> ## Documentation Index > Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt > Use this file to discover all available pages before exploring further. # Thailand PDPA (PDPA B.E. 2562 + PDPC Thailand) > Run Thailand outbound on the PDPA's express-consent line: refuse unbacked contacts, record the basis per channel, file DSARs on the 30-day pdpa clock, and keep the RoPA-class privacy register the PDPC Thailand reads first. # Thailand PDPA (PDPA B.E. 2562 + PDPC Thailand) Thailand's Personal Data Protection Act B.E. 2562, in force since 2022, reads closer to the EU shape than Singapore's regime does: express consent at collection for marketing, a rights chapter administered by the Personal Data Protection Committee (PDPC Thailand), and explicit processing-records duties in sections 39–41. The access-and-correction clock both markets share is the 30-day `pdpa` family on the [DSAR page](/compliance/dsar). Two things separate Thailand from Singapore for an operator: there is no national DNC register to scrub, so your own suppression layer answers for every recipient who revoked, and the consent line is the strict one — unbacked contacts should receive no marketing at all. The combined [Singapore and Thailand PDPA Posture](/compliance/pdpa-singapore-thailand) page holds the cross-market obligation map; this page is the Thailand-only checklist and worked sequence. Singapore's self-standing page is [Singapore PDPA](/compliance/singapore-pdpa). This page describes Orbit's platform controls. It is **not legal advice.** Which PDPA obligations apply to you — express consent or an exception, what basis fits a cross-border transfer — depends on your processing. Confirm with qualified counsel. *** ## The TH checklist **Data-residency posture.** Thailand's cross-border transfer rule accepts the adequate- destination, BCR, and consent-style bases; which fits is the assessment you run on your transfer facts. For voice, the residency pin ([Voice Data Residency](/compliance/voice-data-residency)) records where recordings physically live, and BYOK ([BYOK Customer Managed Keys](/compliance/byok-customer-managed-keys)) carries the localization claim where you need it. Map the whole transfer posture per [Data Residency Overview](/compliance/data-residency-overview). **Sender registration.** Read the `TH` rows returned by `GET /compliance/country-rules?channel=sms` for the channel you send; Thailand's PDPC regime is consent-led, so sender registration sits at the operator and aggregator level rather than in a regulator pre-approval. The row, not this page, is authoritative, and [Country Compliance Requirements](/compliance/country-requirements) documents the read. **KYC document roles.** Operator- and aggregator-facing filings attach to the [KYC identity model](/compliance/kyc-identity-model): corporate identity as `business_doc`, address evidence as `address_proof`, individual signers as `id_proof`. Orbit never files a registration on your behalf; it exposes the row and the gate and delivers once the row reports `approved`. **Opt-in aliases.** Thailand takes the express-consent line: record the grant per channel with `lawful_basis: consent` and the purpose string your TH notice disclosed (s6 turns on the disclosed purpose), and keep `unknown_marketing_policy: refuse` plus `consent_default_policy: deny_on_missing` for TH recipients so an unbacked contact receives no marketing — the two knobs are tenant-owned, see [Consent Posture: The Unknown-Consent Policies](/compliance/consent-default-policy). English `STOP` aliases are the canonical APAC expectation; extend the vocabulary on the [Opt-Out Keyword Alias Table](/compliance/opt-out-keyword-alias-table) and treat every reply as a suppression entry. **DSAR clock.** Requests from Thai data subjects file under the same coded jurisdiction, `applicable_jurisdiction: "pdpa"` — the **30-day clock** tracks the request with or without the SG/TH split. Erasure outcomes flow into suppression the same way as Singapore subjects. **DST concern.** Thailand sits at a fixed UTC+7 with no DST. No statutory quiet-hours window exists; the restraint inherits from carrier practice. Set a recipient-timezone-resolved default (21:00–08:00 TH time) on [Quiet-Hours Configuration](/guides/quiet-hours-configuration) and validate it with [Quiet-Hours Preview](/compliance/quiet-hours-preview). *** ## Worked sequence for a Thailand recipient **Step 1 — capture consent explicitly.** ```bash theme={null} curl -X POST https://api.orbit.devotel.io/api/v1/compliance/consent \ -H "Authorization: Bearer $ORBIT_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "identifier": "+66812345678", "channels": ["sms"], "opt_in": true, "consent_type": "marketing", "lawful_basis": "consent", "purpose": "Marketing SMS — purpose disclosed at collection (TH PDPA s6 duty)." }' ``` **Step 2 — sender and scrub.** Thailand has no DNC register in the scrub chain; your suppression layer answers for every recipient who revoked regardless. The country-rules row for TH on the channel you send is the sender-registration answer. **Step 3 — wire withdrawal to suppression.** `STOP` replies and the consent API with `opt_in: false` land on the same list — [Opt-Out & Suppression Lists](/compliance/opt-out-suppression). **Step 4 — file a DSAR on the same `pdpa` code.** ```bash theme={null} curl -X POST https://api.orbit.devotel.io/api/v1/compliance/dsar \ -H "Authorization: Bearer $ORBIT_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "subject_email": "jordan@example.co.th", "requester_email": "privacy@your-company.co.th", "applicable_jurisdiction": "pdpa", "request_type": "know", "requester_statement": "PDPA access request (Thailand data subject; 30-day clock per the DSAR page)." }' ``` **Step 5 — register TH activities separately.** File the TH-facing processing activities in the [Privacy Register](/compliance/privacy-register) separately from any Singapore ones — the s39–41 RoPA-class inventory answers against the activities you filed, not against a cross-market merge. Record notifications to the PDPC Thailand in the [Breach Incident Register](/compliance/breach-incident-register) (s48); the notification itself is your act. The [Evidence Binder](/compliance/evidence-binder) reads both sets when a reviewer asks for the whole program. *** ## Related references * [Singapore and Thailand PDPA Posture](/compliance/pdpa-singapore-thailand) — the cross-market surface map this page splits for Thailand. * [Singapore PDPA](/compliance/singapore-pdpa) — the companion market's DNC-led posture. * [Country Rules Auto-Refresh Feeds](/compliance/country-rule-feeds) — what keeps the TH country row current. * [Consent Management](/compliance/consent-management) and [Consent Posture: The Unknown-Consent Policies](/compliance/consent-default-policy) — the lawful-basis fields and the strict-line posture knobs. * [DSAR](/compliance/dsar) — the coded jurisdictions, `pdpa` at 30 days, and the proof-of-deletion certificate. * [Privacy Register](/compliance/privacy-register) — the s39–41 RoPA-class activity filings. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.