PDPA Compliance Guide (Thailand)

Thailand's Personal Data Protection Act B.E. 2562 (PDPA) was enacted in 2019 and came into full enforcement on 1 June 2022. It is administered by the Personal Data Protection Committee (PDPC) under the Ministry of Digital Economy and Society. Consenti supports Thailand PDPA via regulation: 'pdpa-th'.

Official references

• Thailand PDPC — Personal Data Protection Committee
• Royal Gazette — PDPA B.E. 2562 (Thai)

Key requirements

Enabling Thailand PDPA mode

Frontend widget

new ConsentiSetup({
  compliance: { type: 'opt-in' },
})

Profile configuration (dashboard)

{
  "regulation": "pdpa-th"
}

Unlike DPDPA (India, which has a dedicated dpdpa profile block rendered automatically), Thailand's PDPA has no dedicated metadata field yet. Add your Data Controller name and DPO contact directly in preferenceModal.htmlText via profileOverride or the dashboard's text editor.

Cross-border transfers

PDPA Section 28 restricts sending personal data to third countries without adequate protection. Consenti's backend stores data in SQLite (local) by default. If you use the MongoDB or PostgreSQL adapter with a foreign host, ensure your Data Processing Agreement covers PDPA cross-border transfer requirements.

What Consenti does — and what it doesn't

Everything above is the consent-collection UX layer: opt-in capture, per-category records, withdrawal, and erasure. Thailand's PDPA imposes obligations beyond what a consent widget can satisfy on its own. Consenti does not:

• Determine or execute the cross-border transfer legal basis (adequacy determination, SCCs, or BCRs) required by Section 28 — that's a legal/contractual step you complete outside the product
• Appoint a Data Protection Officer — mandatory for large-scale or sensitive-data processing under PDPA, and an organisational hire, not a config option
• Distinguish the two minor-consent tiers PDPA requires — parental consent under age 10 versus at-minimum assent for ages 10–20. Consenti's age gate is a single minimum-age/parental-consent threshold; the assent tier for 10–20 year-olds needs a manual process alongside it
• Guarantee data localisation — whether your storage adapter's host counts as an adequate-protection destination is a legal determination, not something the widget verifies

Operator checklist

Beyond configuring Consenti's opt-in consent group, an operator with PDPA exposure still needs to:

1. Appoint a Data Protection Officer if your scale or data category triggers the mandatory threshold, and publish their contact alongside the Data Controller name mentioned above
2. Confirm the cross-border transfer legal basis before enabling a MongoDB/PostgreSQL adapter hosted outside Thailand, or before sending data to any foreign processor
3. Build a separate assent flow for the 10–20 age tier if you knowingly serve users in that range — the built-in age gate only distinguishes "requires parental consent" from "doesn't"
4. Keep the cross-border and Data Controller disclosures in preferenceModal.htmlText current as your actual vendor/processor list changes

Erasure

DELETE /consenti/api/v1/consent/:visitorId

For the widget-side "Forget me" button and the events both sides fire, see the Right to Erasure guide.