Is my health data safe in Thailand? What the law says

What the law says

How Thailand treats your health data.

The law: Personal Data Protection Act B.E. 2562 (2019)[S91]
The regulator: Personal Data Protection Committee (PDPC)[S91]
Health data: Health data is sensitive personal data under Section 26. Processing it needs your explicit consent unless one of the law's exceptions applies.[S91]
Sending it abroad: Under Section 28, data may go to a country with adequate protection under PDPC rules, under safeguards such as binding corporate rules or contract clauses set out in the PDPC's 2023 notifications, or with your consent after you have been told the destination's protection may fall short.[S91][S93]
EU adequacy: No. Thailand is absent from the European Commission's adequacy list, so an EU organisation sending data there needs other safeguards.[S77]
If there is a breach: To the PDPC without undue delay and, where feasible, within 72 hours, unless the breach poses no risk to the people affected.[S92]
Fines: Administrative fines of up to THB 5 million, with criminal penalties, including prison terms, for certain misuse of sensitive data.[S91]

Sending your records

The law protects the clinic’s copy. How it gets there is up to you.

Email and messaging apps leave a readable copy on every server they pass through, in Thailand and at home. The safest file is the one that stays encrypted on your own phone, shown to the doctor in the room or sent by a link that expires by itself.

Who can see my medical records? Free check

Questions

Thailand: common questions.

Is it safe to email medical records to a clinic in Thailand?

Email is protected between mail servers only when both providers support TLS, and it stays readable on each server afterwards. Once your records reach a clinic in Thailand, local law applies: health data is sensitive personal data under Section 26. Processing it needs your explicit consent unless one of the law's exceptions applies. For a full history, use a channel where you hold the key, such as a link that expires by itself.

Are my medical records private in Thailand?

Health data is sensitive personal data under Section 26. Processing it needs your explicit consent unless one of the law's exceptions applies. Breaches must be reported to the PDPC without undue delay and, where feasible, within 72 hours, unless the breach poses no risk to the people affected. The regulator is the Personal Data Protection Committee (PDPC).

Can a clinic in Thailand send my medical records abroad?

Under Section 28, data may go to a country with adequate protection under PDPC rules, under safeguards such as binding corporate rules or contract clauses set out in the PDPC's 2023 notifications, or with your consent after you have been told the destination's protection may fall short.

Keep reading

More on Thailand, and elsewhere.

Sources are numbered in the text and listed in full in the reference list.