Thailand

The Data Controller must notify the Office of any personal data breach without delay and, where feasible, within 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of the affected individuals. Where the breach is likely to cause high risk, the Data Controller must also notify the data subject without delay, together with remedial measures.

This section number is inferred from a cross-reference in the retention clause rather than confirmed against its own article heading directly.

The Personal Data Protection Act (PDPA) is Thailand's comprehensive personal-data statute, published in the Government Gazette 27 May 2019 and, after enforcement of most operative provisions was twice postponed, fully enforceable since 1 June 2022. Lawful basis is consent by default under Section 24, a General Data Protection Regulation (GDPR)-style model, with heightened requirements for sensitive categories under Section 26. The Personal Data Protection Committee and its Office enforce the Act. The text cited is the Ministry of Digital Economy and Society (MDES) copy of the Act.

Section 28 requires that where a Data Controller sends or transfers personal data to a foreign country, the destination country or international organization must have an adequate data protection standard and the transfer must follow rules the Personal Data Protection Committee prescribes, subject to exceptions including legal compliance, informed consent where the data subject is told the destination's standard is inadequate, and contract necessity. This is an adequacy-based restriction; no data-localization mandate was found.

The Personal Data Protection Committee and its Office enforce the Act with administrative fines that vary by provision violated: up to Baht 5,000,000 for Section 26 sensitive-category, Section 27 use or disclosure, and Section 28/29 cross-border transfer violations (Section 84 and Section 87), up to Baht 1,000,000 for data processor non-compliance (Section 85), and up to Baht 3,000,000 under Section 86.

Separately, Section 77 creates civil liability for a Data Controller or Data Processor whose PDPA operation causes damage, subject to narrow defenses of force majeure, the data subject's own act, or compliance with an official order, and Section 78 lets the court additionally order punitive damages up to twice the actual compensation awarded. This is a genuine private right of action with punitive-damages exposure, distinct from the administrative fine regime.

Section 26 prohibits collecting personal data on race, ethnic origin, political opinions, religious or philosophical beliefs, sexual behavior, criminal records, health data, disability, trade union information, genetic data, or biometric data, or any data that may affect the data subject in the same manner, without the data subject's explicit consent, subject to enumerated exceptions such as vital interest and substantial public interest.

Biometric data is defined as data arising from technical processing of a person's physical or behavioral characteristics used to identify them, with facial recognition, iris recognition, and fingerprint recognition data given as express statutory examples. A voiceprint is not named as an express example, but the same-manner catch-all and the general physical-or-behavioral-dominance definition plausibly reach it; no provision was found excluding voice.

Section 5 punishes illegally accessing a computer system that has specific security measures not intended for the accessor's use. Section 7 punishes the same act against computer data.

Section 6 punishes knowing another person's security measures and illegally disclosing them in a manner likely to cause injury, and Section 8 punishes illegally intercepting, by electronic or any other means, computer data of another person transmitting in a computer system where that data is not for public benefit or available to others.

The Act's own Section 2 sets commencement at thirty days after publication in the Government Gazette, but the International Commission of Jurists' translation of the Act's original 2007 text does not itself state that publication date.

Section 15 gives a copyright owner the exclusive right of reproduction or adaptation and of communication to the public. Section 32 paragraph one excepts an act against a copyright work that does not conflict with a normal exploitation of the work by the owner and does not unreasonably prejudice the owner's legitimate rights, the general fair-use-style ground every other exception in Part 6 sits under.

Thailand has not enacted a specific text-and-data-mining exception comparable to the EU's Articles 3-4 of Directive 2019/790, so an automated, bulk reproduction of copyrighted text for model training must be tested against this general, fact-sensitive standard rather than against a dedicated text and data mining (TDM) rule, and no reported Thai case has applied Section 32 to that fact pattern.

Section 32/2 separately excepts a reproduction that must exist for copies already lawfully acquired to run in a computer system, a technical, incidental-copy exception rather than a TDM one. The Copyright Act creates no sui generis database right.

A cinema-exhibition licensee must post the age-rating category assigned to each film in a clearly visible place and must not knowingly or negligently admit a person below the age set for that category during its screening. A film rental, exchange, or sale licensee must not rent, exchange, or sell a film in that category to a person below that age.

The most restricted viewable category is reserved to persons twenty years of age or older, and a licensee who violates either duty is liable to a fine.

Section 32 paragraph two (4) excepts news reporting through mass media that acknowledges the ownership of copyright in the work reported on. Section 33 separately excepts a reasonable recitation, quotation, copying, emulation, or reference in part from a copyright work, again with an acknowledgement of ownership.

Both exceptions are subject to Section 32 paragraph one's general condition that the act not conflict with a normal exploitation of the work and not unreasonably prejudice the owner's legitimate rights, so an aggregator reproducing more than a short, attributed excerpt, or reproducing enough that it substitutes for the original article, sits outside a plain reading of either ground.

Thailand has no separate press-publisher neighbouring right and no compelled bargaining code requiring a platform to pay a publisher for carrying its headlines or snippets.