Thailand’s data protection law is often described as similar in structure to Europe’s GDPR. For outreach teams, the similarity that matters most is that consent is not the only lawful basis, and that the alternative, legitimate interests, has to be reasoned rather than assumed.
This is general information, not legal advice. Laws and official guidance change. Check the current position, and take advice on your own circumstances, before acting.
The law in brief
The Personal Data Protection Act B.E. 2562 (2019) came fully into force on 1 June 2022, after its main provisions were postponed. It is overseen by the Personal Data Protection Committee. The Act sets out several lawful bases for processing personal data, including consent, the performance of a contract, legal obligations and legitimate interests.
As with other data protection laws in the region, the Act concerns information about individuals. A generic company inbox is in a different position from a named person’s work address, which is personal data.
What legitimate interest asks of you
Relying on legitimate interests means being able to show three things: that the interest is real and specific, that contacting this person is a reasonable way to pursue it, and that it does not override the person’s own interests and rights. A useful habit is to write that reasoning down before the first message is sent, in plain words.
A legitimate-interest record
Purpose: introduce a food-grade packaging range to companies that pack food for retail.
Why this company: its website describes retail food packing in Thailand.
Why this role: the procurement role is responsible for packaging suppliers.
Message: one short email asking whether they review new suppliers.
How to object: unsubscribe link and reply; both stop all contact.
If the reasoning is hard to write, that is a signal. It usually means the audience is too broad or the person is not the right one.
The right to object
The Act gives individuals the right to object to the processing of their personal data, including processing for direct marketing. An objection to direct marketing should be treated as final. Stop contact across every campaign, not only the one that prompted the reply, and make sure the address cannot be picked up again by a later search.
Being open about the source
The Act also expects individuals to be told about how their data is processed, including where it was collected from another source. In a first email, that can be as simple as saying who you are, why you are writing and that you found the address on the company’s website, followed by a clear way to stop.
Keep follow-ups proportionate
Legitimate interest is easier to sustain for one relevant message than for a long sequence. Each follow-up adds weight to the individual’s side of the balance. A reasonable pattern is a first message, perhaps one follow-up with something new and useful, and then a stop. If there is no reply, record that and move on. Silence is not agreement.
The same logic applies to the data you keep. Hold only what the campaign needs, such as the company, the role, the source of the address and the outcome, and set a point at which records of people who did not reply are reviewed.
Language and how we apply this
Many Thai businesses are more comfortable reading and replying in Thai, and a well-written Thai message is often easier to route internally. If you write in Thai, make sure someone can handle a Thai reply.
Outreach Asia’s rules for Thailand start from published company inboxes. Before a named individual is contacted, a legitimate-interest basis has to be documented. First messages wait 24 hours for review, and objections and opt-outs stop everything immediately.
Before you move on.
- Company inboxes are the default route.
- A written legitimate-interest note exists for every named contact.
- The message explains who is writing, why and where the address came from.
- Objections to direct marketing stop all campaigns.
- A Thai reply can be handled if the message is in Thai.
This is general information, not legal advice. Outreach Asia describes its own rules and practices here; they are not a statement that any particular campaign complies with the law.