Thailand Compliance: Which Frameworks Apply to You

Thai PDPA is modeled architecturally on GDPR, adopting the data controller and data processor distinction, a lawful basis framework for processing personal data, and a set of data subject rights including access, rectification, erasure, and portability. The enforcement body , the Personal Data Protection Committee, or PDPC , has authority to impose administrative fines of up to five million Thai baht per violation and criminal penalties of up to one year imprisonment for intentional violations. The PDPA applies extraterritorially to organizations outside Thailand that offer goods or services to individuals in Thailand or that monitor the behavior of individuals in Thailand, which is the provision that brings international SaaS providers and ecommerce operators into scope regardless of where their servers are located or where they are incorporated.

The Thai PDPA Warning that appears as a universal caution across all industry-to-international-framework pathways reflects a compliance reality that enforcement data from the first two years of full PDPA enforcement has confirmed: organizations consistently underestimate the operational complexity of PDPA compliance because they treat it as a legal document exercise rather than a data governance program. PDPA Article 37 requires data controllers to implement appropriate security measures to prevent unauthorized access, disclosure, alteration, or destruction of personal data , language that maps directly to ISO 27001 Annex A controls and to NIST CSF Protect function practices. The PDPA does not prescribe specific technical controls, which means organizations must determine for themselves what appropriate security looks like in their risk context, and that determination is where compliance programs most frequently fail. ISO 27001 certification is the most widely accepted demonstration of PDPA Article 37 compliance in the Thai market, which is why ISO 27001 appears as a recommended international framework for every industry sector operating in Thailand.

Healthcare and pharma organizations operating in Thailand face the most complex mandatory obligation stack of any sector. NHSO , National Health Security Office , and MOPH Health Data Standards together govern the handling of health data within the Thai public health system and impose requirements on hospitals, clinics, health technology platforms, and pharmaceutical companies that process patient data. These standards address health data classification, access control requirements for patient records, data sharing protocols between healthcare providers, and breach notification obligations that operate independently of , and sometimes with shorter timelines than , PDPA breach notification requirements. Organizations that handle both general personal data under PDPA and health data under NHSO and MOPH standards must maintain compliance programs that address both regulatory regimes simultaneously, because health data is a special category under PDPA Article 26 that requires explicit consent and heightened security measures in addition to whatever the NHSO and MOPH standards require.

Banking and finance organizations in Thailand operate under two distinct mandatory frameworks beyond Thai PDPA. Bank of Thailand IT Risk Management Guidelines , issued under the BOT authority granted by the Financial Institutions Business Act , require licensed financial institutions to implement IT governance structures, information security management systems, IT risk assessment processes, and business continuity management programs that meet BOT-prescribed standards. The guidelines align substantively with ISO 27001 and NIST CSF control domains, and BOT examination teams assess compliance with these guidelines during regular supervisory examinations , making them a hard compliance obligation enforced through the banking license rather than through a separate civil penalty framework. SEC Thailand Cybersecurity Rules , issued by the Securities and Exchange Commission under the Securities and Exchange Act , impose parallel obligations on capital market participants including brokers, dealers, asset managers, and securities registrars. The SEC rules focus specifically on cybersecurity incident management, third-party risk management for technology service providers, and cybersecurity testing requirements including penetration testing at prescribed frequencies.

Critical infrastructure operators face the Thai Cybersecurity Act as their primary mandatory domestic obligation, administered by the National Cybersecurity Committee and the Office of the National Cybersecurity Committee. The Cybersecurity Act identifies eight critical information infrastructure sectors , national security, significant public services, banking and finance, information technology and telecommunications, transportation and logistics, energy and public utilities, public health, and other sectors designated by the committee , and imposes tiered cybersecurity standards on operators in those sectors. Tier 1 critical information infrastructure requires compliance with a baseline security standard. Tier 2 requires compliance with a standard level. Tier 3 requires compliance with a strict level that includes third-party audit requirements, incident response capability standards, and regular cybersecurity drill exercises. NIST CSF is the international framework most directly recommended alongside the Cybersecurity Act because the Thai national cybersecurity standards were developed with explicit reference to NIST CSF functions and subcategories.

SaaS and technology companies operating in Thailand face a compliance architecture where the international framework layer is not merely recommended but functionally mandatory based on commercial reality. GDPR applies as a legal requirement to any Thai-based SaaS provider that offers services to EU customers , GDPR Article 3 extraterritorial scope is not theoretical for Thai SaaS companies with European enterprise or consumer customers, and GDPR enforcement actions against non-EU companies have been executed through the Article 65 consistency mechanism and through EU-based customer contract requirements. Beyond GDPR, SOC 2 Type II reports have become the de facto procurement requirement for enterprise SaaS sales in North American and European markets, meaning Thai SaaS companies that cannot produce a SOC 2 Type II report frequently cannot close enterprise contracts regardless of their actual security posture.

ISO 27017 , the cloud security extension to ISO 27001 , is the recommended international framework for SaaS and tech companies because it addresses the specific control requirements that apply to cloud service providers rather than organizations generally. ISO 27017 Clause 6.3 provides cloud-specific implementation guidance for the ISO 27001 Annex A controls, adding cloud provider-specific controls covering virtual machine hardening, administrative operations security, monitoring of cloud services, and the alignment of virtual and physical security boundaries. Thai SaaS companies that implement ISO 27001 as their foundation and extend to ISO 27017 for cloud-specific controls position themselves to satisfy Thai PDPA Article 37 security requirements, GDPR Article 32 technical and organizational measures requirements, and enterprise customer security questionnaire requirements from a single integrated control framework. Ecommerce and retail organizations face the additional mandatory overlay of Thai PDPA for customer data and PCI DSS as a recommended framework for any operation that processes payment card transactions , a recommendation that becomes effectively mandatory for any ecommerce operator whose card brand agreements require PCI DSS compliance as a contractual obligation.

The framework selection logic for Thailand operations follows a structured decision path based on three variables: the organization industry sector, its customer geography, and its data handling scope. GDPR is the only international framework that appears as required rather than recommended, and its requirement status is triggered by a single condition , processing personal data of EU residents , regardless of industry sector. A Thai manufacturing company with no EU customers has no GDPR obligation. A Thai SaaS startup with ten EU enterprise customers is fully subject to GDPR extraterritorial scope and must implement the complete GDPR compliance program including Article 30 Records of Processing Activities, Data Protection Impact Assessments for high-risk processing under Article 35, and Data Processing Agreements with all processors under Article 28.

ISO 27001 is the most universally recommended international framework across all Thai industry sectors because it provides the documented information security management system that multiple Thai regulators , BOT, SEC, PDPC , treat as evidence of appropriate security implementation. Organizations that have achieved ISO 27001 certification can present their Statement of Applicability and certification evidence in response to BOT IT Risk Management Guideline assessments, SEC cybersecurity rule examinations, and PDPA compliance inquiries because the underlying control framework addresses the security requirements that each of these regulatory regimes impose. ISO 27701 , the privacy information management system extension to ISO 27001 , is recommended specifically for companies with significant personal data processing obligations, because its Annex mapping connects ISO 27701 controls to GDPR articles and PDPA-equivalent privacy principles in a single documented framework. NIST CSF receives specific recommendation for critical infrastructure and healthcare sectors because its function-based structure , Identify, Protect, Detect, Respond, Recover, and the recently added Govern , provides a risk management vocabulary that aligns with the Thai Cybersecurity Act tier assessment methodology and with NHSO health data security assessment processes.