BLOG
A Customer Asks for Their Data. Can You Find It in 30 Days?
Imagine a letter arrives at your office. A former customer, or a former employee, wants a copy of every piece of personal data your business holds about them, and they want to know where you got any of it that they did not give you directly.
Since 14 September 2026, how you handle that letter is no longer up to you. The Personal Data Protection Committee (PDPC) has set out exactly what Thai businesses must do, how they must do it, and how long they have.
This article explains the new rules in plain terms, and why, for most SMEs, the hard part is not the legal paperwork. It is finding the data.
This is general information, not legal advice. If you are unsure how the rules apply to your business, speak to a qualified Thai data protection lawyer.
What changed
The right of individuals to access their personal data has been part of Thailand’s Personal Data Protection Act (PDPA) since it came into force. What was missing was detail on how businesses should handle those requests in practice.
On 16 July 2026, the PDPC published a notification in the Royal Gazette setting out the rules for access requests, and it took effect 60 days later, on 14 September 2026 (Baker McKenzie, 10 August 2026). In summary, it covers the following.
Who can ask. The person the data is about, or someone acting for them: a parent of a minor, a custodian or curator, or an authorised representative.
What they can ask for. A copy of the personal data you collected from them, personal data you collected about them from other sources, where you got data you collected without their consent, and the information described in your privacy notice and your record of processing activities (ROPA).
How they can ask. Businesses must offer at least physical and postal channels for requests. Electronic channels such as email or a web form are encouraged in addition.
Identity checks. You must verify the request and the identity of the person making it within a set timeline, and if the request is incomplete you must tell them and give them time to fix it.
The deadline. You must comply within 30 days of receiving a complete and valid request. You can extend by up to another 30 days, for example where a large volume of data is involved, but you must tell the requester.
Fees. Requests are generally free. You can only charge in limited cases, such as special formats, delivery costs or repetitive and excessive requests.
Refusals. You can refuse on specific grounds, such as where disclosure is prohibited by law or court order, where it would affect the rights of others, or where the request is unfounded.
Records. You must keep records of access requests for at least two years.
Why this is really an IT problem
Read that list again and notice how much of it assumes you know where your data is. To answer an access request properly, you need to search every place a person’s details might exist and pull together a complete copy. In a typical 30-person Thai SME, that might include:
The accounting and invoicing system. The CRM or customer spreadsheet. Email inboxes, including those of staff who have left. Shared drives and Google Drive or OneDrive folders. LINE chats with customers. HR files, ID card copies and payroll records. CCTV footage. The booking system, the website contact form, the marketing email platform. And the laptop of the sales manager who keeps “his” customer list in a personal file.
If nobody has mapped those systems, a 30-day deadline is suddenly very short. If former employees’ mailboxes were deleted without a retention policy, or are still sitting in an active account nobody controls, you may not be able to say with confidence what you hold. And if data has been copied freely around the business, you may find it in places you did not expect, which is a PDPA problem in its own right.
This is why the access request rules connect directly to the access control discipline we covered in our July article on PDPA compliance. A business that controls who can reach each data set also knows where each data set lives. A business that does not, finds out the hard way when the first request arrives.
The security risk hiding inside access requests
There is a second IT angle that is easy to miss. An access request is, by design, a way for someone outside your business to obtain a copy of personal data. If your identity checks are weak, it becomes a way for the wrong person to obtain it.
Fraudsters already impersonate customers to reset passwords and redirect payments. A request that looks like it comes from a customer, sent from a lookalike email address with a convincing story, could trick a busy staff member into sending out ID card copies, addresses and payment history. Sending one person’s data to someone else is a data breach, with all the PDPA consequences that follow, including the duty to notify the PDPC within 72 hours where there is a risk to the individual.
The notification’s requirement to verify identity is not a formality. Your process should confirm identity using information the real person would have and an impostor would not, and requested data should be delivered through a secure channel, not as an attachment to whatever email address asked for it.
What a workable process looks like
You do not need a large compliance department. You need a short, written procedure and the IT foundations to support it.
A clear way to receive requests. Publish a postal address and a physical drop-off point as the rules require, plus an email address or web form, and make sure requests arriving through any of them reach one named person.
A data map. A simple list of every system that holds personal data, what kind, and who manages it. If you already keep a ROPA, this is where it pays off.
Search capability. Make sure you can search email, shared drives and core business systems for a person’s name, email address, phone number or ID number, including archived and former-employee mailboxes.
Identity verification. Agree what proof you will accept and how you will check it, and train staff not to bypass it under pressure.
Secure delivery. Send data through an encrypted or password-protected channel, with the password shared separately.
A request log. Record every request, the date received, the date it became complete, what you did, and when you responded. Keep it for at least two years.
A diary system for the deadline. Thirty days passes quickly when the person handling it also does finance and HR. Put the deadline, and any extension notice, on a shared calendar.
Where HumanIT fits
Access requests sit at the point where legal duties meet day-to-day IT. Lawyers can tell you what the rules say. Someone still has to make sure you can find the data, control who can reach it, and keep the records.
HumanIT’s Gold package (THB 2,500 per device per month, or THB 2,000 on annual billing) includes user lifecycle management and access controls, so former employees’ accounts are handled properly and access to personal data is limited to the people who need it. It also includes 24/7 SOC-lite monitoring and tested backups. For businesses that want audit-ready evidence, our Compliance Management service (THB 15,000 per month) adds centralised policy and evidence management, continuous vulnerability scanning, quarterly compliance reviews and audit-ready reports, and can be bundled with any package. Packages require a minimum of ten managed devices.
A practical next step
Run a test. Pick one real customer, with their permission, or one member of staff, and time how long it takes to find every piece of personal data your business holds on them. Note every system you had to check and every place you were not sure about. If it takes more than a day, or you finish without being confident you found everything, you have a clear picture of the work to do before a real request arrives.
The PDPC has made the rules specific. The businesses that will handle requests calmly are the ones that already know where their data lives.
Frequently asked questions
What is a data subject access request under the PDPA?
It is a request from an individual, or someone acting for them, to access or obtain a copy of the personal data a business holds about them, and to know the source of any data collected without their consent.
How long do Thai businesses have to respond to an access request?
Under the PDPC notification that took effect on 14 September 2026, you must comply within 30 days of receiving a complete and valid request. You may extend by up to 30 more days if you notify the requester, for example when large volumes of data are involved.
Can we charge a fee for an access request?
Generally no. Fees are only allowed in limited cases, such as requests for special formats, delivery costs, or repetitive and excessive requests.
Do small businesses have to follow the new access request rules?
Yes. The PDPA applies to any business that collects, uses or discloses personal data, regardless of size, and the access request rules apply to data controllers generally.
How long must we keep records of access requests?
At least two years, according to the notification.
What is the biggest risk when handling access requests?
Sending someone’s data to the wrong person. Weak identity checks can turn an access request into a data breach, which may then need to be reported to the PDPC within 72 hours.
Want help getting your data and access controls ready for PDPA requests? Call Eve on +66 89 354 9916 or compare packages at humanit.asia/pricing-and-plans.
