Penalties for non-compliance with PDPA

Civil fines may be imposed where the data controller or data processor that possesses the data subject’s personal data fails to comply with the PDPA’s standards, either intentionally or negligently, causing damage to the data subject. The data subject may seek actual compensation for such harm from the data controller or data processor, including all actual expenditures incurred by the data subject to avoid or suppress such damage.

The unique feature of civil penalties is that, in addition to the aforementioned real compensation, the court has the authority to order the data controller or data processor to pay punitive damages to the data subject.
However, PDPA’s Penalties cannot be more than twice the amount of real compensation. If the real compensation is one million Baht, the court can award punitive damages of up to two million Baht. In this case, the total amount of damages might be up to three million Baht.

The prescription time for demanding civil compensation under the PDPA is three years from the data subject’s recognition of the occurrence of harm and the name of offenders, or ten years from the data controller’s or data processor’s unlawful act.

When an offender breaks a statute that interferes with the regular functioning of society, criminal sanctions may be imposed. When the PDPA is violated, the following criminal penalties can be imposed on the data controller or other people who execute personal data protection responsibilities under the PDPA:

1. If the data controller:

2. If any of the foregoing is done in a way that is likely to cause the data subject or any other person harm, impair the person’s reputation, or expose the person to ridicule, hatred, or humiliation, the data controller may face imprisonment for up to six months or a fine of up to 500,000 Baht, or both. If the data controller commits any of these activities with the goal of gaining illegal advantages (or securing benefits for others), the data controller faces imprisonment for up to a year, a fine of up to one million Baht, or both.

3. If any individual obtains the data subject’s personal data as a result of fulfilling responsibilities under the PDPA and discloses this personal data to another person, the offender may face imprisonment for up to six months, a fine of up to 500,000 Baht, or both. This does not apply, however, when a person is forced to reveal personal information under specific conditions. For example, whether the disclosure is in the interest of investigative processes or judicial proceedings, or where the data subject has provided written approval for a specific disclosure.

4. If the offender is a juristic person and the PDPA violation is the result of instructions or omissions from the juristic person’s responsible person (e.g., director, manager, or other persons responsible for the juristic person’s operations), the said person, along with the juristic person, may face criminal penalties.

Administrative sanctions for PDPA violations may be imposed, including:

Civil, criminal, and administrative fines can all be imposed on an offender. Penalties might be increased if a substantial number of PDPA violations occur.

Given the PDPA’s Penalties, we recommend complete compliance with the law with the PDPA.