Your PDPA cookie banner needs to:

• Display “Accept all” and “Reject all” buttons of equal prominence
• Block non-essential cookies until consent
• Provide a clear list of vendors and purposes
• Maintain auditable consent logs

Cookie Information’s consent management platform addresses these requirements with WCAG accessible banners customizable to Thailand’s specific PDPA rules, including the mandatory ‘Accept all’ and ‘Reject all’ equal prominence, granular consent categories, and auditable consent logs that satisfy PDPC inspection requirements.

These rules closely mirror the GDPR and are now actively enforced in Thailand.

Building a PDPA-compliant analytics setup

Moving from non-compliant to compliant analytics doesn’t require replacing your entire stack – but it does require strategic choices about core platforms. Here’s how to build a foundation that supports both marketing performance and legal requirements:

Foundation layer: consent management

Required for compliance:

• Deploy a compliant cookie banner before any tracking loads
• Implement granular consent categories (necessary, analytics, marketing)
• Block all non-essential cookies until consent is received

Recommended for audit readiness:

• Maintain detailed consent records with timestamps and user preferences to demonstrate compliance if inspected by the PDPC

Data collection layer: analytics platform

Required for compliance:

• If transferring Thai user data abroad, verify your vendor provides Section 29 transfer safeguards (SCCs or BCRs)

Recommended for complete visibility:

• Choose analytics that supports anonymous tracking for non-consenting users—this allows you to understand full traffic patterns while respecting user choices
• Select a platform that can differentiate consented vs. anonymous data, giving you flexibility in how you use insights

Recommended for marketing performance:

• Prioritize platforms offering real-time or near-real-time data processing (30-minute data freshness or better) to enable faster campaign optimization

Activation layer: marketing tools

Required for compliance:

• Audit all pixels, tags, and tracking codes for PDPA compliance
• Use tag management to control when marketing tools fire based on consent

Recommended for enhanced privacy:

• Consider implementing server-side tracking to reduce client-side data exposure and improve data quality
• Document data flows to each vendor with legal basis – this documentation proves invaluable during regulatory inquiries or audits

Anonymous tracking under Thailand PDPA

One of the most valuable – yet underutilized – PDPA privacy compliance strategies is privacy-preserving anonymous tracking. When implemented correctly, it allows you to understand full traffic patterns, optimize user experience, and measure campaign effectiveness even for visitors who decline consent.

Cross-border data transfers and hosting (sections 28–29)

One of the most significant changes affecting international marketers came in March 2024, when Thailand’s cross-border transfer regulations took full effect. These rules directly impact where you can host analytics tools, how you process data through cloud services, and which vendors you can work with legally.

Thailand’s cross-border data-transfer regime took effect on 24 March 2024 through two PDPC Notifications. It regulates how Thai personal data can be sent abroad.

Section 28 – Transfers to “adequate” destinations

Under Section 28, data may be transferred to a country or international organization that has adequate data-protection standards, as determined by the PDPC.

As of late 2025, no official “adequacy list” has been published. Until then, adequacy must be assessed individually or justified using Section 29 mechanisms.

Countries and regions such as the EU/EEA, UK, Japan, and Singapore are widely considered likely candidates for adequacy, though this is not yet confirmed.

Section 29 – Appropriate safeguards when no adequacy decision exists

When transferring data to destinations not yet approved, you must implement appropriate safeguards, such as:

• Binding Corporate Rules (BCRs): internal policies that apply across a corporate group, subject to PDPC approval.
• Standard Contractual Clauses (SCCs): contractual terms ensuring data protection, enforceable rights, and remedies for Thai data subjects.
• Certified frameworks: participation in recognized certification or code-of-conduct schemes, once approved by the PDPC.

Each safeguard must guarantee:

• enforceable rights for individuals;
• effective legal processes in the event of a breach; and
• adequate technical and organizational security measures.

What this means for your analytics stack

Many marketing teams unknowingly violate Thailand’s transfer rules because popular digital marketing tools process data outside Thailand and may not have proper safeguards in place. Here’s what requires your immediate attention:

• Google Analytics 4: Sends data to US servers (requires Section 29 safeguards)
• Meta Pixel: Processes through multiple global data centers (compliance unclear without SCCs)
• Most CDP platforms: Store data in US/EU clouds (need documented transfer mechanisms)
• Email marketing platforms: Often replicate data across regions (requires vendor assessment)

Hosting digital marketing platforms outside Thailand

The PDPA does not require marketing tools like CMPs or analytics systems to be hosted in Thailand.

However, if your platform stores or processes Thai users’ data abroad, you must ensure:

• The destination country qualifies as (or is expected to be) adequate under Section 28; or
• You have valid safeguards under Section 29 (BCRs, SCCs, or certification); and
• Your privacy or cookie notice clearly discloses the transfer and the protections applied.

Best practice:

• Retain consent logs under your organization’s control (cloud hosting abroad is fine if compliant)
• Include PDPA-aligned clauses in vendor contracts – including 72-hour breach notification and restrictions on onward transfers
• Disclose your CMP’s hosting region (e.g., “Our consent system is hosted in the EU under PDPA-compliant safeguards.”)

Piwik PRO’s analytics platform offers EU-based hosting with documented PDPA-compliant transfer safeguards, giving marketers the complete behavioral data they need while maintaining clear legal standing under Sections 28-29. Unlike cloud-agnostic alternatives, data location and transfer mechanisms are explicit, documented, and audit-ready.

Enforcement and DPO responsibilities (2025)

Thailand’s regulatory approach has evolved from educational to punitive. The August 2025 fines – totaling THB 21.5 million – represent the PDPC’s shift toward active enforcement, particularly targeting organizations with inadequate security measures and those failing to report breaches within mandated timeframes.

Enforcement is intensifying. In August 2025, the PDPC imposed fines totalling THB 21.5 million across five cases, citing failure to report data breaches and poor security measures.

On 9 October 2025, a Royal Gazette notification expanded the DPO appointment obligation to all state agencies, signaling stricter oversight in both public and private sectors.

The regulator now frequently inspects how organizations manage consent records, vendor contracts, and international data transfers.

Common violations triggering enforcement by the PDPC

Understanding what triggers PDPC scrutiny can help you prioritize compliance efforts:

• Collecting data without valid legal basis – Most common in marketing contexts where consent is assumed rather than obtained
• Failing to block cookies before consent – Non-essential tracking that loads before user choice
• Inadequate vendor contracts lacking PDPA clauses – Third-party processors without proper data protection terms
• Processing sensitive data without explicit consent – Particularly problematic in health, finance, and behavioral targeting
• Cross-border transfers without safeguards – Using tools that send data abroad without Section 29 documentation
• Missing or inadequate privacy notices – Failing to inform users about data collection purposes and legal basis

Penalties for non-compliance

• Administrative fines: up to THB 5 million per offence
• Civil damages: including punitive damages up to double the actual loss
• Criminal penalties: up to one year’s imprisonment or THB 1 million fine for certain offences

While these penalties are lower than the GDPR’s global-turnover model, Thailand’s enforcement momentum means poor consent or data transfer practices carry serious financial and reputational risks.