On 16 July 2026, the Thai Parliament opened a new draft amendment to the Personal Data Protection Act B.E. 2562 (2019) (PDPA) for public consultation. The proposed amendments seek to address several practical and legal uncertainties under the existing framework, particularly concerning the scope of government agencies, exemptions from PDPA requirements, and the legal bases available for processing personal data. Stakeholders may submit comments during the consultation period, which is scheduled to close on 15 August 2026.
A key proposal is the introduction of a specific definition of “government agency” for purposes of the PDPA. The proposed definition would expressly cover central, provincial and local government administration, state enterprises, public organisations, Parliament, courts, constitutional independent organisations, the State Attorney Organ, and public higher education institutions. The clarification is intended to establish greater certainty regarding which public bodies fall within the relevant regulatory framework.
The draft would also introduce additional exemptions for certain government agencies carrying out statutory functions relating to the prevention and suppression of corruption and misconduct. Activities undertaken by agencies performing such functions, including relevant anti-corruption authorities, may therefore fall outside the scope of the PDPA. If enacted, the provision could facilitate the performance of statutory investigative and enforcement functions while establishing a clearer boundary between data protection requirements and public-sector anti-corruption activities.
Another significant amendment concerns the legal basis for processing general personal data under Section 24 of the PDPA. The proposed framework would expressly recognise consent as one of the available lawful bases for processing, rather than treating consent as the default basis subject to specified exceptions. This restructuring is intended to provide greater clarity regarding the circumstances in which organisations may lawfully process personal data and how consent interacts with other available legal bases.
The draft further proposes to expand the public interest legal basis to cover disclosures by government agencies where such disclosure is required under laws governing official information or other legislation requiring information to be made publicly available. If adopted, this amendment could provide a clearer statutory foundation for certain government disclosure activities and help reconcile data protection obligations with transparency requirements under other Thai legislation.
From a broader legal and commercial perspective, the proposed amendments indicate an effort to clarify the interaction between Thailand’s data protection regime and public-sector functions, rather than fundamentally altering the PDPA’s overall regulatory framework. Businesses that regularly interact with government agencies, provide services to public-sector entities, or process personal data in connection with government-related activities should monitor the legislative process and consider participating in the public consultation. The proposed changes may ultimately affect how personal data is exchanged with government bodies and how organisations assess the appropriate legal basis for processing personal data under Thai law.