Material Applicability

The PDPA's material scope is defined through several key exemptions that limit its applicability:

Personal and Domestic Activities

PDPA Section 4(1):

"This Act shall not apply to: (1) the collection, use, or disclosure of Personal Data by a Person who collects such Personal Data for personal benefit or household activity of such Person only;"

Original (Thai):

"พระราชบัญญัตินี้ไม่ให้ใช้บังคับแก่: (1) การเก็บรวบรวม ใช้ หรือเปิดเผยข้อมูลส่วนบุคคลของบุคคลที่ทำการเก็บรวบรวมข้อมูลส่วนบุคคลเพื่อประโยชน์ส่วนตนหรือเพื่อกิจกรรมในครอบครัวของบุคคลนั้นเท่านั้น"

This exemption covers personal data processing for purely private purposes, such as maintaining personal contact lists or family photo collections.

National Security and Law Enforcement

PDPA Section 4(2):

"This Act shall not apply to: (2) operations of public authorities having the duties to maintain state security, including financial security of the state or public safety, including the duties with respect to the prevention and suppression of money laundering, forensic science or cybersecurity;"

This exemption covers activities related to national security, law enforcement, and public safety operations.

Media, Arts, and Literature

PDPA Section 4(3):

"This Act shall not apply to: (3) a Person or a juristic person who uses or discloses Personal Data that is collected only for the activities of mass media, fine arts, or literature, which are only in accordance with professional ethics or for public interest;"

Judicial Proceedings

PDPA Section 4(5):

"This Act shall not apply to: (5) trial and adjudication of courts and work operations of officers in legal proceedings, legal execution, and deposit of property, including work operations in accordance with the criminal justice procedure;"

Credit Bureau Operations

PDPA Section 4(6):

"This Act shall not apply to: (6) operations of data undertaken by a credit bureau company and its members, according to the law governing the operations of a credit bureau business."

Territorial Applicability

The PDPA's territorial scope is established through two main criteria:

Establishment Criterion

PDPA Section 5(1):

"This Act applies to the collection, use, or disclosure of Personal Data by a Data Controller or a Data Processor that is in the Kingdom of Thailand, regardless of whether such collection, use, or disclosure takes place in the Kingdom of Thailand or not."

Targeting Criterion

PDPA Section 5(2):

"In the event that a Data Controller or a Data Processor is outside the Kingdom of Thailand, this Act shall apply to the collection, use, or disclosure of Personal Data of data subjects who are in the Kingdom of Thailand, where the activities of such Data Controller or Data Processor are the following activities:

(1) the offering of goods or services to the data subjects who are in the Kingdom of Thailand, irrespective of whether the payment is made by the data subject;

(2) the monitoring of the data subject's behavior, where the behavior takes place in the Kingdom of Thailand."