What is the PDPA and how does it apply to business websites?
PDPA stands for the Personal Data Protection Act B.E. 2562 (2019), a law that protects the personal data of individuals and prohibits collecting, using or disclosing personal data without the data owner's consent
A business website that collects customer data such as names, emails, phone numbers or addresses, or uses cookies to track user behavior, falls under the PDPA and must strictly comply with its requirements
Personal data business websites typically collect
Most business websites collect several types of personal data, which can be grouped as follows
General data from sign-ups or enquiries
Basic data collected through forms, such as name, email, phone number and address, plus company details for B2B businesses. This data is typically used for communication, sending promotions or after-sales service
Data from cookies and behavior tracking
Most websites use cookies to remember visitors' use and track behavior through Google Analytics, Facebook Pixel or other digital marketing tools, but under the PDPA businesses must inform users and obtain consent before storing cookies
Transaction data for e-commerce
E-commerce websites collect additional data such as order history, payment details and delivery addresses, which must be strictly protected under the PDPA to prevent leaks or misuse
Why business websites must comply with the PDPA
Avoid legal penalties
Non-compliance with the PDPA carries severe penalties: criminal fines of up to 1 million baht or up to 1 year in prison, administrative fines of up to 5 million baht, and civil liability to compensate data owners
Build trust and a good reputation
As consumers care more about privacy, a website that properly complies with the PDPA — with a Privacy Policy, Cookie Consent Banner and transparent data management — builds customer confidence and trust
An international standard every business should meet
Thailand's PDPA was inspired by the EU's GDPR, a global data protection standard, so PDPA compliance shows professionalism and readiness to do business internationally
What a website must prepare for the PDPA
Privacy Policy
A document explaining what data the business collects, why, and how it will be used, written clearly and simply
Cookie Consent Banner
A banner that appears on a user's first visit asking permission to store cookies, which users can accept or decline
Data subject rights management
A system that lets customers request access to, correction, deletion or transfer of their personal data — the PDPA requires a response within 30 days
Security systems
SSL certificates, data encryption and restricting data access to authorized personnel
DPO (Data Protection Officer)
A Data Protection Officer, required for large organizations or businesses that hold large amounts of data
FAQ — Frequently Asked Questions
Yes. Regardless of size, any business that collects personal data from customers or website users must comply with the PDPA. Every business with a website that uses cookies or collects customer contact details needs at least a Privacy Policy and a Cookie Consent Banner
There are 3 types of penalty: criminal (up to 1 year in prison or a fine of up to 1 million baht), administrative (fines of up to 5 million baht) and civil (compensation to data owners). Non-compliance also harms the business's long-term reputation and credibility
It depends on the website's complexity. A basic Cookie Banner and Privacy Policy may start at 10,000–30,000 baht, while e-commerce sites that store a lot of data may cost more
The PDPA isn't an obstacle — it's a chance to build trust
The PDPA may seem like an extra burden for businesses, but seen positively it's an opportunity to build credibility and stand out. A website that properly complies with the PDPA shows professionalism and care for customer security, giving you a competitive edge and long-term customer confidence