Thailand: PDPA Enforcement Escalates with THB 21.5M in Fines and Tightened Cross-Border Transfer Rules
Thailand's Personal Data Protection Committee (PDPC) has decisively shifted from awareness-building to active enforcement, imposing over THB 21.5 million (approximately USD 655,000) in administrative fines across five cases and eight penalties announced on August 1, 2025. The Hogan Lovells analysis crystallizes the message: "'zero data breach' stance suggests that even minor compliance lapses may attract scrutiny."
Five Landmark Enforcement Cases
-
State Agency (THB 153,120): Cyberattack on a web application exposed 200,000 records. Both the agency and its system developer were fined for lacking privacy-by-design and breach protocols.
-
IT Retailer (THB 7 million): Customer data leaked and exploited by fraudulent call centers. Fined for no DPO appointment, failure to report breach, and inadequate security — the heaviest single penalty.
-
Cosmetics Company (THB 2.5 million): Failed to implement adequate security and notify the PDPC of a breach.
-
Toy Company and Data Processor (THB 3.5 million combined): Notably, the data processor was fined THB 3 million versus THB 500,000 for the controller — a landmark in processor accountability.
-
Private Hospital (THB 1.21 million): Medical records improperly handled by a document-destruction contractor.
Cross-Border Data Transfer Rules: Significantly Tightened
On September 29, 2025, the PDPC issued its Binding Corporate Rules (BCRs) Regulations and approved the first two companies' BCRs the following day. However, the adequacy route under Section 28 remains theoretical — no adequacy list has been published. As Enersys notes:
"Since the PDPC has not yet published an adequacy list, all cross-border transfers must be treated as going to non-adequate jurisdictions, requiring appropriate safeguards in every case."
The PDPC reported 2,672 PDPA-related complaints as of January 2026. Key compliance imperatives include data flow mapping, SCCs or BCRs for all cross-border transfers, vendor agreement audits, and breach response protocols. The 72-hour breach notification obligation to the PDPC is actively enforced. Criminal penalties including imprisonment of up to one year also apply — a feature absent in the GDPR.