PDPA and your own website, what a small business really needs
The law has been fully in force since June 2022. When researchers checked 384 Thai SME websites shortly before that, more than half collected personal data without any privacy notice.
PDPA · 2026-10-21
By David Lemke
Thailand's Personal Data Protection Act applies to any website that collects personal data, and a contact form asking for a name and an email already counts. A small business site needs four things: a privacy notice in plain language your visitors can read, a lawful basis for each purpose, real consent before any advertising or analytics tracking loads, and a working way for a person to ask what you hold. Administrative fines reach 1 million baht for a missing privacy notice and 5 million where sensitive data such as health information is involved. Prison terms apply to misuse of sensitive data, and a director who caused the offence can be punished personally.
The scope, in numbers
- 5 M ฿ highest administrative fine under the PDPA, where sensitive data is involved
- 1 name is enough to bring a website inside the law, no minimum volume applies
- June 2022 the act has been fully enforceable since then, the grace period is long over
The privacy notice is the part everyone copies wrongly
A notice taken from a foreign site names the wrong law, the wrong authority and often a data protection officer who does not exist. It has to say who you are, what you collect, why, on what basis, how long you keep it, who else sees it, and how someone contacts you about it. In plain language your visitors read, which for a Thai site means Thai. A translated European text is not compliant, it is only long.
Consent means before, not after
A banner that says "by using this site you agree" is not consent. Google Analytics, the Meta pixel and an embedded Google Map all send data before a visitor has chosen anything. On the sites I build, all three stay switched off until the visitor chooses. That is a technical setting, not a paragraph. The map on my own contact page loads only after a click.
What a small business does not need
Most small businesses do not need a data protection officer. The requirement applies to public authorities, to businesses whose core activity is regular monitoring of personal data on a large scale, which the PDPC sets at 100,000 people or more, and to businesses whose core activity is processing sensitive data such as health records. A spa with a booking form is none of these. Being told you must appoint one is usually a sign that someone is selling a service you do not need.
Do the notice properly, then stop
Spend the effort on a correct privacy notice and on consent that actually blocks the trackers, then leave the rest alone. The elaborate compliance packages sold to small businesses in Thailand solve problems those businesses do not have, and the money is better spent on photos of your own shop. If you take card payments or handle health data, that is the point where proper advice is worth paying for.
Sources
- Personal Data Protection Act B.E. 2562 (2019), Ministry of Digital Economy and Society, 27 May 2019
- Update on Thai Personal Data Protection Law: Clarification on Requirement of Data Controller and Data Processor that is Required to Designate the Data Protection Officer, Nagashima Ohno & Tsunematsu, 11 October 2023
- Personal data protection compliance assessment: A privacy policy scoring approach and empirical evidence from Thailand's SMEs, Chatsuwan et al., Heliyon, October 2023
PDPA is part of the build
Every site I build ships with a privacy notice in both languages, a consent dialogue that really blocks, and a map that waits for a click.
See web design in Chiang Mai