03 / Compliance Landscape
PDPA enforcement is no longer theoretical. First fines have landed.
THB 21.5 million in August 2025 fines ended the informal grace period. Six priority guideline areas under public consultation. PDPC and NCSA now conducting joint site audits for fiscal year 2026.
PDPA B.E. 2562: from grace period to active enforcement
First significant fines issued August 2025. March 2026 consultation on six priority areas.
What's happening
PDPA B.E. 2562 has been effective since 27 May 2020. The PDPC operated in an informal grace period for five years. That ended in August 2025 with administrative fines exceeding THB 21.5 million. March 2026 public consultation covers six priority guideline areas.
Why it matters
The six priority areas directly affect BGV operations: legal bases for processing (including employment screening), security measures, breach notification, DPO obligations, records of processing activities, and national ID card data collection.
Where it breaks
Vendors who treated PDPA compliance as aspirational now face concrete enforcement risk. BGV contracts signed before August 2025 may not reference PDPA compliance at all. Renewal cycles are the remediation window.
Reality insight
Employer screening is recognised as a legitimate purpose under PDPA. But legitimate purpose does not eliminate the consent requirement. Explicit, informed, free consent remains mandatory. Pre-ticked or silent consent is invalid.
THB 21.5M
Total fines issued
August 2025, first significant PDPC enforcement
USD 666K
Approximate equivalent
EUR 576K at August 2025 rates
6
Priority guideline areas
March 2026 public consultation
PDPC March 2026 priority guidelines
- Legal bases for processing, including employment screening scenarios.
- Security measures and breach notification protocols.
- Data Protection Officer (DPO) obligations and qualifications.
- Marketing data use, including consent requirements for commercial communications.
- Records of processing activities, with specific retention expectations.
- CCTV and national ID card data collection, directly relevant to workplace identity verification.
Regulatory signal · 26 May 2026
Thailand's PDPC and NCSA conducted a joint FY2026 site audit at a major Thai public institution against a 10-point Regulator Checklist covering PDPA controls and cybersecurity measures. The combined data-protection and cyber-resilience inspection model, led by named officers from each agency, is now operating on a fiscal-year cadence and is the clearest indicator yet that PDPA enforcement and Cybersecurity Act enforcement have converged into a single supervisory workflow.
Source: Khon Kaen University news release, 26 May 2026.
Operational impact for BGV vendors
The PDPC's March 2026 consultation covers security measures, breach notification, and records of processing activities. All three areas directly affect how BGV vendors handle Thai candidate data. Clients should ask vendors to demonstrate documented compliance with each of the six priority areas.
Decision trigger
Does your current BGV contract reference PDPA B.E. 2562 compliance? Can your vendor produce a documented consent framework, breach notification SLA, and data retention policy on demand?
04 / Operational Gaps
Every check type has its own dependency chain and consent requirement
Identity is reliable. Employment requires direct HR contact. Education demands Thai-language registrar engagement. Criminal access depends on documented separate consent. Address coverage varies by geography.
Verification process: where it stalls
1
Candidate consent
PDPA-compliant capture
2
Identity
Thai National ID, 0-1 day
3
Employment
SSO + HR confirm
4
Education
OHEC + registrar (Thai)
Stall: Thai-language only
5
Criminal
RTP + court records
Stall: consent overhead
6
Address
Field visit, geo-tagged
Identity: Thai National ID is highly reliable
- Thai National ID Card (13-digit, biometric-linked): mandatory for all Thai citizens. Most widely used and reliable identity document.
- Blue Book (household registration): supports address and family relationship verification. Secondary to national ID.
- Passport and Driver's License: acceptable for identity but not primary for domestic employment screening.
- Dual-document validation is standard practice.
Employment: SSO records and direct HR contact
- Direct HR contact is the primary source. Larger BPO and IT companies support direct verification.
- SSO (Social Security Office) maintains employee contribution records for registered workers. Verification is institution-by-institution, not centralised.
- Gap: no unified labour ministry portal. Informal-sector workers may have HR confirmation as the only source.
Education: Thai-language engagement is mandatory
- OHEC maintains list of accredited universities. Institutions not on list are not recognised.
- Education verification requires direct registrar contact via email or certified mail, often requiring Thai-language communication.
- Most institutions lack English-language enquiry processes. This is a material operational requirement.
- International credentials verified through ThECES and bilateral agreements, but no automated pathway exists.
Thai-language registrar requirement
Many Thai educational institutions do not respond to English-language enquiries. Verification vendors must have Thai-language capacity to contact registrars and interpret responses. This is not optional.
Criminal: dual-path, consent-dependent
- Royal Thai Police (RTP) Criminal Records Division: primary source for national criminal record certificates. Response is "No Record Found" or "With Record."
- Court records: maintained separately from police records. A clean RTP certificate does not guarantee absence of pending cases, dismissed charges, or civil judgments.
- Separate written consent required, specific to criminal record access. Cannot be bundled with general BGV consent.
Address: geography-dependent coverage
- Bangkok has robust field-visit networks. Provincial and remote verification incurs higher costs and longer timelines.
- For regulated roles, both current and permanent address may be required, involving field visits to provincial family residences.
Credit: restricted access
- National Credit Bureau (NCB), regulated by Bank of Thailand, is the primary consumer credit bureau.
- Access is restricted to Bank of Thailand-regulated financial institutions. Private BGV screening does not typically include credit checks.
turnaround time by check
Realistic TAT range per check type (days)
Observed ranges across Thailand IT-BPO programmes, 2024-2025. Gold marker = typical median.
IdentityThai National ID
0-1 days
EmploymentSSO + HR confirm
2-5 days
EducationOHEC + registrar (Thai)
3-10 days
Criminalconsent overhead + RTP
3-8 days
Address, urbanfield-visit, Bangkok
2-4 days
Address, provincialfield-visit, regional
5-10 days
Source: OutsourceVerify Thailand operating data, IT-BPO programmes, 2024-2025.
What companies assume
Thailand is simple because it is smaller
Criminal checks are automatic
English-language institutional engagement works
BOI and non-BOI screening is the same
PDPA enforcement is still theoretical
Credit checks are part of standard BGV
What actually happens
Smaller does not mean simpler. Consent requirements and language constraints are non-negotiable.
Criminal checks require separate explicit consent. Cannot be bundled with general BGV authorisation.
Most Thai institutions do not respond to English-language enquiries. Thai-language capacity is mandatory.
BOI-promoted companies have different foreign worker quotas and permit paths. Records are held in different systems.
THB 21.5M in fines issued August 2025. Enforcement is real.
NCB access is restricted to regulated financial institutions. Not available for private BGV.
Decision trigger
When your vendor reports "completed" on a Thai education check, does that mean institutional confirmation via Thai-language registrar contact, or an English-language email that was never answered?
05 / Decision Impact
Three scenarios. Three different risk exposures.
Your operating context determines your verification risk. Each scenario maps to a distinct failure mode in the Thai market.
BOI-Promoted Expansion
Hiring through a BOI-promoted entity in the Eastern Seaboard or Bangkok periphery. Foreign worker quotas differ. Work permits bypass standard Department of Employment records.
Risk: Standard screening paths produce false "no record found" results for BOI-tracked permits.
Medium exposure
Market Entry into Thailand
First shared services or outsourcing engagement. No baseline for Thai-specific requirements. Vendor selection based on regional coverage claims without verifying Thai-language capacity.
Risk: Programme designed without understanding consent and language constraints.
Medium exposure
PDPA Audit Exposure
Client or regulator audit requires evidence of PDPA-compliant consent capture, separate criminal record consent, and data retention compliance. First fines landed August 2025.
Risk: Vendor cannot produce consent trails, breach notification SLA, or records of processing activities.
High exposure
Decision trigger
The right question is not "which vendor covers Thailand." It is: does the vendor have Thai-language institutional capacity, documented separate consent for criminal checks, and PDPA compliance evidence?
Executive Intelligence Summary
Thailand: 7 conclusions for decision-makers
Thailand is operationally simpler than larger regional peers, but not procedurally simpler. Two non-negotiable constraints: Thai-language registrar engagement and separate explicit consent for criminal record access.
PDPA enforcement is now real. THB 21.5 million in fines issued August 2025. Six priority guideline areas under consultation. Vendors without documented PDPA compliance are a liability.
Criminal record access is strictly consent-based and cannot be bundled. PDPA Section 26 classifies criminal records as sensitive data. Blanket check policies may not satisfy proportionality requirements. Three penalty layers apply.
Thai-language capacity is not optional. Most educational institutions do not respond to English-language enquiries. Vendors without in-house Thai-language registrar engagement cannot complete education verification reliably.
BOI-promoted companies create a split screening landscape. Foreign worker quotas, permit rules, and reporting obligations differ. Records are held in different systems. Failing to account for this produces false negatives.
Credit checks are not available for private BGV. NCB access is restricted to Bank of Thailand-regulated financial institutions. Vendors claiming credit check capability for non-financial employers should be questioned.
Vendor evaluation should test for Thai-specific operational depth. Ask for Thai-language registrar engagement evidence, separate criminal consent documentation, PDPA compliance framework, and BOI vs non-BOI screening differentiation.
Country benchmark
Thailand Verification Benchmark Pack
Market-specific constraints, institutional access data, typical timelines, and source verification pathways. PDF format, designed for internal circulation.
Request benchmark
Delivery in this market
Verification in this jurisdiction is executed by a regional cell with direct institutional access, operating under our central programme office. Cases run in parallel with other active markets. Evidence standards, quality gates, and escalation protocols are identical regardless of geography. Surge capacity is pre-built, not assembled on demand.
About this brief. Reflects the regulatory and operational landscape as of May 2026. Workforce data sourced to Thailand's Board of Investment (BoI). TAT ranges and red flag detection rates are first-party operating data, presented as observed ranges. PDPA enforcement data sourced to PDPC official publications.
References
- Thailand Board of Investment (BoI), IT and digital sector promotion and workforce statistics. https://www.boi.go.th
- Personal Data Protection Act B.E. 2562 (2019), official text and amendments. pdpc.or.th
- Personal Data Protection Committee (PDPC), regulatory authority and guidance. https://www.pdpc.or.th
- Social Security Office (SSO), employment contribution records. https://www.sso.go.th
- Office of the Higher Education Commission (OHEC) / Ministry of University Affairs (MUA), higher education regulation and accreditation. mua.go.th
- Royal Thai Police, Central Criminal Records Division, criminal record certificates and inquiries. https://www.royalthaipolice.go.th
- National Credit Bureau (NCB), credit information system regulated by Bank of Thailand. ncb.co.th
- Department of Provincial Administration (DOPA), National ID and household registration. dopa.go.th
- Department of Land Transport (DLT), Driver's license issuance and verification. dlt.go.th
- Royal Thai Police, Immigration Bureau, Passport and immigration services. immigration.go.th
- Bank of Thailand, Financial services regulator and credit system overseer. bot.or.th
- Thai Education Credentials Evaluation System (ThECES), international credential equivalence evaluation. mua.go.th
- Royal Thai Police, Criminal Records Bureau, public criminal record information portal. royalthaipolice.go.th
- Thailand Digitalization for Development Institute (DDI), government IT and digital transformation agency. ddi.go.th
- PDPC Enforcement Actions (August 2025), first significant administrative fines totalling THB 21.5 million. pdpc.or.th
- PDPC Public Consultation on Priority Guidelines (March 2026), six priority guideline areas including legal bases, security measures, DPO obligations, marketing, records of processing activities, CCTV and national ID data. pdpc.or.th
- Courts of Justice, Thailand, court records system and case search. coj.go.th
- BOI Foreign Worker and Expert Provisions, foreign worker quotas and simplified work permit procedures for promoted companies. boi.go.th
- Department of Employment, Ministry of Labour, work permit administration for non-BOI entities. doe.go.th