Thailand’s Personal Data Protection Act (PDPA) continues to shape how businesses collect, store, use, and disclose personal information. For organizations operating in Thailand, compliance is not limited to publishing a privacy policy or obtaining consent. Businesses must also be prepared to respond appropriately when individuals exercise their legal rights over their personal data.
In July 2026, Thailand’s Personal Data Protection Committee (PDPC) published a notification establishing more detailed procedures for exercising the right of access under Section 30 of the PDPA. The notification introduces practical requirements for handling requests, verifying identities, meeting deadlines, and maintaining records.
For companies that manage customer databases, employee information, online accounts, or other personal data, these procedures make it important to review existing privacy operations and ensure that requests can be handled consistently.
What Is the Right of Access Under Thailand’s PDPA?
The right of access allows individuals to request access to their personal data held by a data controller and, subject to applicable requirements, obtain copies of that information. Individuals may also request information about the source of personal data collected without their consent, where the law provides that right.
This right can affect businesses across many sectors, including e-commerce, hospitality, healthcare, financial services, technology, and professional services.
For example, a customer may ask an online retailer for a copy of personal information associated with their account. An employee may request access to personal data maintained in an HR system. A customer may also ask a service provider to explain the source of information it obtained indirectly.
Businesses need a reliable process to receive, verify, assess, and respond to these requests without unnecessarily disclosing information belonging to other people.
Establish Appropriate Channels for Data Access Requests
One important element of the new notification is the requirement for data controllers to provide at least two channels for submitting access requests: direct submission at the business location and registered mail.
Electronic submission channels may also be offered. Where a business provides an electronic channel, it can use that channel to support the request-handling process in accordance with the applicable requirements.
Organizations should review their privacy notices, internal policies, and customer-service procedures to ensure that individuals can clearly understand how to exercise their rights.
A practical procedure should identify:
- Where requests can be submitted.
- Which team or employee is responsible for receiving them.
- What information a request should contain.
- How the requester’s identity and authority will be verified.
- How the organization will track and communicate deadlines.
Without a clear procedure, a request may remain unnoticed in a general customer-service inbox or be transferred between departments without an assigned owner.
Verify the Requester’s Identity and Authority
Before releasing personal information, a business must take appropriate steps to confirm that the request comes from the relevant individual or an authorized representative.
The notification specifies information that a written or electronic request should contain, including the data subject’s name, the preferred method of access, details of the requested data, and the requester’s signature. Additional identifying information may be requested when necessary.
Where a representative submits a request, the organization may need to verify the authorization and the identities of both the representative and the data subject.
Verification procedures should be proportionate to the circumstances. Businesses should avoid collecting excessive identification documents when a less intrusive method would adequately establish identity and authority.
This is particularly important for online platforms, where requests may originate from different email addresses, shared accounts, or individuals claiming to represent customers.
A consistent verification process helps reduce the risk of unauthorized disclosure while preserving individuals’ ability to exercise their rights.
Understand the Review and Response Deadlines
The new procedures establish specific timeframes for reviewing and fulfilling requests.
Controllers must review a request within 15 days. If the request is incomplete, the requester must be notified and given at least 15 days to correct the deficiencies. If the deficiencies are not corrected, the request may be treated as abandoned in accordance with the applicable rules.
Once the request has been verified, the controller must fulfill it within 30 days. An extension of up to another 30 days may be available for large-volume or complex requests, subject to the notification requirements.
These timelines make internal coordination essential. A request may involve information held by customer service, human resources, IT, marketing, finance, or external service providers.
Businesses should therefore maintain a centralized tracking system that records:
- The date the request was received.
- The identity-verification status.
- The information being requested.
- The department responsible for gathering the data.
- Applicable deadlines and any extension notices.
- The date and method of the final response.
A documented workflow makes it easier to identify delays and demonstrate that requests have been handled appropriately.
Provide Access Without Exposing Other People’s Information
Depending on the circumstances, a business may provide access through inspection, copies of documents, or electronic access.
However, fulfilling a request does not necessarily mean disclosing every document in its original, unredacted form. Records may contain personal information belonging to other individuals, confidential business information, trade secrets, or intellectual property.
The organization should assess the information before disclosure and determine whether third-party information needs to be protected or whether another lawful limitation applies.
For example, a customer-service record might include both the requester’s details and information about another customer. A personnel document might contain information about multiple employees.
Businesses should establish a review process that identifies relevant personal data, protects information that should not be disclosed, and documents the basis for any limitation.
The objective is to respect the requester’s rights while complying with other applicable legal obligations.
Know When a Request May Be Refused or Limited
The right of access is subject to limitations permitted by law. The notification identifies circumstances in which a request may be refused or limited, including where compliance would harm third-party rights, where a request is manifestly unfounded or unreasonably burdensome, or where another applicable legal restriction or court order permits or requires a different outcome.
A refusal should not be based solely on inconvenience or a general preference to keep company records confidential.
Businesses should assess each request individually, identify the applicable legal grounds, and provide the requester with written reasons where required. The refusal and its supporting reasons must also be recorded in the controller’s records.
Preparing standard response templates can help legal and compliance teams communicate decisions consistently. Nevertheless, each refusal should be reviewed against the specific facts rather than relying on a generic explanation.
Review Fees and Methods of Providing Information
The notification addresses how access may be provided and when fees may be charged.
Electronic access that does not involve special recording or delivery costs should generally be free. Where fees are permitted, they must be reasonable, must not exceed actual costs, and must comply with the applicable fee schedule. Relevant fee details must be disclosed in advance.
Organizations should therefore review their current procedures to ensure that charges are not imposed automatically and that staff understand when a fee may be permitted.
Businesses should also consider whether their systems can provide information securely in an appropriate format. Electronic responses may be particularly useful when requests are submitted electronically, provided the relevant requirements can be met.
A clear process can improve efficiency while reducing unnecessary friction for customers, employees, and other data subjects.
Maintain Records of Requests and Responses
Recordkeeping is a key part of demonstrating compliance. Under the notification, controllers must retain records of access requests and their responses for at least two years. Electronic records are permitted.
A useful record should capture the request received, verification steps, communications with the requester, decisions taken, any extension or refusal, and the date and method of fulfillment.
Records should be accessible to authorized personnel while protected against unauthorized access or alteration.
Businesses should also establish retention and access controls that are consistent with their broader privacy and information-security policies. Maintaining records does not justify keeping personal data indefinitely; the organization should continue to apply its lawful retention rules to the underlying information.
Create an Internal PDPA Access-Request Workflow
A written policy alone is unlikely to be sufficient if employees do not know how to implement it. Businesses should develop an operational workflow that connects legal, compliance, IT, HR, and customer-service teams.
A practical implementation plan includes the following steps:
Step 1: Review current procedures. Identify existing request channels, responsible employees, verification methods, and response templates.
Step 2: Update privacy notices. Explain how individuals can submit requests, what information may be required, and how the organization handles them.
Step 3: Assign responsibility. Designate a team or individual to coordinate requests and ensure that the appropriate departments respond promptly.
Step 4: Implement deadline tracking. Use a register or case-management system to monitor review periods, correction requests, verification, and fulfillment deadlines.
Step 5: Prepare response templates. Develop templates for acknowledgments, requests for missing information, extensions, fulfillment, and refusals.
Step 6: Train relevant personnel. Ensure that employees who receive or process personal data understand how to recognize and escalate access requests.
Step 7: Test the procedure. Conduct a sample exercise to determine whether the business can locate the requested information, protect third-party data, and respond within the applicable timeframe.
Step 8: Review and improve. Periodically assess whether the process remains effective as the organization’s systems, vendors, and data practices change.
What Should International Businesses Operating in Thailand Consider?
Companies with regional headquarters, overseas parent companies, cloud-based systems, or international customer-service teams may hold personal data across several locations.
These arrangements can complicate the process of locating information and assigning responsibility for a request. Businesses should understand which entity acts as the data controller, which service providers process information on its behalf, and how relevant records can be retrieved when required.
Cross-border arrangements should also be assessed under the PDPA’s applicable transfer rules and other relevant obligations.
An international group should not assume that a request can be handled entirely by its overseas headquarters without considering the responsibilities of the relevant Thai entity. Internal agreements, escalation procedures, and access controls should support timely and lawful responses.
Conclusion: Make Data Access Part of Your Compliance Strategy
Thailand’s detailed PDPA access-request procedures reinforce the importance of treating data-subject rights as an operational responsibility rather than a document-only compliance exercise.
Businesses should review their request channels, verification methods, response deadlines, disclosure safeguards, fee procedures, and recordkeeping practices. Clear ownership and reliable internal coordination can help organizations respond more consistently while protecting personal information.
A proactive review can also identify broader weaknesses in privacy governance before they lead to complaints, disputes, or regulatory scrutiny.
Pimlegal assists businesses in understanding digital-law obligations and managing legal risks associated with data protection and online operations. Organizations that are uncertain about their existing procedures should consider obtaining a legal assessment tailored to their activities and data-processing arrangements.