PDPA Local Representative in Thailand: Do You Need One?

Many foreign companies serve customers in Thailand without ever setting up a local office. Yet under Thailand’s Personal Data Protection Act (PDPA), that same cross-border reach can create a hard legal obligation: the appointment of a PDPA local representative inside the country. If your business collects data from people in Thailand — through a website, an app, or an online store — you may already fall within the law’s scope. This guide explains when a PDPA local representative is required, what the representative does, how to appoint one, and the penalties that follow non-compliance.

What Is a PDPA Local Representative?

A PDPA local representative is a person or entity, based in Thailand, that a foreign organisation designates in writing to act on its behalf on data protection matters. The representative serves as the point of contact for data subjects who want to exercise their rights and for the Personal Data Protection Committee (PDPC), Thailand’s data protection regulator.

In practical terms, the representative bridges the gap between an overseas business and Thai authorities. Because a company outside Thailand can be difficult to reach or hold accountable, the law places a locally accessible party in the middle. The representative is authorised to act for the organisation without any limitation of liability in relation to the processing of personal data.

Does Thailand’s PDPA Apply to Your Business?

The first question is not whether you need a representative, but whether the PDPA reaches your business at all. Section 5 of the PDPA gives the law extraterritorial effect. As a result, a data controller or data processor located outside Thailand still falls under the Act when its activities target people in the country.

Offering goods or services to people in Thailand

The PDPA applies when a foreign business offers goods or services to data subjects in Thailand, regardless of whether payment is required. A free app, a marketing sign-up form, or an e-commerce checkout aimed at Thai users can all trigger the law. Pricing in Thai baht, Thai-language pages, and local delivery options are strong indicators that you are targeting the market.

Monitoring behaviour in Thailand

The Act also applies when a business monitors the behaviour of people located in Thailand. Analytics, cookies, ad tracking, and profiling that follow users inside the country all count. Consequently, even a company with no Thai entity and no Thai staff can be caught simply through its digital footprint.

Key Takeaway: The PDPA follows the data subject, not the company’s address. If you sell to, market to, or track people in Thailand, the law likely applies to you — and a PDPA local representative may become mandatory even though your business sits entirely offshore.

Who Must Appoint a PDPA Local Representative?

Under Section 37(5) of the PDPA, a data controller established outside Thailand and caught by the extraterritorial scope must designate a representative in Thailand in writing. Data processors that fall within the same scope carry a parallel obligation. In short, both the businesses that decide how personal data is used and those that process it on their behalf can be required to appoint a representative.

Limited exemptions exist. The requirement generally does not extend to processing carried out by public authorities, and narrow carve-outs may apply to certain small-scale activities defined by the PDPC. However, these exemptions are specific and easy to misread, so foreign businesses should confirm their position before assuming they are exempt.

Key Takeaway: The duty to appoint a PDPA local representative can fall on both controllers and processors. Do not assume the obligation is someone else’s — a foreign processor handling Thai user data can be just as exposed as the controller.

What Does the Local Representative Do?

The representative is far more than a mailing address. Its core function is to stand in for the foreign organisation on the ground in Thailand. Responsibilities typically include the following:

  • Receiving and channelling requests from data subjects who wish to access, correct, or delete their data.
  • Acting as the liaison with the PDPC during inquiries, audits, or enforcement.
  • Maintaining records related to processing activities so they can be produced when required.
  • Helping the organisation respond within the timelines the PDPA sets.

Because the representative is authorised without limitation of liability, the role carries real exposure. For that reason, the appointment should sit with a party that understands Thai data protection law and can manage regulator contact professionally.

How to Appoint a PDPA Local Representative

Appointing a PDPA local representative is a formal step, not a casual arrangement. The designation must be in writing and should clearly define the representative’s authority. A sound appointment usually involves the following:

  • A written instrument that names the representative and confirms authority to act on the organisation’s behalf.
  • A representative located in Thailand who can be reached by data subjects and the regulator.
  • A clear scope of duties, covering data subject requests, regulator liaison, and record-keeping.
  • Internal escalation channels so the representative can obtain instructions from the overseas business quickly.

Many foreign companies appoint a professional services firm or law firm to serve in this role. This approach keeps the function accountable, informed, and consistent, rather than relying on an individual who may leave or lack the necessary expertise.

Penalties for Failing to Appoint a Representative

Non-compliance is not a theoretical risk. Failing to appoint a PDPA local representative can attract administrative fines — commonly cited at up to THB 1 million for this particular breach. Moreover, the PDPA’s wider penalty regime reaches administrative fines of up to THB 5 million, alongside potential civil liability and, for certain violations, criminal penalties.

Beyond the fines, the reputational and commercial cost can be higher. Thai partners, payment providers, and enterprise customers increasingly ask about PDPA compliance before they contract. A missing representative can therefore stall deals as well as invite enforcement.

Key Takeaway: Treat the representative requirement as a gateway obligation, not a formality. The direct fine is significant, but the knock-on effect on partnerships and enterprise sales in Thailand is often what hurts most.

Practical Steps for Foreign Businesses

If you are unsure where your business stands, a short, structured review will usually give you a clear answer. We recommend the following sequence:

  • Map your data flows. Identify whether you collect, use, or monitor personal data of people in Thailand.
  • Confirm your role. Determine whether you act as a controller, a processor, or both for that data.
  • Assess the trigger. Check whether you offer goods or services to, or monitor behaviour in, Thailand.
  • Appoint if required. Where the criteria are met, put a written appointment in place and document it.
  • Align the wider programme. Pair the appointment with privacy notices, consent flows, and data subject request handling.

Because the PDPA is already in force, businesses that qualify should act now rather than wait. For related obligations, see our guides on data subject access requests in Thailand, PDPA certification, and direct marketing under the PDPA. The regulator’s own guidance is published by the Personal Data Protection Committee.

Frequently Asked Questions

Who needs a PDPA local representative in Thailand?
Any data controller or data processor established outside Thailand that offers goods or services to people in Thailand, or monitors their behaviour, may need to appoint a PDPA local representative. The obligation follows the data subject, so a company with no Thai entity can still be caught.
Can a law firm act as our PDPA local representative?
Yes. Many foreign businesses appoint a qualified law firm or professional services provider as their PDPA local representative. This keeps the role stable, informed, and capable of managing contact with the regulator and data subjects on the organisation’s behalf.
What happens if we do not appoint a representative?
Failing to appoint a representative can lead to administrative fines — up to THB 1 million is commonly cited for this breach — while the PDPA’s broader regime reaches administrative fines of up to THB 5 million, plus possible civil and criminal liability for related violations. It can also disrupt commercial relationships with Thai partners and customers.
Is the PDPA local representative personally liable?
The representative is authorised to act on the organisation’s behalf without limitation of liability in relation to the processing of personal data. Because the exposure is real, the appointment should sit with a party that understands Thai data protection law and can handle regulator contact responsibly.
Does the PDPA apply if we only have a website?
Possibly. A website that targets users in Thailand — through Thai-language content, baht pricing, or local marketing — can bring your business within the PDPA. Behavioural tracking of Thai visitors can also trigger the law, even without any physical presence in the country.

A local representative is not the same as a data protection officer in Thailand; some businesses must appoint both roles.

Do You Need a PDPA Local Representative?

Lex Bangkok advises international companies on Thailand’s data protection regime and can assess whether your business must appoint a PDPA local representative — and act in that role where required. Speak with our team for a clear, commercially grounded compliance strategy.

Schedule a Consultation

Disclaimer: This article provides general information on Thailand’s Personal Data Protection Act and is current as of July 2026. It is not legal advice. Specific obligations, exemptions, and penalties depend on your facts and on guidance issued by the Personal Data Protection Committee. Seek professional advice before acting.