More Clarity, More Compliance: Thailand's New Personal Data Access Rights Notification

Data subject access requests are about to become more procedural and compliance intensive.  

On 6 July 2026, the Personal Data Protection Committee of Thailand (PDPC) issued a new Notification¹, setting out detailed requirements for handling requests by data subjects to access and obtain copies of their personal data, as well as requests for information on the source of personal data collected without consent.

Effective from 14 September 2026, the Notification introduces specific requirements relating to, among others, request procedures, identity verification, response timelines, grounds for refusal, fees and record keeping obligations.  

What does this Notification mean for businesses and data subjects? 

Most businesses process personal data in the course of their operations and, whether they realise it or not, are likely to be subject to Thai data protection laws, including this Notification.  

Businesses, as data controllers, should therefore review their existing data subject rights handling processes and relevant documents such as request forms to ensure compliance with the new requirements before they come into force.  

Data subjects should also familiarise themselves with how their access rights may be exercised in practice, including the information and supporting documentation required to submit such requests. 

Key details 

This Notification addresses several aspects including:

1. Scope of information: Data subjects may request access to, and obtain copies of, personal data held by data controllers obtained whether directly or indirectly, information on the source of personal data obtained without consent, data controller's privacy notices, and records of processing activities (ROPA). Data controllers must make the above available so that the data subjects can exercise their rights.
    
2. Request procedures: Requests may be submitted in writing by the data subject or an authorised representative. Data controllers must provide channels for data subjects to submit requests in person or by post, and may additionally provide electronic or other channels. Data subjects must provide prescribed information and supporting documents for identity verification.
    
3. Response timeline: Data controllers must review and verify requests and supporting documents within 15 days of receipt. If the request is valid and complete, the data controller must respond without undue delay and, in any event, within 30 days, subject to a further extension of up to 30 days where necessary.
    
4. Grounds for refusal: Requests may be refused, in whole or in part, in limited circumstances, including where refusal is permitted by law or court order, the request is manifestly unfounded or imposes an unreasonable burden, or compliance would adversely affect the rights of others or involve protected information (e.g., trade or official secrets or intellectual property).
    
5. Fees and record keeping: The Notification also sets out requirements relating to fees, including maximum chargeable fees, and requires records of requests and responses to be retained for at least two years. 

The above provides only a high-level overview of the Notification, which contains extensive and detailed requirements. This article does not and is not intended to constitute legal advice. You should not use or otherwise rely on its contents without obtaining qualified legal advice.

Should you have any further questions or are interested to know more about the above, please contact our team below. 

_______

1. The Personal Data Protection Committee Notification Re: Criteria on access to and obtaining a copy of personal data relating to the data subject under the responsibility of the data controller, or requesting disclosure of the acquisition of personal data for which the data subject did not give consent B.E. 2569 (2026) (the "Notification").