Data and the PDPA

1. What the PDPA is

The Personal Data Protection Act B.E. 2562 (2019) is Thailand's general data protection law. It has been fully in force since June 2022 and it is enforced by the Personal Data Protection Committee and its Office.

It will look familiar to anyone who has met the European GDPR: the same idea of a controller and a processor, a short list of lawful bases, a notice duty, a set of rights for the individual, rules on transferring data abroad, and an obligation to report a breach. It is not identical, and the differences that matter to an accommodation are mostly about the other Thai laws that sit underneath it — immigration and the Hotel Act — which oblige you to collect things a guest might otherwise decline to give.

2. Controller and processor, applied to Kohsta

The controller decides why and how personal data is processed. The processor processes it on the controller's instructions.

For guest data, the operator is the controller

You decide to take the booking, you are the accommodation with the filing duties, you decide what to ask a guest for and how long to keep it. The guest's relationship is with your property.

For guest data, Kohsta is your processor

We hold and handle it because you told us to and for your purposes. We do not use guest data for our own ends, do not sell it, and do not market to your guests. If a guest asks us to delete a record, we tell you rather than acting behind your back.

For your own data, Kohsta is the controller

Your account, your billing, your correspondence with us. That is our decision and our responsibility, and it is described in the privacy policy.

This split is not a formality. It decides who has to answer a guest, who has to notify a breach, and who is answerable if something has been collected that should not have been.

3. Lawful bases, and the one that does the work

Under PDPA s.24, general personal data may be processed without consent where one of the listed bases applies. For an accommodation in Thailand, in practice:

Legal obligation — s.24(6)

This is the important one. Immigration notification and the hotel guest register are duties imposed on the accommodation by law, so the data needed for them is processed to comply with a law to which you are subject. Not consent. Not legitimate interest.

Performance of a contract — s.24(3)

The booking itself: names, dates, room, price, payment. You need this to provide the stay the guest asked for.

Legitimate interest — s.24(5)

Running the property sensibly: security, fraud prevention, keeping records of what happened during a stay, improving the service. It is balanced against the guest's rights, so it will not carry anything heavy.

Vital interest — s.24(2)

Rare, but real in hospitality: a medical emergency in a room at two in the morning.

Consent — s.19

For the things that are genuinely optional. Marketing is the obvious one. Consent must be freely given, informed, and separate from everything else — which is why Kohsta stores the marketing opt-in together with the exact wording the guest was shown and the time they agreed to it. A consent you cannot reproduce is not a consent you can rely on.

Pick the basis before you collect the data, not afterwards, and tell the guest what it is: PDPA s.23 requires a notice at or before the point of collection.

4. Why a guest cannot simply refuse TM30 collection

Guests do sometimes object to handing over a passport at a small property, and the objection sounds reasonable. The answer is that it is not your choice to make, and it is not theirs either.

• TM30. The Immigration Act B.E. 2522 (1979) requires the possessor of a house, the manager of a hotel or the head of a household to notify the immigration office when a foreign national stays with them — within twenty four hours of arrival. Kohsta prepares the notification file and tracks that clock; the submission is made by you on immigration's own system.
• The ร.ร.4 hotel guest register. The Hotel Act B.E. 2547 (2004) requires a licensed hotel to keep a register of guests, to enter each arrival promptly, and to send the register to the registrar at regular intervals. It also requires both forms to be kept in a checkable condition for at least one year, and it makes a knowingly false entry a criminal matter for the manager who signed it.

Because these are legal obligations under s.24(6), the guest is not being asked for consent — so there is no consent to withhold, and none to withdraw later. What the guest is entitled to is the truth about it: what is being collected, why, under what law, who will see it and how long it will be kept. Saying "it is the law" while looking irritated is not a PDPA notice. Saying which law, in a sentence, is.

Two things do not follow from a legal obligation. It does not license collecting more than the law asks for — a passport scan kept because it might be handy is not covered by it. And it does not extend to a different purpose: register data cannot quietly become a marketing list.

5. Sensitive personal data

PDPA s.26 draws a much tighter line around certain categories — racial or ethnic origin, political opinions, religious or philosophical beliefs, sexual behaviour, criminal records, health data, disability, trade union membership, genetic and biometric data. These generally need explicit consent, or a specific exemption in s.26.

This is not academic at a hotel desk. A Thai national identity card carries religion. A passport photograph or a facial image used for identification can be biometric data. A guest's dietary or accessibility request can be health data. A signature is normally treated as ordinary personal data rather than biometric, but it is captured for the register and should not be reused for anything else.

Collect what the register and immigration ask for and stop there. If your operation genuinely needs a s.26 category — an accessible room, a medical note — handle it separately, with explicit consent, and do not let it drift into the general guest record.

6. Data subject rights, and where they stop

Subject to the conditions in the Act, an individual may ask for:

• Access to their data and a copy of it (s.30).
• Portability — a machine-readable copy, or transfer to another controller (s.31).
• Objection to processing (s.32).
• Erasure, destruction or anonymisation (s.33).
• Restriction of use (s.34).
• Rectification of data that is wrong or out of date (s.35).
• Withdrawal of consent, where consent was the basis (s.19).

They stop where a legal obligation begins. A guest may ask a hotel to erase their register entry, and the hotel cannot do it while the Hotel Act requires that entry to be kept and checkable. The right answer is to explain the limit, say when it expires, and delete what genuinely is not caught by it — not to refuse the whole request, and not to comply with it and quietly break the register.

Withdrawing marketing consent is different: that is optional data, and it should be acted on immediately.

7. Cross-border transfer

PDPA s.28 restricts sending personal data outside Thailand: the destination must have adequate data protection standards as prescribed, or the transfer must fall within one of the exceptions in the Act — including the individual's informed consent, performance of a contract, or a legal obligation. Section 29 provides for binding policies within a group of companies.

Kohsta uses services that operate outside Thailand, listed in section 6 of the privacy policy. The country the servers themselves sit in is one of the gaps at the top of this page, and it decides whether the hosting of guest data is a domestic matter or a transfer that has to be justified. It has to be settled before this section can be finished honestly.

8. Breach notification

Under PDPA s.37(4), a controller must notify the Office of the Personal Data Protection Committee of a personal data breach without delay and, where feasible, within seventy two hours of becoming aware of it, unless the breach is unlikely to result in a risk to people's rights and freedoms. Where the risk is high, the affected individuals must be notified too, together with what is being done about it.

Applied to Kohsta and an operator:

• We tell you. As the processor, if we become aware of a breach affecting your guests' data we notify you without delay, because your seventy two hours start when you know.
• You notify. As the controller, the notification to the Office — and to guests where the risk is high — is yours to make. We give you what you need to make it: what happened, when, what data was involved and what we have done.
• For data we control — your account and billing — the duty is ours and we will carry it.

Current service availability is shown on the status page.

9. Records, and whether you need a DPO

PDPA s.39 requires a controller to keep a record of its processing activities, available for inspection. A hotel's record is not a long document: guest registration, immigration notification, the hotel register, bookings and payments, marketing where consent was given.

PDPA s.41 requires a data protection officer in certain cases — including where the core activity involves regular monitoring of personal data on a large scale, or the processing of sensitive data under s.26. Whether a particular property crosses that line is a question for a Thai lawyer, and the honest answer for a small guesthouse is usually no. Do not take that as advice; it is context.

10. What this means for an operator using Kohsta

A short and unglamorous list:

• Write a privacy notice for your guests, in Thai and English, and put it where they will actually meet it: on the registration form, not framed behind reception. Say what you collect, why, under what law, who sees it and for how long.
• Keep marketing consent separate from registration. A tick box buried in a required form is not freely given.
• Collect only what the register and immigration ask for. If you cannot name the reason for a field, stop collecting it.
• Control who can see passport scans and signatures. Give staff their own accounts, and remove them the day they leave.
• Keep your register for its statutory year, and do not let "we might need it" turn that into forever.
• Have an answer ready for the guest who asks why you want their passport. One sentence naming the law is worth more than a shrug.
• Know who you would call if data were exposed on a Friday evening, and remember that the clock is seventy two hours, not seventy two working hours.

11. What we do, and what stays yours

What Kohsta does

Keeps passport scans and signature images on private storage rather than anywhere reachable by a link. Scopes each property's data to that property. Releases documents only to an authorised, signed-in member of your staff. Stores marketing consent with the wording shown and the time given. Deletes a guest's files along with their record when you delete it, rather than orphaning them on disk. Gives you exports so your data can leave.

What stays yours

Deciding what to collect. Giving the guest their notice. Choosing the lawful basis. Answering a data subject request. Filing the TM30 and getting the register to the registrar. Notifying the Office if there is a breach. Being right about what your business needs, which is a question for your lawyer and your accountant rather than for us.

Kohsta gives you tools and it removes the excuse of "there was no time". It does not, and cannot, take on your compliance.

12. Making a request

Guests: ask the property you stayed at. They hold your record and they decide what happens to it. If you write to us, we will pass it to them and help them answer.

Operators: write to [email protected], whether it is a request about your own data or an instruction about a guest's.

You may also complain to the Office of the Personal Data Protection Committee.

Registered name

AW Code Company Limited

Company registration number

0205557033660

Registered address

244/127-128 Moo 6, Nong Prue, Bang Lamung, Chon Buri 20150, Thailand

Taxpayer identification number

0205557033660