Thailand's Personal Data Protection Committee (PDPC) published a notification in the Government Gazette on 16 July 2026 setting detailed rules for data subjects' right of access. Baker McKenzie reports it takes effect 60 days later, on 14 September 2026, so it is now in force (Baker McKenzie). It is a procedural measure, but it will shape how firms handle Thai users' data.
What section 30 already said
The Personal Data Protection Act B.E. 2562 (2019) gave data subjects the right to request access to and a copy of their personal data. They can also request disclosure of how data obtained without their consent was acquired. Section 30 lets a controller refuse only where law or a court order permits and where access would adversely affect others' rights and freedoms. It requires controllers to record any refusal with reasons, and to act "without delay, but... not exceed thirty days" from receipt. It also lets the Committee prescribe rules, including extensions of that period (PDPA, unofficial translation, KMUTT copy). The statute left the mechanics open. Who may ask, through what channel, with what identification and at what price were all unspecified. The new notification fills those gaps.
What the notification requires
According to Tilleke & Gibbins, the notification covers requests for copies of personal data and for the source of data collected without consent. Requests may come from the data subject or an authorized representative. Controllers must offer at least two channels: in-person submission at the business location and registered mail. Electronic channels are optional. The PDPA's reach extends to controllers outside Thailand that offer goods or services to people in Thailand, and Tilleke advises onshore and offshore controllers alike to gap-assess against the notification (Tilleke & Gibbins).
The law-firm summaries describe the following mechanics:
- Controllers review a request within 15 days and give the requester at least 15 days to fix an incomplete one. An uncorrected request may be treated as abandoned.
- Once verified, a request must be fulfilled within 30 days. That can be extended by 30 days for large-volume or complex requests, with notice.
- Controllers may require official ID. Representatives must show authorization plus ID for themselves and the data subject.
- Electronic access without special costs should generally be free. Other fees must be reasonable and not exceed actual cost.
- Request and response records must be kept for at least two years.
Baker McKenzie adds that the scope reaches information in privacy notices and records of processing activities, and that charges may apply to repetitive or excessive requests.
The strongest case for the rules
The case for detailed procedure is serious. A right that has no workable process is largely theoretical. The PDPC's own enforcement record shows how often basic compliance fails. In August 2025 it announced eight fines in five cases, citing missing security measures, unreported breaches and absent data protection officers (Tilleke & Gibbins). The PDPC's PDPA Center had logged 2,672 complaints by January 2026, mostly about data minimization and lawful basis. A defined timeline and a mandatory fallback channel give individuals something enforceable, and they stop controllers from ignoring requests through a web form that is never read.
Where proportionality is tested
We support clear rules, and several choices here are sensible. The final text refuses requests that are manifestly unfounded or unreasonably burdensome, lets controllers extend deadlines for complex cases, and makes electronic access free. Those are the safeguards a pro-innovation regime needs. The 60-day lead time is also more generous than the 30 days proposed in the April consultation draft, which opened on 16 April 2026 (Mondaq). Regulators listened on timing.
Three concerns remain.
First, the paper-first channel design. Requiring in-person and registered-mail intake while treating electronic channels as optional made sense for brick-and-mortar controllers. For a digital service with no Thai office, it is a poor fit. The summaries do not describe a separate rule for offshore controllers. How an offshore controller offers submission "at its business location" is therefore unclear, and we have not seen guidance resolving it. Small firms and start-ups, the part of the digital economy Thailand most wants to grow, will bear the fixed cost of staffing a postal-and-counter process nobody may use.
Second, identity verification cuts both ways. Demanding official ID protects people from impostors seeking someone else's data. Collecting ID copies also creates a new honeypot of sensitive records. The notification permits alternatives such as digital authentication, provided they do not unreasonably obstruct rights. Controllers should use that flexibility rather than default to copying passports.
Third, the clock is ambiguous. The statute counts 30 days from receipt of the request. Both Tilleke and Baker McKenzie describe the notification as running 30 days from a verified or complete request. That is workable, but only if controllers use the 15-day review step in good faith, not as a way to delay.
What to do now
Controllers serving Thai users should do four things before they receive their first request:
- Map where Thai personal data sits.
- Name a person who owns requests.
- Adopt a verification method that minimizes new data collection.
- Publish the two required channels.
The PDPC should do two things. It should issue guidance on how offshore controllers meet the physical-channel rule. It should also let electronic channels count as primary where a controller operates entirely online. A regime that scales with the size and form of the business will protect people better than one that makes every controller run a post office.