Lawful Bases for Processing Personal Data

Last updated 27 September 2026 · References the Personal Data Protection Act B.E. 2562 (2019) as currently in force

Download the article as PDF (Thai)

I. Consent as the Rule, the Exceptions as the Way Out

The lawful bases under Section 24 of Thailand’s Personal Data Protection Act B.E. 2562 (2019) (the PDPA) are six exceptions that allow a data controller to collect personal data without asking for consent. The general rule of Thai law is that consent must be obtained before or at the time personal data is collected, used, or disclosed. If there is no valid consent and none of the exceptions applies, the processing has no basis.

Section 19 paragraph one lays down the rule: a data controller may not collect, use, or disclose personal data unless the data subject has given consent beforehand or at the time, except where the law permits it.¹ Section 24 uses the same formulation. It prohibits collection without consent “unless” one of the six cases in its subsections applies.²

The use and disclosure stages follow the same rule. Section 27 prohibits use or disclosure without consent unless the data was collected under an exemption in Section 24 or Section 26.³ The basis chosen at the collection stage therefore also sets the boundaries of how the data may be used later.

Sensitive personal data is governed by a separate provision, Section 26, whose conditions are stricter. This article covers only general personal data under Section 24.

II. The Six Exceptions in Section 24

Section 24 divides the exceptions into six cases. Subsections (3), (4), and (5) use the words “is necessary,” so the data controller must be able to show that the collection is genuinely necessary for the purpose, not merely useful. The other three cases, in subsection 1, subsection 2, and subsection 6, each specify a particular purpose or ground. The legitimate interests case is the only one in which the statute itself directs a balancing against the rights of the data subject.

The table shows that the substance of five of the cases corresponds almost entirely to bases in the GDPR. The difference lies in the structure. The GDPR places consent as basis (a) on an equal footing with the other five,⁶ whereas Thai law makes consent the rule and the six cases exceptions.

The practical consequence of the Thai structure has two layers. First, a data controller relying on an exception bears the burden of showing that its case meets the elements of that subsection. Second, exceptions should be read according to their terms; stretching an exception beyond its wording erodes the consent rule that the statute has set.

III. Valid Consent under Section 19

Valid consent must be given explicitly, in writing or through electronic means, with the purpose stated, separated from other text, in plain and readable language, without deception, and freely. The data subject must be able to withdraw it as easily as it was given. Consent that does not meet these conditions has no binding effect on the data subject.

Section 19 paragraphs two and three prescribe the form: a request for consent must be made explicitly, in writing or through electronic means, unless that is impossible by its nature, and the purpose must be stated at the same time. The request must be clearly separated from other matters, easily accessible, intelligible, and must not deceive or mislead.¹

Paragraph four is the provision organizations most often overlook. The statute requires the data controller to “utmost take into account that the data subject’s consent is freely given,” and when entering into a contract or providing a service there must be no condition requiring consent to data that is not necessary for or related to that contract.¹ A form that bundles marketing consent with service registration therefore risks that part of the consent having no effect.

Paragraph five allows the data subject to withdraw consent at any time, and withdrawal must be as easy as giving consent, unless the right to withdraw is restricted by law or by a contract that benefits the data subject. Withdrawal does not affect processing already lawfully carried out. The final paragraph states the consequence of invalid consent clearly: it has no binding effect on the data subject and does not enable the data controller to collect, use, or disclose the data.¹

It is worth noting that consent is the most fragile of all the bases, because as a rule the data subject can withdraw it at any time. If processing is already necessary for the performance of a contract or a legal obligation, adding a layer of consent on top may create the false impression that the data subject has a choice, when in reality the organization must continue processing on another basis.

IV. Legitimate Interests and the Right to Object

The legitimate interests basis under Section 24 (5) has three elements: a genuine legitimate interest, a collection that is necessary for that interest, and an interest that is not less important than the fundamental rights of the data subject in their personal data. When this basis is used, the data subject has the right to object under Section 32 (1).

The wording of Section 24 (5) is “it is necessary for legitimate interests of the Data Controller or any other Persons or juristic persons other than the Data Controller, except where such interests are overridden by the fundamental rights of the data subject of his or her Personal Data.”² The closing clause beginning with “except” is the balancing test that the statute itself requires.

Section 32 (1) allows the data subject to object at any time to the collection, use, or disclosure of data collected under Section 24 (4) or (5), unless the data controller proves a compelling legitimate ground that outweighs the objection, or that the processing is for the establishment, exercise, or defense of legal claims.⁴ At the objection stage, the burden of proof therefore falls on the data controller.

As at the date this article was updated, the author searched the Supreme Court judgment database using the Thai terms “ผู้ควบคุมข้อมูลส่วนบุคคล” (data controller), “คุ้มครองข้อมูลส่วนบุคคล” (personal data protection), and “เจ้าของข้อมูลส่วนบุคคล” (data subject) and found no Supreme Court judgment ruling directly on Section 24 or Section 32. Interpretation at this stage therefore relies on the statutory text and on the approach of foreign legal systems with similar provisions.¹³

The practical consequence is that this basis should be supported by a balancing record prepared before processing begins, setting out the interest relied on, why the data is needed, the impact on the data subject, and the measures taken to reduce that impact. This document is the first piece of evidence when an objection or complaint is made. Thai law does not prescribe the form of such a record, but Singapore law does, as explained in the next section.

V. Comparative Law: the European Union and Singapore

The EU’s GDPR places six bases on an equal footing in Article 6(1), and the Court of Justice of the European Union has read the contract and legitimate interests bases narrowly. Singapore uses a consent-first system similar to Thailand’s but requires organizations to assess the impact before relying on the legitimate interests exception. These two systems help in reading the gaps in Thai law.

European Union. GDPR Article 6(1) provides that processing is lawful only if at least one of the following applies: (a) consent, (b) contract, (c) legal obligation, (d) vital interests, (e) public task, and (f) legitimate interests, which is unavailable where those interests are overridden by the interests or fundamental rights of the data subject; the following subparagraph bars public authorities from relying on basis (f) in the performance of their tasks.⁶ The definition of consent in Article 4(11) requires it to be “freely given, specific, informed and unambiguous,” and Article 7(4) directs that making the performance of a contract conditional on consent to data that is not necessary be taken into account in assessing whether consent is freely given.⁷ Section 19 paragraph four of the Thai Act matches Article 7(4) in substance. Recital 43 adds that consent should not provide a valid ground where there is a clear imbalance between the controller and the data subject, in particular where the controller is a public authority.⁸

The Court of Justice of the European Union laid down an approach that can be applied directly in reading Section 24 of the Thai Act in Meta Platforms v Bundeskartellamt (C‑252/21), judgment of the Grand Chamber of 4 July 2023. The Court held that processing can be “necessary” for the performance of a contract only if it is “objectively indispensable” for a purpose that is integral to the contractual obligation; it is not enough that the contract refers to the processing or that the processing is useful for performing the contract (paragraphs 98 to 99). The Court separated the conditions of the legitimate interests basis into three cumulative requirements (paragraph 106) and held that users of a free social network cannot reasonably expect the operator to process their data for personalized advertising without their consent (paragraph 117). A dominant market position does not in itself invalidate consent, but it is an important factor that the operator must address in proving that consent was freely given (paragraph 154).⁹

Singapore. Section 13 of the Personal Data Protection Act 2012 prohibits an organization from collecting, using, or disclosing personal data unless the individual gives, or is deemed to have given, consent, or the collection, use, or disclosure without consent is required or authorized by law. This structure is closer to Thailand’s than to the GDPR. The legitimate interests exception sits in the First Schedule, Part 3, paragraph 1, which requires that the organization’s interests outweigh any adverse effect on the individual and obliges the organization to “conduct an assessment” before collecting, using, or disclosing the data, as well as to give individuals reasonable access to information about its reliance on the exception.¹⁰

Three comparative conclusions follow. First, Thailand belongs structurally to the same group as Singapore: consent is the rule. Second, the substance of the Thai exceptions matches the GDPR, so the European court’s narrow reading of “necessary” can serve as a tool for reading Section 24 (3) and (5). Third, the assessment that Singapore requires before the legitimate interests basis is used is a practice that Thai organizations can adopt to meet their burden of proof under Section 32 (1).

VI. Law and Economics and Interdisciplinary Perspectives

Scholarship in law and economics shows that a system that leaves each person to manage their own privacy through consent has both cognitive and structural limits. Ordinary people lack the time and information to weigh the costs and benefits of every consent. This explains why the law needs bases other than consent, and why those bases must be subject to conditions.

Daniel J. Solove calls the approach that lets individuals decide about their own data through notice and consent “privacy self-management” and identifies two layers of problems. The first is cognitive: empirical research shows that people cannot make informed, rational decisions about the costs and benefits of consenting. The second is structural: even a fully informed person cannot manage the task, because there are too many data collectors to deal with one by one, and much of the harm arises later from the aggregation of many pieces of data from many sources.¹¹

Solove cites a study estimating that if everyone read the privacy policy of every website they visited in a year, the lost productivity would be worth around 781 billion US dollars.¹¹ This figure converts the limits of consent into a transaction cost. When the cost of an informed decision exceeds the benefit to each individual, a great deal of consent becomes a mere click of acceptance rather than a real decision.

Alessandro Acquisti, Curtis Taylor, and Liad Wagman survey the economic literature on privacy in the Journal of Economic Literature and conclude in their abstract that privacy protection may either increase or decrease individual and societal welfare depending on the context, and that in the digital economy consumers are often in a position of incomplete or asymmetric information about when data is collected, for what purpose, and with what consequences.¹²

Reading Section 24 through this framework makes the role of the six exceptions clearer. They shift part of the decision from individual data subjects to the law. The word “necessary” and the balancing test in subsection (5) serve to prevent the data controller, which holds more information, from using the exceptions beyond their scope. Consent should therefore be reserved for cases in which the data subject has a genuine choice.

VII. Practical Considerations for Organizations

The lawful basis should be chosen before processing begins and activity by activity, not organization-wide. The basis chosen determines the notice that must be given, the rights that the data subject can exercise, and the scope of later use of the data. Choosing the wrong basis has civil and administrative consequences and affects the organization’s credibility.

• Keep a register of activities with their bases — Identify each processing activity, the data used, and the subsection that supports it, because Section 27 ties use and disclosure to the basis at the collection stage.
• Use consent where the data subject has a genuine choice — For example, direct marketing or sharing data with partners, and separate the consent request from the terms of service in accordance with Section 19.
• Read “necessary” narrowly — The contract basis covers data that is indispensable for delivering the service; data that merely improves the service should be considered under another basis.
• Record the balancing test before relying on legitimate interests — Use the framework of the Singapore assessment and prepare to respond to objections under Section 32 (1).
• Review existing forms — Consent that does not comply with Section 19 has no binding effect, and a breach of Section 24 or obtaining consent by deception carries an administrative fine of up to three million baht under Section 83.⁵

VIII. Frequently Asked Questions

Frequently asked questions about lawful bases under the PDPA usually concern five points: what exceptions Section 24 contains, whether consent is in Section 24, when the legitimate interests basis may be used, the consequences of invalid consent, and how far GDPR practice can be applied to Thai law. The answers below cite the statutory text in the footnotes on this page.

What are the lawful bases under Section 24 of the PDPA?

Section 24 allows personal data to be collected without consent in six cases: (1) historical documents, archives, research, or statistics with appropriate safeguards; (2) preventing or suppressing a danger to life, body, or health; (3) necessity for the performance of a contract or for taking steps at the data subject’s request before entering into a contract; (4) a task in the public interest or the exercise of official authority; (5) legitimate interests; and (6) compliance with a law to which the data controller is subject.

Is consent one of the six bases in Section 24?

No. Consent is the general rule under Section 19 and under the opening words of Section 24 itself. The six cases in Section 24 are exceptions that remove the need to ask for consent. This structure differs from GDPR Article 6(1), which places consent as one of six bases of equal weight.

When can the legitimate interests basis be used?

It can be used when the collection is necessary for the legitimate interests of the data controller or of another person, and those interests are not less important than the fundamental rights of the data subject in their personal data. The controller must therefore carry out a balancing test every time, and the data subject has the right to object under Section 32 (1).

What happens if consent is not obtained correctly?

The final paragraph of Section 19 provides that a request for consent that does not comply with the requirements of that Chapter has no binding effect on the data subject and does not enable the data controller to collect, use, or disclose the data. A breach of Section 24, or obtaining consent by deception, carries an administrative fine of up to three million baht under Section 83.

Can a business that already follows the GDPR apply the same approach to the PDPA?

To a large extent, yes. The six cases in Section 24 are close in substance to GDPR Article 6(1)(b) to (f), and Section 19 contains a freely given consent principle similar to Article 7(4). Two adjustments are needed: Thailand’s consent-first structure, and the research or statistics case, which Thailand treats as a specific exception subject to a notification of the Committee.

IX. Related Topics across the Eksiam Group

This page is Eksiam Legal’s main page on personal data and data governance, explaining the principles and the comparative law. Practical steps for businesses, disclosure of data under tax law, and the theoretical foundations of rights in data are covered on dedicated pages across the Eksiam group, listed below.

• PDPA for Business (Thai) — Practical steps, data subject rights, the DPO, and penalties, for business executives
• PDPA and the Revenue Department (Thai) — Disclosure of customer data under legal obligations in tax law
• From the UDHR to the PDPA (Thai) — The development of personal data law globally and in Thailand
• Is Personal Data Property or a Right? (Thai) — The theoretical foundations of data protection
• PDPA for Foreign Businesses in Thailand — For foreign businesses that collect data on people in Thailand