Thailand: passenger data record

Data protection law and its limits

The Personal Data Protection Act B.E. 2562 was given on 24 May 2019 and published in Government Gazette volume 136, chapter 69 Gor, on 27 May 2019 ¹. Section 2 brought most of the Act into force the day after publication. Chapters II, III, V, VI and VII and sections 95 and 96 came into force one year after publication ¹.

Section 4 says the Act does not apply to operations of public authorities with duties to maintain state security ¹. The same section lists other exclusions, among them public safety, money laundering prevention, cybersecurity, parliament and the courts ¹. Some excluded controllers must still keep data secure to a prescribed standard ¹.

Section 26 treats biometric data as sensitive data, together with health, criminal record and genetic data ¹. The Act defines biometric data as data from physical or behavioural traits that can identify a person, such as facial, iris or fingerprint recognition data ¹. Collection of sensitive data needs explicit consent, with listed exceptions ¹.

Who oversees the Act

Section 43 sets up the Office of the Personal Data Protection Committee as a government agency with juristic person status ¹. The Minister of Digital Economy and Society is in charge of the Act under section 7 ¹. The ministry's Permanent Secretary is Vice-Chairperson of the Personal Data Protection Committee under section 8 ¹.

Sections 82 to 88 set administrative fines with ceilings of 1 million, 3 million or 5 million baht ¹. The highest ceiling, 5 million baht, is in sections 84 and 87 ¹.

APPS and PNR

A Tourism Authority of Thailand release dated 27 November 2015 said the Advance Passenger Processing System would start on 1 December 2015 at Suvarnabhumi, Don Mueang, Phuket, Chiang Mai, Hat Yai and Mae Fa Luang Chiang Rai airports ³. The release said passport, personal and visa details would be checked against a blacklist held by immigration ³. It said 35 baht would be added to the price of all tickets into and out of Thailand, and that the system would extend to 32 airports in 2016 ³. The release does not name a supplier ³.

Immigration Bureau Order 121/2565 was signed on 14 June 2022 and published in the Royal Gazette on 8 July 2022 ². It cites section 18 of the Immigration Act B.E. 2522 as amended in 2017, and the Electronic Transactions Act B.E. 2544 ². It requires aircraft owners and operators to store PNR data for every flight and send it electronically through APPS ². The order took effect on the date it was issued ².

• Booking data: record locator, booking time, booking origin and contact details ².
• Passenger and ticket data: name, baggage, fare, ticket number, tax and issue date ².
• Payment data: payment method and details, sponsor and billing address ².
• Travel data: full itinerary, check-in time and agent, seat, checked baggage and non-air segments such as accommodation ².
• History data: who changed a record and when, with name, service and flight changes ².

Thailand Digital Arrival Card

The Tourism Authority of Thailand said on 4 April 2025 that the Immigration Bureau would launch the Thailand Digital Arrival Card (TDAC) on 1 May 2025, with submissions open from 28 April ⁴. All foreign visitors arriving by air, land or sea must file it before entry ⁴. Travellers in transit who do not pass immigration control and holders of a Border Pass are exempt ⁴.

Travellers can submit up to three days before arrival ⁴. The card asks for passport, personal and travel details, accommodation in Thailand and a basic health declaration ⁴. The official portal is run by the Immigration Bureau ^4,5. The release does not state a retention period for TDAC data ⁴.

Auto gates at Suvarnabhumi

As reported by Khaosod English on 17 August 2026, the Immigration Bureau approved in principle opening Suvarnabhumi auto gates to 31 more nationalities ⁶. The report said the nationalities were chosen using immigration rejection statistics, the Henley Passport Index and national security considerations ⁶. It said travellers who had entered Thailand before and already had biometric information in the system would use the gates first ⁶. The report said the change was awaiting final signatures and was expected by the end of August 2026 ⁶. The report does not name a gate supplier or say how long biometric data is kept ⁶.

Chronology