PDPA and your own website, what a small business really needs
The law has been fully in force since June 2022. Most small business sites in Thailand still do not meet it.
PDPA · 2026-08-19
Thailand's Personal Data Protection Act applies to any website that collects personal data, and a contact form asking for a name and an email already counts. A small business site needs four things: a privacy notice in the language of the site, a lawful basis for each purpose, real consent before any tracking or map loads, and a working way for a person to ask what you hold. Fines reach 5 million baht, and the criminal provisions can reach an individual.
The scope, in numbers
- 5 M ฿ maximum administrative fine under the PDPA
- 1 name is enough to bring a website inside the law, no minimum volume applies
- June 2022 the act has been fully enforceable since then, the grace period is long over
The privacy notice is the part everyone copies wrongly
A notice taken from a foreign site names the wrong law, the wrong authority and often a data protection officer who does not exist. It has to say who you are, what you collect, why, on what basis, how long you keep it, who else sees it, and how someone contacts you about it. In Thai for a Thai site. A translated European text is not compliant, it is only long.
Consent means before, not after
A banner that says "by using this site you agree" is not consent. Google Analytics, the Meta pixel and an embedded Google Map all send data before a visitor has chosen anything, and all three must stay switched off until they choose. That is a technical setting, not a paragraph. The map on our own contact page loads only after a click, and that is exactly why.
What a small business does not need
Most small businesses do not need a data protection officer. The requirement applies to public authorities, to those whose core activity is large-scale regular monitoring, and to those handling sensitive data at scale. A spa with a booking form is none of these. Being told you must appoint one is usually a sign that someone is selling a service you do not need.
Do the notice properly, then stop
Spend the effort on a correct privacy notice and on consent that actually blocks the trackers, then leave the rest alone. The elaborate compliance packages sold to small businesses in Thailand solve problems those businesses do not have, and the money is better spent on photos of your own shop. If you take card payments or handle health data, that is the point where proper advice is worth paying for.
PDPA is part of the build
Every site we build ships with a privacy notice in both languages, a consent dialogue that really blocks, and a map that waits for a click.
See how we build websites