Strategic Market Entry: Eliminating Thailand PDPA Friction
Entering the Thai market offers immense growth, but Section 37 of the Personal Data Protection Act (PDPA) creates a mandatory "gatekeeper" requirement for non-resident businesses. If you collect data from Thai residents without a physical presence in the Kingdom, you face specific regulatory challenges that Formiti is built to solve.
Critical Compliance Challenges We Address:
- Mandatory Local Representation: Under Section 37, failure to appoint an official representative in Thailand is a direct violation. Formiti provides the legal bridge required to satisfy the Office of the Personal Data Protection Committee (PDPC).
- Localised Regulatory Liaison: Communicating with the PDPC requires local language expertise and an understanding of Thai administrative law. Our Nakhon Sawan based team acts as your 24/7 liaison.
- Cross-Border Data Subject Rights: Handling Data Subject Access Requests (DSARs) from Thailand requires a deep understanding of local timelines and exemptions to avoid litigation.
- 72-Hour Breach Response: When a data breach occurs, the PDPA requires rapid notification. We provide the localized infrastructure to manage these high-pressure windows within the Thai jurisdiction.
Formiti: Your Authoritative Gateway to PDPA Compliance
As international data flows become more scrutinized by the Office of the Personal Data Protection Committee (PDPC), having a "placeholder" representative is no longer enough. Formiti provides a robust, Section 37-compliant infrastructure that bridges the gap between your headquarters and Thai regulatory requirements.
A Local Representative Backed by Global Expertise
Appointing Formiti means you get more than just a local address. You gain the full strength of our integrated compliance structure, powered by three specialist teams dedicated to protecting your business interests in Thailand.
Privacy Team
Our privacy experts act as your front line, managing all communications from Thai data subjects and ensuring every request is handled efficiently and in strict accordance with the PDPA.
Legal Team
In the event of a regulatory inquiry or data breach, our in-house legal team provides immediate support, guiding you through any interactions with the PDPC and ensuring your response is legally sound.
Operations Team
Our operations team ensures flawless service delivery, managing documentation, providing reports, and handling all the administrative details of your local representation so you can operate with peace of mind.
Our Multi-Layered Representative Model:
- Official Regulatory Liaison: We act as your formal, Thai-speaking interface with the PDPC. In the event of an inquiry or audit, our Bangkok team handles all communications, ensuring your global legal interests are protected.
- Data Subject Rights Facilitation: We provide the local mechanism required for Thai residents to exercise their rights (access, deletion, objection). By managing these requests locally, we reduce the risk of escalation to the regulator.
- Statutory Record Keeping: Under the PDPA, your representative must maintain an up-to-date Record of Processing Activities (RoPA). Formiti's technical team ensures your documentation is always audit-ready.
- Cultural & Linguistic Accuracy: Compliance isn't just about law; it's about language. Our team ensures all privacy notices and communications are translated and localized to meet Thai expectations.
- Full Statutory Liability Authorization (Section 37 Compliance): Unlike generic consultancy services, Formiti fulfills the strict mandate of Section 37(5) of the PDPA. We are authorized to act on your behalf without limitation of liability regarding your data processing activities in the Kingdom.
- Proactive "Zero-Breach" Enforcement Liaison: In Thailand's 2026 "Strategic Enforcement" climate, the 72-hour window for breach reporting is a high-risk failure point. Formiti acts as your emergency technical and legal liaison, providing immediate, localized response capabilities. We handle the critical first-response communications with the PDPC from our Bangkok office to mitigate the risk of administrative fines, which now routinely reach millions of Baht.
Is This Service Required for Your Business?
Under Section 5 and Section 37 of the PDPA, the requirement for a local representative is not optional—it is a mandatory legal gateway for foreign entities. If you meet any of the following criteria, you are legally required to appoint a representative in writing:
- Extraterritorial Reach: Your business is based outside of Thailand but offers goods or services to individuals within the Kingdom (regardless of whether a payment is required).
- Behavioral Monitoring: You monitor the behavior of individuals in Thailand, including the use of tracking cookies, AI-driven profiling, or analytics that take place within the jurisdiction.
- No Physical Presence: You process Thai personal data but do not have a registered branch, office, or permanent establishment within the Kingdom of Thailand.
- Processing Sensitive Data: You handle "Sensitive Personal Data" (as defined in Section 26) such as health records, biometric data, or criminal history of Thai residents without a local legal anchor.
- Regulator Insight: In 2026, the PDPC has explicitly stated that even "minor" data processing activities by foreign firms are subject to scrutiny. Failure to appoint a representative is considered a direct violation of Section 37(5), carrying administrative fines of up to 5 million THB.
4 SIMPLE STEPS
Getting Started is Simple
01. Free Assessment
We'll have a quick, no-obligation call to confirm your requirement for a Thai representative under the PDPA.
02. Appoint the Formiti Team
We provide a straightforward service agreement to formally appoint us as your local PDPA Representative.
03. Update Your Policies
Our data protection consultants provide the necessary details and wording to add to your privacy notices.
04. Compliance Secured
We handle all relevant local communications from that point forward, keeping you informed every step of the way.
OUR OFFICES
UK Office
Birmingham, B3 1RB, United Kingdom
Ireland Office
Thailand Office
CONTACT US
Formiti