Direct Marketing in Thailand: PDPA Rules for Businesses

What Counts as Direct Marketing in Thailand

Direct marketing covers any communication aimed at a specific individual to promote products, services, or a brand. In practice, that includes email newsletters, SMS blasts, in-app push notifications, telemarketing calls, social media advertising and retargeting, and personalized offers generated from purchase history. Because each of these activities uses personal data, they fall squarely within the PDPA whenever the recipient is an identifiable person.

Consequently, the question is rarely whether the PDPA applies. Instead, the practical issue is which lawful basis supports the activity, how consent is captured, and whether the recipient can easily opt out. Foreign businesses running regional campaigns from Singapore, Hong Kong, or Europe should note that the PDPA applies extraterritorially. If you market to people in Thailand or monitor their behavior, the law reaches your organization even without a local entity.

The Legal Framework Governing Direct Marketing in Thailand

Two statutes shape direct marketing in Thailand, and they operate in parallel rather than as alternatives. Understanding both prevents the common mistake of treating PDPA consent as the only compliance step.

First, the PDPA regulates the personal data behind every campaign — collection, use, disclosure, profiling, and cross-border transfer. It gives data subjects enforceable rights, including the right to object to direct marketing at any time and the broader data subject access rights that let individuals see what data you hold. Second, the Direct Sales and Direct Marketing Act, administered by the Office of the Consumer Protection Board (OCPB), regulates the commercial activity of marketing goods and services directly to consumers. Notably, businesses that conduct direct marketing to consumers generally must register with the OCPB before operating.

Choosing a Lawful Basis Under Section 24

Every marketing use of personal data needs a lawful basis under Section 24 of the PDPA (or Section 26 for sensitive data). The two bases that matter most for marketers are consent and legitimate interests, and choosing correctly is now a documented decision rather than an afterthought.

Consent

Consent remains the cleanest basis for marketing to individuals, particularly for electronic messages and for any data considered sensitive. However, valid consent under the PDPA must be freely given, specific, informed, and clearly separated from other terms and conditions. A pre-ticked box or consent buried in general terms will not hold up.

Legitimate Interests

Some marketing — for example, promoting similar products to existing customers — may rest on legitimate interests instead of consent. To rely on this basis, though, an organization should complete and record a legitimate interest assessment (LIA) weighing the business benefit against the individual’s rights and reasonable expectations. Where the balance tips toward the individual, consent becomes necessary.

Consent Rules for Marketing Communications

Because consent is so central to direct marketing in Thailand, the mechanics deserve close attention. The PDPA and the regulator’s emerging expectations point to several non-negotiable practices:

• Keep marketing consent separate. Do not bundle it with consent to core service terms or with the transaction itself.
• Avoid pre-selected boxes. Silence or inaction cannot be treated as agreement; the individual must take a clear affirmative step.
• Give a real choice. Declining marketing must not block access to the product or service, unless the marketing is genuinely necessary to deliver it.
• Record what was agreed. Keep dated consent records showing what the person was told and what they accepted.

These practices matter because Thai regulators increasingly scrutinize “dark patterns” — manipulative interface designs that nudge users into agreeing. A consent flow that relies on confusion or pressure risks being treated as invalid, which in turn removes the lawful basis for the entire campaign.

The Right to Opt Out and Withdraw Consent

Under the PDPA, individuals may object to direct marketing at any time, and they may withdraw consent as easily as they gave it. For businesses, this creates two operational duties. First, every marketing message should carry a clear, working opt-out — an unsubscribe link, a STOP keyword, or an equivalent mechanism. Second, the organization must honor opt-outs promptly across all channels, not merely on the platform where the request arrived.

Withdrawal of consent does not erase past lawful processing. Nevertheless, once a person opts out, continued marketing to them loses its lawful basis and becomes a violation. Suppression lists, therefore, are not optional housekeeping; they are a compliance control that protects the business from repeat-contact complaints.

Profiling, AI, and Third-Party Data

Modern marketing rarely stops at a single opt-in. Companies profile customers, enrich records with data from affiliates or brokers, and increasingly deploy AI to predict behavior. Each of these adds legal risk that the regulator has flagged directly.

When you buy or receive data from a third party, you inherit responsibility for how it was collected. If the original consent did not cover onward marketing by your business, you may lack a lawful basis to use it. Accordingly, due diligence on data brokers and marketing partners — including reviewing their consent language and source documentation — is essential before any list is loaded into a campaign.

Profiling and AI-driven marketing raise the stakes further. These techniques can reveal sensitive inferences and affect individuals in ways they do not expect. As a result, they call for heightened transparency, a carefully selected lawful basis, and, where risk is elevated, a data protection impact assessment (DPIA). Businesses layering AI into advertising should also review Thailand’s AI advertising regulations alongside their PDPA obligations.

What Thailand’s 2026 Draft PDPA Guidance Signals

On July 7, 2026, the Office of the Personal Data Protection Committee (PDPC) published draft guidance for public consultation, including one document on lawful bases and another specifically on marketing and direct marketing. The drafts are not yet final and do not change the law. Even so, they offer a clear preview of the regulator’s enforcement priorities for direct marketing in Thailand.

The lawful-bases draft sets out a structured five-step method: identify the processing activity, assess the appropriate basis, confirm the data is necessary, complete an LIA where relevant, and ensure transparency through privacy notices. Importantly, it warns against treating consent as a catch-all where another basis fits better. The marketing draft, meanwhile, emphasizes separating marketing consent from core services, avoiding manipulative consent designs, honoring opt-outs, and applying extra safeguards to profiling and AI-driven marketing.

Penalties and Commercial Risks

Non-compliance carries more than reputational cost. The PDPA provides for administrative fines of up to THB 5 million per violation, and certain breaches involving sensitive data can attract criminal liability. In addition, affected individuals may claim compensation, and courts may award punitive damages of up to twice the actual loss. Separately, operating direct marketing without required registration with the OCPB can trigger penalties under the Direct Sales and Direct Marketing Act.

For international brands, the sharper risk is often practical rather than statutory. A single well-publicized complaint, a regulator inquiry, or an unsubscribe failure can stall a market-entry campaign and damage trust with Thai consumers. Building compliance into the campaign from day one is far cheaper than remediating it under scrutiny.

A Compliance Checklist for Foreign Businesses

To market compliantly, foreign companies should treat direct marketing in Thailand as a documented process. The following steps map the essentials:

1. Map your data flows. Identify every marketing activity and the personal data it uses, then assign a lawful basis to each.
2. Rebuild consent capture. Separate marketing consent, remove pre-ticked boxes, and log dated, specific consent records.
3. Deploy reliable opt-outs. Ensure every channel offers a working unsubscribe and that suppression syncs across systems.
4. Vet third-party data. Conduct due diligence on brokers, affiliates, and partners before importing any list.
5. Assess profiling and AI. Add transparency, select a defensible basis, and run a DPIA where the risk is elevated.
6. Confirm OCPB registration. Check whether your consumer-facing marketing requires registration under the Direct Sales and Direct Marketing Act.

Frequently Asked Questions