising from technical processing of a person's physical or behavioral characteristics used to identify them, with facial recognition, iris recognition, and fingerprint recognition data given as express statutory examples. A voiceprint is not named as an express example, but the same-manner catch-all and the general physical-or-behavioral-dominance definition plausibly reach it; no provision was found excluding voice.

Section 5 punishes illegally accessing a computer system that has specific security measures not intended for the accessor's use. Section 7 punishes the same act against computer data.

Section 6 punishes knowing another person's security measures and illegally disclosing them in a manner likely to cause injury, and Section 8 punishes illegally intercepting, by electronic or any other means, computer data of another person transmitting in a computer system where that data is not for public benefit or available to others.

The Act's own Section 2 sets commencement at thirty days after publication in the Government Gazette; the Act was published in the Government Gazette on 18 June 2007, thirty days before its 18 July 2007 commencement.

The amending Act (No. 2) B.E. 2560 (2017), published in the Government Gazette on 24 January 2017 and commencing 120 days later, left the wording and penalties of Sections 5 to 8 unchanged; its changes reach other matters, including updating the administering ministry's name to the Ministry of Digital Economy and Society.

Section 15 gives a copyright owner the exclusive right of reproduction or adaptation and of communication to the public. Section 32 paragraph one is a free-standing exception for an act that does not conflict with a normal exploitation of the work by the owner and does not unreasonably prejudice the owner's legitimate rights, an open-ended test rather than a filter on the specific acts paragraph two goes on to list.

Paragraph two's own list of specific permitted acts, research or study, personal use, comment or criticism, news reporting, and the others through Section 32/4, names no text-and-data-mining item, so an automated, bulk reproduction of copyrighted text for model training must be tested against paragraph one's general standard rather than against a dedicated text and data mining (TDM) rule.

Section 32/2, added by the Copyright Act (No. 2) B.E. 2558 (2015), separately excepts a reproduction that must exist for copies already lawfully acquired to run in a computer system, a technical, incidental-copy exception rather than a TDM one. Section 12 vests copyright in a compilation of data made by selection or arrangement that is not an imitation of another's work, an originality-conditioned right rather than a sui generis database right.

Section 44 requires an Organization of Critical Information Infrastructure to prepare a Code of Practice and standard framework for Maintaining Cybersecurity without delay. Section 44 requires that Code of Practice to include a plan for examining and assessing risks at least once per year and a plan for coping with Cyber Threats.

Section 45 gives an Organization of Critical Information Infrastructure a duty to prevent, cope with and mitigate risks from Cyber Threats in accordance with its Code of Practice and standard framework. Section 46 requires the organization to notify the Office of the names of its executive officials and operational officials for coordination.

Section 49 gives the National Cybersecurity Committee the power to prescribe by notification the characteristics of organizations that have a mission or provide services in national security, substantive public service, banking and finance, information technology and telecommunications, transportation and logistics, energy and public utilities, public health, and others the Committee prescribes.

Section 52 requires the organization to notify the Office, its Supervising or Regulating Organization and the coordinating organization of the names and contact information of the owner, the person possessing the computer and the person monitoring the computer system, within thirty days of the Committee's notification.

Section 54 requires the organization to conduct a risk assessment on Maintaining Cybersecurity at least once per year and to submit a summary report to the Office within thirty days after the operation has been finished. Section 56 requires the organization to establish a mechanism or process to monitor Cyber Threats or Cybersecurity Incidents related to its Critical Information Infrastructure.

Section 53 requires the Supervising or Regulating Organization to examine the minimum cybersecurity standard of the organizations under its supervision. Under section 53 the Cybersecurity Regulating Committee may notify the chief executive of a private organization to make correction and comply with the standards. An Organization of Critical Information Infrastructure is a government agency or private organization that has a mission of or provides a Critical Information Infrastructure service. Section 2 brings the Act into force on the day following the date of its publication in the Government Gazette.

Section 57 requires an Organization of Critical Information Infrastructure, in the event of a Cyber Threat significantly occurring to its system, to report to the Office and the Supervising or Regulating Organization and to cope with the Cyber Threat, and allows the Cybersecurity Regulating Committee to prescribe the criteria and method of the reporting.

Section 58 requires a Government Agency or an Organization of Critical Information Infrastructure, where there is or may be a Cyber Threat to its information system, to examine its related information, computer data and computer system, to prevent, cope with and mitigate the risks, and to notify the Office and its Supervising or Regulating Organization without delay.

Section 73 provides that an Organization of Critical Information Infrastructure that does not report a Cyber Threat incident in accordance with section 57 without reasonable cause is subject to a fine not exceeding Baht two hundred thousand. The Act places section 73 in its chapter of penalty provisions.

A Cyber Threat is any action or unlawful undertaking by using the computer, computer system, or undesirable program with an intention to cause any harm to the computer system, computer data, or other relevant data, and be an imminent threat to damage or affect operation of the computer, computer system, or other relevant data.

An Organization of Critical Information Infrastructure is a government agency or private organization that has a mission of or provides a Critical Information Infrastructure service. Section 2 brings the Act into force on the day following the date of its publication in the Government Gazette.

A cinema-exhibition licensee must post the age-rating category assigned to each film in a clearly visible place and must not knowingly or negligently admit a person below the age set for that category during its screening. A film rental, exchange, or sale licensee must not rent, exchange, or sell a film in that category to a person below that age.

The most restricted viewable category is reserved to persons twenty years of age or older, and a licensee who violates either duty is liable to a fine.

Section 32 paragraph two (4) excepts news reporting through mass media that acknowledges the ownership of copyright in the work reported on. Section 33 separately excepts a reasonable recitation, quotation, copying, emulation, or reference in part from a copyright work, again with an acknowledgement of ownership.

Both exceptions are subject to Section 32 paragraph one's general condition that the act not conflict with a normal exploitation of the work and not unreasonably prejudice the owner's legitimate rights, so an aggregator reproducing more than a short, attributed excerpt, or reproducing enough that it substitutes for the original article, sits outside a plain reading of either ground.

Thailand has no separate press-publisher neighbouring right and no compelled bargaining code requiring a platform to pay a publisher for carrying its headlines or snippets.