PDPA Checklist for Clinics in Thailand: 9 Obligations, 9 Documents

Your clinic collects patient health data, and health data is one of the most strictly protected categories of "sensitive data" under the law. Under Section 26 of the Personal Data Protection Act B.E. 2562 (2019) ("PDPA"), having patients simply tick a generic terms-and-conditions box on your website isn't enough.

Most clinic owners know they "have to do PDPA," but few know exactly what that means in practice — what to do, which documents to prepare, and in what order. This article summarizes the obligations that apply directly to clinics, based on the text of the Personal Data Protection Act B.E. 2562 (2019), and is not specific legal advice for your particular clinic.

By the end of this article, you'll have a checklist you can actually tick off, know exactly what document each item requires, and know which documents are already ready to sign. One private company was hit with an administrative fine of up to ฿7,000,000 (roughly US$195,000) over a lack of adequate security measures in 2024 (isranews.org; amarintv.com). This isn't a theoretical risk anymore.

Related reading: Digital Informed Consent for Aesthetic and Dental Clinics

TL;DR: Clinics must comply with PDPA because health data is sensitive data (Section 26) requiring explicit consent. The main things you need to do: (1) publish a Privacy Notice; (2) obtain written consent; (3) consider appointing a DPO if processing large volumes of health data is a core activity of your business — confirm your clinic's status with legal counsel; (4) sign a DPA with labs, accounting firms, or other external processors; (5) maintain a RoPA and minimum security measures. Failing to do so risks administrative fines — one private company was fined ฿7 million in 2024. This article is not legal advice — it's a starting point before consulting your own legal counsel.

Key Takeaways

• Patient health data = sensitive data under Section 26 of PDPA 2562, requiring explicit, written consent
• Most clinics fall into the category that should consider appointing a DPO under Section 41(3), but the law doesn't define an exact data-volume threshold, so confirm your status with legal counsel
• There are 9 minimum documents you need, from a Privacy Notice to a patient rights-request form
• PDPA 2562 (data protection) and ETA 2544 (electronic signature validity) are two separate laws — you need to comply with both, in parallel
• A private company has already been fined ฿7,000,000 in 2024, and total fines of roughly ฿21.5 million were issued in 2025, according to pdpathailand.com's tracking
• This article is not specific legal advice — it's a starting point before consulting your clinic's own legal counsel

Table of Contents

• Is Patient Data Sensitive Data?
• Does a Clinic Need a DPO?
• The Privacy Notice: The First Thing You Need
• Written Consent: Why Paper Isn't Enough
• DPA: Contracts With External Data Processors
• RoPA: Record of Processing Activities
• Minimum Security Measures and the 72-Hour Breach Notification
• PDPA Is Not ETA: Don't Confuse the Two Laws
• What's the Risk of Not Doing PDPA?
• The Full 9-Item Checklist, With Required Documents
• From Checklist to Ready-to-Sign Documents
• Frequently Asked Questions

Is Patient Data Sensitive Data?

Yes. Patient health data is classified as "Sensitive Personal Data" under Section 26 of PDPA 2562 — a category subject to stricter consent requirements than general personal data.

This category covers diagnostic history, treatment records, test results, and biometric data — such as fingerprints or facial recognition if your clinic uses either at reception.

In practice, this means a generic "accept terms" button isn't enough. Clinics need explicit, written consent for processing health data, except in a few legally exempted cases, such as emergency medical necessity.

Does a Clinic Need a DPO?

In most cases, a clinic falls into the category that should consider appointing a Data Protection Officer (DPO), because Section 41(3) of PDPA 2562 requires a DPO when an organization's core activity is processing sensitive data under Section 26 "on a large scale" — and health data is already at the core of a clinic's business.

The point worth flagging: the law doesn't set a clear data-volume threshold for small or solo-practitioner clinics. What counts as "large scale" depends on the actual patient volume your clinic handles.

A DPO's role is to provide internal advisory support, oversee data security, and act as the point of contact with Thailand's Personal Data Protection Committee (PDPC) and with patients exercising their rights.

The Privacy Notice: The First Thing You Need

Before collecting any patient data, a clinic must publish a Privacy Notice stating what data is collected, for what purpose, on what legal basis, for how long, and what rights the patient has.

This notice must be visible at the point data is actually collected — whether that's the reception desk, an online form, or the booking process.

One thing to watch for: a Privacy Notice (shown to patients) and an internal Privacy Policy (your clinic's internal governance policy) are two separate documents. A common mistake seen across many websites is using a generic notice copied from another business, without specifying the actual health data the clinic collects.

Written Consent: Why Paper Isn't Enough

Consent for health data must be explicit, specific, and provable. A paper form kept in a drawer can't prove an exact date, and there's no way to confirm the patient actually received the latest version of your Privacy Notice.

Valid PDPA consent must identify the data controller, state a clear purpose, include the right to withdraw consent, and record the time consent was given.

An electronic signature with an audit trail (timestamp and OTP) strengthens your ability to demonstrate compliance if audited — but it's a way to strengthen the evidentiary weight of the document, not an absolute legal guarantee.

DPA: Contracts With External Data Processors

A clinic that shares patient data with a third party — such as a lab, an accounting firm, or a cloud provider — needs a Data Processing Agreement (DPA) under Section 40 to bind that external processor to security and confidentiality measures equivalent to those of the data controller itself.

A real-world example: a toy business whose online booking system was hacked saw the business owner, as data controller, fined ฿500,000, while the system developer, as data processor, was fined a separate ฿3,000,000, in 2025, according to a PDPA consulting provider's tracking (not yet confirmed against an official PDPC announcement) from pdpathailand.com. This shows that external processors carry independent liability, not just the data controller alone.

RoPA: Record of Processing Activities

A Record of Processing Activities (RoPA) is an internal register logging the purpose, legal basis, data recipients, and retention period for each category of data your clinic processes, under Section 39. This document is often the first thing PDPC asks for during an audit.

For a clinic, RoPA should be broken into at least 4 categories: patient medical records, financial and receipt data, staff data, and marketing data such as newsletters or appointment reminders.

A common mistake is creating a RoPA once and never updating it, when it should be updated every time a new type of data processing is introduced, such as a new booking app or accounting system.

Minimum Security Measures and the 72-Hour Breach Notification

A clinic must have minimum security measures as defined by ministerial notification, and must notify PDPC of a data breach within 72 hours of becoming aware of it, if it poses a risk to patients' rights, under Section 37(4).

Basic measures should include access controls on medical records, secure backups, and a log of who accessed what data and when.

A real-world example: a government agency was fined ฿153,120 as data controller over a breach affecting around 200,000 people, while the related external service provider was separately fined the same amount as data processor, according to the same source, in 2025. This is further evidence that inadequate security measures create risk for both parties.

PDPA Is Not ETA: Don't Confuse the Two Laws

PDPA B.E. 2562 (2019) and ETA B.E. 2544 (2001) are two separate laws, serving two different functions, and must never be used interchangeably.

• PDPA B.E. 2562 (2019) (Personal Data Protection Act) protects personal data — covering consent, security, and data subject rights.
• ETA B.E. 2544 (2001) (Electronic Transactions Act) is a separate law that validates electronic signatures themselves — it has nothing to do with the nature of the data inside the signed document.

Documents related to PDPA, such as patient consent forms or DPA contracts, must be substantively compliant with PDPA (content, purpose, legal basis) and correctly signed under ETA, if you want a citable electronic record. The two laws complement each other — they never substitute for one another.

Read more about the legal basics of electronic signature validity under ETA 2544

What's the Risk of Not Doing PDPA?

PDPC has already issued real administrative fines ranging from ฿153,120 to ฿7,000,000, depending on severity and the volume of data involved. This isn't a theoretical threat.

The highest disclosed fine to date is ฿7,000,000, against an IT equipment retailer in 2024 (B.E. 2567), over a lack of adequate security measures that led to a data leak affecting more than 100,000 customers — the first administrative fine order issued under PDPA (isranews.org; amarintv.com).

The total of publicly disclosed fines since PDPA came into force stands at roughly ฿21.5 million across 6 disclosed cases in 2025, according to the same source (pdpathailand.com).

One thing to note: there's no data confirming that any disclosed fine specifically targeted a "small clinic." Real cases have involved businesses of various sizes, so you shouldn't assume a small clinic would be fined a similar amount.

The Full 9-Item Checklist, With Required Documents

Here are the 9 core obligations most clinics need to meet, with the related document for each. Three of the items in this table already have ready-to-use templates in the Jabmue clinic template gallery — the rest are internal documents you prepare yourself, which you can also send for signature through Jabmue's general document editor.

All 9 items are mandatory — none is "more important" than another. The order in this table reflects a suggested starting sequence based on risk, not a priority ranking.

From Checklist to Ready-to-Sign Documents

Three of the nine checklist items — the patient PDPA consent form, the DPA with external processors, and the staff confidentiality agreement — already have ready-to-use Thai-language templates in the Jabmue clinic gallery. Customize and send them for electronic signature right away.

The remaining documents in the table, such as the Privacy Notice or the rights-request form, don't yet have a ready-made template in the gallery, but you can draft them yourself and send them through Jabmue's general document editor, since the platform supports uploading your own documents and sending any type for signature.

A reminder: Jabmue provides document templates and an e-signature tool — it is not a legal advisor. Every document should be adapted to your clinic's specific situation and reviewed by legal counsel before actual use.

Beyond PDPA documents, the clinic gallery also includes other documents most clinics need, such as informed consent forms, before/after image release forms, treatment-plan payment schedules, and patient intake forms.

See all documents in the clinic gallery

Frequently Asked Questions

Does a clinic need a DPO?

In most cases, yes, you should consider appointing one, because health data sits at the core of a clinic's activity and is classified as sensitive data under Section 26. The law (Section 41(3)) requires a DPO when large-scale processing of sensitive data is a core activity — but since the exact volume threshold isn't defined for small clinics, confirm your status with legal counsel.

What are the fines for not complying with PDPA?

Real administrative fines issued so far range from ฿153,120 to ฿7,000,000, depending on severity and the volume of data involved. There's no fixed rate specifically published for clinics.

Is patient data sensitive data?

Yes. Health data — such as diagnostic results, treatment history, and medication history — is classified as "sensitive data" under Section 26 of PDPA, requiring a stricter level of consent than general personal data.

What's the difference between PDPA and ETA?

PDPA B.E. 2562 (2019) protects personal data, while ETA B.E. 2544 (2001) validates electronic signatures themselves. Documents that comply with PDPA also need to be signed correctly under ETA to create a citable electronic record. The two laws complement each other — they're not interchangeable.

What PDPA documents does a clinic need?

At minimum: a Privacy Notice, an internal Privacy Policy, a patient consent form, a DPA with each external processor, a staff confidentiality agreement, and a Record of Processing Activities (RoPA).

Conclusion

Patient health data is sensitive data requiring written consent. Most clinics need to consider appointing a DPO, need a DPA with external processors, and PDPC's administrative fines are already a reality — not a theoretical risk anymore.

Tick off your own checklist, then pull ready-to-customize, ready-to-sign PDPA documents from the Jabmue clinic gallery.

Start free and see all clinic documents Related reading: Digital Informed Consent for Aesthetic and Dental Clinics

This article is not specific legal advice for your clinic. It's a starting point before consulting your legal counsel to confirm accuracy and completeness for your clinic's actual situation.

Last updated: August 2026. This article is reviewed against new legal developments and fine orders at least once a year.