As of late October 2026

‍

Introduction: from regulatory declarations to administrative fines and the "Eagle Eye" crawler

‍

While the initial years after the enactment of Thailand’s Personal Data Protection Act B.E. 2562 (PDPA) were largely seen by domestic businesses and foreign contractors as a procedural formality, 2026 marked a definitive shift into a "Strategic Enforcement" era.

‍

The Personal Data Protection Committee (PDPC), working alongside the Ministry of Digital Economy and Society (MDES), has deployed round-the-clock automated surveillance tools (notably the PDPC Eagle Eye Crawler), actively targeted both Data Controllers and technical Data Processors with substantial administrative fines (reaching up to THB 5–7 million), and strictly enforced cross-border data transfer mandates under Sections 28 and 29 of the PDPA.

‍

For Ukrainian IT outsourcing firms, software vendors, SaaS platforms, digital agencies, and fintech providers serving Thai clients or processing Thai residents' data from abroad, these developments introduce direct legal, technical, and operational liabilities. This article examines the current regulatory architecture, key compliance pitfalls, and practical steps forward.

‍

1. Cross-border data transfer framework: requirements under Sections 28 and 29

‍

Thailand's PDPA mirrors the European Union’s GDPR: personal data originating in Thailand must not lose protection when it crosses international borders. Subordinate regulations issued by the PDPC classify permissible transfer mechanisms into distinct legal pathways:

‍

• Jurisdictional Allowlisting (Section 28):
• Standard Contractual Clauses (SCCs / Section 29):
• Binding Corporate Rules (BCRs):
• Explicit and Informed Consent:

‍

2. Direct liability of Data Processors and Mandatory DPAs

‍

A critical misconception among overseas service providers was that regulatory liability attached solely to the local Thai Data Controller. Recent enforcement decisions by the PDPC have fundamentally altered this paradigm:

‍

• Direct Processor Sanctions: The regulator now imposes administrative fines directly upon third-party vendors and Data Processors for technical failures, security oversights, and data leaks (penalties reaching THB 3–5 million per violation).
• Compulsory Data Processing Agreements (DPA): The absence of an executed, legally valid DPA between Controller and Processor constitutes an independent administrative offense.
• Sub-processing Restrictions: Any foreign vendor utilizing cloud infrastructure (e.g., AWS, GCP, Microsoft Azure) or downstream technical sub-contractors must secure prior documented authorization from the Thai Data Controller before deploying sub-processors.
• Breach Notification Timelines: Technical infrastructure must maintain protocols that can identify breaches and alert the Data Controller without delay, ensuring the Controller can meet the mandatory 72-hour notification window to the PDPC.

‍

3. Automated regulatory oversight: the "Eagle Eye" surveillance ecosystem

‍

Regulatory supervision has evolved from post-incident reports to active digital tracking:

‍

• The PDPC Eagle Eye Crawler conducts automated 24/7 web-scraping and system monitoring of applications, client portals, and e-commerce platforms operating in Thailand to detect exposed databases, unauthenticated endpoints, missing consent triggers, or unauthorized third-party tracking scripts.
• Detected discrepancies lead directly to formal administrative remediation orders or prompt investigations without prior on-site audit visits.

‍

4. Critical legal and commercial analysis

‍

Extraterritorial Jurisdiction:

‍

Section 5 of the PDPA expressly asserts extraterritorial applicability: foreign entities that offer goods or services to data subjects in Thailand, or monitor their online behavior within Thailand, fall squarely within the Act's scope, regardless of whether they maintain an incorporated presence or personnel in the Kingdom.

‍

Operational Deadlock from Whitelist Inaction:

‍

The ongoing delay in publishing a formal list of adequate jurisdictions eliminates the simplest transfer route, requiring Ukrainian and international businesses to negotiate and execute bespoke SCCs for every client engagement.

‍

Civil and Criminal Exposure:

‍

Beyond administrative fines of up to THB 5 million per infraction, the PDPA empowers civil courts to award punitive damages up to twice the proven actual damage. Unauthorized disclosure or commercialization of Sensitive Personal Data (such as health, biometric, or financial profile records) also carries potential criminal penalties, including imprisonment of responsible corporate directors for up to one year.

5. Implications for Ukrainian companies

‍

IT Outsourcing and Managed Services:

‍

Commencing any project involving Thai user data without an executed, PDPA-compliant Data Processing Agreement (DPA) creates an immediate compliance default. Standard, generic GDPR clauses must be customized to cite the relevant Thai statutory provisions and acknowledge Thai regulatory oversight.

‍

SaaS, EdTech, and Fintech Platforms:

‍

Digital platforms accessible in Thailand must overhaul their user onboarding flows. Consent forms, cookie banners, and Privacy Notices must meet the PDPC’s granularity requirements - pre-ticked boxes and buried transfer clauses are legally void.

‍

Data Protection Officer (DPO) Appointments:

‍

Where overseas service models involve large-scale tracking, behavioral analytics, or systematic processing of sensitive categories, the foreign provider may need to formally appoint a Data Protection Officer or designate a local representative to interface with the PDPC.

‍

Synergy with Corporate Scrutiny:

‍

This compliance regime intersects directly with the Department of Business Development’s (DBD) heightened scrutiny of foreign-controlled corporate structures. Local joint ventures or branch offices are now evaluated simultaneously across financial substance, foreign ownership compliance, and digital security governance.

‍

6. Practical compliance checklist

‍

1. Contractual Review: Has a standalone Data Processing Agreement (DPA) incorporating adapted Standard Contractual Clauses (SCCs) been signed with the Thai client?
2. Records of Processing (ROPA): Does the company maintain an up-to-date registry detailing the volume, destination country, technical security measures, and legal basis for all exported Thai data?
3. Sub-processor Governance: Are all downstream hosting providers, API vendors, and analytics tools explicitly authorized in writing by the primary controller?
4. Incident Response Protocol: Are technical procedures established to detect, contain, and report data breaches internally within 24 hours of discovery?
5. Security Baseline Audit: Have client-facing interfaces, databases, and API integrations been audited against automated crawlers to eliminate exposed endpoints?

‍

Conclusion

‍

Thailand’s transition toward active, automated enforcement of cross-border data transfer rules signals an end to informal data processing agreements. For Ukrainian companies operating to high engineering and technical standards, these rules are not an insurmountable obstacle, as their core principles closely parallel the European GDPR. However, treating privacy documentation as an afterthought now carries the tangible risk of contract termination, contractual indemnities, and regulatory fines as Thai enterprise clients increasingly refuse to clear payments without validated data protection compliance.

‍

Connect with TUCC

‍

Stay updated with the latest market insights, legal guides, and networking opportunities within the Thai-Ukrainian business corridor.

‍

Website: thaiukraine.org

‍

Email: info@thaiukraine.org

‍

LinkedIn: Thai-Ukrainian Chamber of Commerce