Personal data protection is no longer simply a matter of publishing a privacy policy or obtaining consent from customers. Businesses must also be prepared to respond when individuals exercise their rights under Thailand’s Personal Data Protection Act B.E. 2562 (2019), commonly known as the PDPA.
One important development in 2026 is the introduction of more detailed rules governing requests by individuals to access their personal data. The Personal Data Protection Committee published its notification concerning data subject access requests in the Government Gazette on 16 July 2026, and the rules took effect on 14 September 2026.
These requirements make it increasingly important for organisations to establish clear procedures for receiving, verifying, assessing, and responding to personal data access requests.
For companies operating in Thailand, an access request can involve information held across customer databases, email accounts, human resources systems, cloud storage, customer service platforms, and external service providers. Without a coordinated process, even a routine request can become a significant compliance challenge.
Businesses should therefore treat access request management as an operational responsibility supported by appropriate legal, technical, and organisational controls.
Understanding the Right to Access Personal Data
Under Section 30 of Thailand’s PDPA, data subjects generally have the right to request access to their personal data held by a data controller and to obtain a copy of that data, subject to applicable legal conditions and exceptions.
The right can apply in many business contexts.
A customer may request a copy of personal information held by an online retailer. An employee may ask an employer for access to employment-related records. A former customer may seek information maintained in a company’s customer relationship management system.
The precise scope of a request depends on its wording, the information involved, and the applicable legal requirements.
Businesses should distinguish between a request to access personal data and a broader demand for every document that mentions an individual. A request may require searching relevant records and assessing what constitutes the person’s personal data, but it does not automatically mean that every internal document must be disclosed in full.
Organisations should assess each request individually and document their reasoning.
What Changed Under the 2026 Access Request Rules?
The detailed rules introduced in 2026 provide a more structured framework for handling access requests under Section 30.
One of the most important operational considerations is the response deadline. Businesses should be prepared to respond within 30 days, with a possible extension of a further 30 days where permitted and supported by reasons communicated to the requester in accordance with the applicable rules.
An organisation should not assume that a request can remain unanswered simply because retrieving information is inconvenient or requires coordination between departments.
The rules also address the circumstances in which an access request may be refused. A refusal should be based on an applicable legal ground rather than a general preference to keep information confidential. Organisations should assess the relevant conditions, document the basis for their decision, and communicate appropriately with the requester.
For businesses, the practical implication is clear: access requests need an identifiable owner, a documented workflow, and a reliable system for monitoring deadlines.
Establishing a Reliable Request-Handling Procedure
A well-designed procedure can help an organisation respond consistently while reducing the risk of missed deadlines and unnecessary disclosure.
Step 1: Receive and record the request
Businesses should provide a clear channel through which individuals can submit access requests. Depending on the organisation, this may involve a dedicated email address, privacy contact, customer service process, or data protection officer.
Every request should be recorded with its receipt date, the requester’s contact details, the relevant systems or departments, and the requested information.
Employees should know how to recognise a data access request, even when the individual does not use formal legal terminology.
Step 2: Verify the requester’s identity
Before disclosing personal information, the organisation should take reasonable and proportionate steps to verify the requester’s identity in accordance with applicable requirements.
This is particularly important where records contain sensitive information, financial details, employment information, or customer account data.
Verification procedures should avoid collecting excessive additional personal information. The objective is to establish that the information is being disclosed to the appropriate person or an authorised representative.
Step 3: Identify the information held
The organisation should determine which systems and departments may hold relevant personal data.
Depending on the circumstances, this may include customer databases, archived emails, human resources records, billing systems, complaint logs, and information maintained by service providers.
The search should be sufficiently thorough to support a reliable response without unnecessarily expanding the request beyond its proper scope.
Step 4: Review the information before disclosure
Information identified during the search should be reviewed for relevance, accuracy, confidentiality, and applicable legal restrictions.
Some records may contain personal data relating to other individuals or information that is subject to a lawful restriction on disclosure. The organisation should determine whether redaction or another appropriate measure is required.
Businesses should not automatically disclose complete documents when a more limited disclosure is appropriate.
Step 5: Respond within the applicable deadline
The response should address the request clearly and in accordance with the applicable legal requirements.
Where an extension is permitted, the organisation should follow the prescribed conditions and communicate the reasons within the required timeframe.
If the request is refused in whole or in part, the organisation should document the relevant legal basis and provide the explanation or other information required by the applicable rules.
Step 6: Retain appropriate records
The organisation should maintain suitable records of the request, verification steps, searches performed, decisions made, communications sent, and any applicable extension or refusal.
These records can help demonstrate that the organisation followed a consistent process and provide useful evidence if the handling of the request is later challenged.
The Importance of Data Mapping and Internal Coordination
One of the most common practical difficulties in responding to an access request is identifying where personal information is stored.
A company may maintain information across several platforms operated by different departments. Customer service may hold correspondence, marketing may maintain campaign records, finance may retain transaction information, and human resources may store employment documents.
If these systems are managed independently, the privacy team may not know where to search or whom to contact.
Businesses should develop an inventory of personal data processing activities and identify the systems in which relevant information is held.
The inventory should be supported by clear responsibilities for the departments that collect, store, access, or otherwise process personal data.
A centralised request register can then help track each request, assign tasks, monitor progress, and record the final response.
These measures are useful not only for access requests but also for other data subject rights and wider PDPA compliance activities.
Working With Cloud Providers and External Processors
Many organisations rely on external providers to operate their customer relationship management systems, human resources platforms, email services, cloud storage, and other business applications.
This can complicate the handling of access requests because relevant personal data may be processed by a third party on the organisation’s behalf.
Businesses should review their contractual arrangements and operational procedures to determine how quickly a provider can assist with identifying, retrieving, and securely delivering relevant information.
Data processing agreements should address the parties’ respective responsibilities and provide appropriate mechanisms for cooperation when requests are received.
Organisations should also consider whether data is stored in multiple environments, including backups, archived systems, or integrated applications, and determine what searches are appropriate under the circumstances.
A company should not assume that outsourcing data storage transfers its own legal responsibilities to the service provider. Its obligations must be assessed according to its role under the PDPA and the specific processing arrangement.
Balancing Access Rights With Confidentiality and Security
Responding to an access request requires a balance between the individual’s legal rights and the organisation’s obligations to protect information.
A request may involve documents containing personal data about several individuals, confidential business information, or material subject to a legal restriction.
The correct response depends on the relevant facts and applicable law. Businesses should avoid both automatic disclosure and blanket refusal.
For example, a customer complaint record may contain information about the requester alongside information identifying another customer or employee. The organisation should assess whether the requester’s personal data can be disclosed while appropriately protecting other individuals’ information.
Security is equally important during delivery. Responses should be transmitted through an appropriate channel, with access controls and safeguards proportionate to the sensitivity of the information.
The organisation should also consider how the recipient’s identity is confirmed and how the disclosure is recorded.
Consequences of Poor Access Request Management
An inadequate response process can create legal, operational, and reputational risks.
Missing a deadline may result in non-compliance with applicable requirements. An unjustified refusal may lead to a complaint or regulatory scrutiny. Disclosing information to the wrong person may create a separate data protection or security incident.
Poor recordkeeping can make it difficult for a business to explain what happened, demonstrate its decision-making process, or identify the source of an error.
These risks may be compounded when responsibility is unclear or employees are unfamiliar with the organisation’s privacy procedures.
Businesses should therefore review their existing arrangements to identify whether requests are handled consistently, deadlines are monitored, and decisions are supported by appropriate records.
Training is also important. Customer service personnel, HR teams, IT staff, and other employees who may receive or process requests should understand when to escalate a matter to the responsible privacy contact.
A Practical Compliance Checklist for 2026
Businesses operating in Thailand can use the following checklist to assess their readiness.
- Confirm that internal procedures reflect the access request rules effective from 14 September 2026.
- Designate a responsible person or team to coordinate requests.
- Establish clear channels for receiving and recording requests.
- Implement appropriate identity verification procedures.
- Map the systems and departments that hold personal data.
- Introduce a deadline-tracking mechanism and escalation process.
- Establish review procedures for third-party information and lawful restrictions.
- Confirm how external data processors support retrieval and disclosure.
- Document decisions, extensions, refusals, and communications.
- Train employees to recognise and escalate access requests.
- Periodically test the process to identify operational weaknesses.
The checklist should be adapted to the organisation’s size, processing activities, information systems, and legal obligations. Businesses handling substantial volumes of personal data may need more formal procedures and additional technical support.
Why Legal Review Matters
Although an access request may appear to be a straightforward administrative task, the legal assessment can become complex when the request is broad, records involve several individuals, information is held by multiple providers, or disclosure may be restricted.
Legal review can help businesses interpret the applicable requirements, assess potential grounds for refusal, determine whether redaction is appropriate, and establish procedures that reflect the organisation’s actual operations.
It can also help identify gaps in privacy notices, internal policies, data processing agreements, and recordkeeping practices.
The objective is not simply to respond to individual requests. It is to build a consistent process that protects individuals’ rights while enabling the organisation to meet its legal responsibilities efficiently.
Conclusion: Make Access Request Readiness Part of PDPA Compliance
Thailand’s more detailed access request rules reinforce the importance of practical, well-documented data protection procedures.
Businesses should not wait until a customer, employee, or former client submits a request to determine who is responsible, where information is stored, or how a response will be prepared.
By establishing clear responsibilities, mapping personal data, monitoring deadlines, coordinating with external processors, and documenting decisions, organisations can improve their ability to respond appropriately and reduce avoidable compliance risks.
For companies operating in Thailand, reviewing access request procedures is an important step towards a more mature and accountable approach to PDPA compliance in 2026.
This article is provided for general informational purposes only and does not constitute legal advice. The application of the PDPA and its implementing rules depends on the facts of each case. Businesses should obtain appropriate legal advice when assessing their specific obligations.
About PimLegal
PimLegal assists businesses with digital law, personal data protection, online legal risks, and technology-related legal matters. Organisations reviewing their PDPA compliance arrangements can seek appropriate legal guidance to assess their policies, procedures, and contractual responsibilities.