On 16 July 2026, the Personal Data Protection Committee (PDPC) Notification on access to and copies of personal data was published in the Royal Gazette. The Notification will take effect on 14 September 2026.
Section 30 of Thailand’s Personal Data Protection Act B.E. 2562 (2019) (PDPA) already gives data subjects the right to access and obtain copies of their personal data held by a data controller. It also allows them to request disclosure of the source of personal data where the data was obtained without their consent.
The new Notification provides more detailed procedures for handling these requests.
Among other requirements, data controllers must review a request and verify the requester’s identity or authority within 15 days of receipt. Where supporting information is incomplete, the requester must be given at least 10 days to provide the required information.
Once the applicable requirements are met, the controller must respond without delay and generally within 30 days. Where necessary, including where a request involves a large volume of personal data, the response period may be extended by up to a further 30 days, with the requester informed of the extension and reasons.
The Notification also addresses circumstances in which access may be refused, including where disclosure is restricted by law or a court order or would adversely affect the rights and freedoms of another person. Where only part of the information is affected, controllers should consider whether the remaining information can be provided after the protected information has been removed or redacted.
Access should generally be provided without charge where the data can be supplied electronically without special media or direct delivery costs. Where a fee is permitted, it must be reasonable and remain within the limits prescribed by the Notification.
Controllers are also required to maintain records relating to access requests, supporting evidence and actions taken, including refusals, for at least two years.
Organizations operating in Thailand should review their existing data subject request procedures, particularly their identity verification, response timelines, internal approval processes, secure disclosure methods and record-keeping practices, before the Notification takes effect on 14 September 2026.
This article is provided for general information only and does not constitute legal advice.