On 7 July 2026, Thailand’s Personal Data Protection Committee Office (PDPC) issued two draft supplementary guidelines under the PDPA, elaborating on “lawful bases for personal data processing” and “marketing and direct marketing”, and launched a public consultation. Although the drafts are not legally binding at this stage, they clearly indicate the regulator’s future enforcement priorities and carry important reference value for all types of marketing businesses, including A2P marketing SMS.
Regarding lawful bases of data processing, the drafts provide enterprises with a five‑step selection workflow: identify data processing activities, assess applicable lawful bases, verify necessity of processing, conduct a Legitimate Interest Assessment (LIA) where relevant, and fulfil transparency obligations via privacy notices. The drafts fully interpret all lawful grounds listed in Section 24 of the PDPA. It specifically reminds companies not to treat “user consent” as a universal fallback option, but select appropriate legal bases according to actual business scenarios. Where “legitimate interests” is relied upon, enterprises must complete and retain LIA documentation. Additional safeguards must be implemented based on risk levels when sensitive personal data is involved. Meanwhile, the drafts strengthen accountability requirements; companies shall properly retain privacy notices, Records of Processing Activities (ROPA), LIA reports and other compliance documents for regulatory audits.
For A2P marketing SMS services, the core compliance requirements from the drafts fall into three points: consent must be obtained through active, explicit user ticking; pre‑ticked boxes or bundled consent are prohibited. Every marketing SMS must contain an easy unsubscribe mechanism, and sending must cease immediately once consent is withdrawn. Enterprises must fully preserve consent records, unsubscribe requests and relevant compliance documents for audits. The two drafts remain under public consultation, yet they clearly demonstrate PDPC’s enforcement direction. Relevant businesses are advised to adjust compliance procedures in advance to prepare for upcoming stricter regulation.
