PDPA for Real Estate Agents: How to Collect Tenant and Buyer Data Legally

TL;DR: A real estate agent who collects tenant or buyer data (names, addresses, ID card copies, phone numbers) is, in most cases, a data controller under Thailand's Personal Data Protection Act B.E. 2562 (2019) (PDPA), and must obtain clear consent before collecting or passing on that data. This article summarizes what agents actually need to do in practice — how to ask for consent, how far you can go with ID card copies, whether you can forward data to the landlord — with a checklist you can use right away.

If You Ask for ID Card Copies, You Are Already Handling Personal Data

A real estate agent who asks viewing prospects for a copy of their ID card is already handling legally regulated personal data — often without realizing it. This article explains how the PDPA (Personal Data Protection Act) applies to real estate agents in practical terms, whether you work solo or in a small agency.

This is not comprehensive legal advice. It is a practical checklist to use alongside advice from a lawyer in more complex cases. Read the full legal framework for electronic signatures in Thailand and our guide to real estate broker agreements

Key Takeaways

• An agent who collects tenant/buyer data and decides how it is used is, in most cases, a data controller under the PDPA
• The data agents collect ranges in sensitivity, from ordinary names and phone numbers up to ID card copies and income information
• Consent must be clear and specific to the purpose of use — not a blanket, catch-all consent
• The 5-point checklist in this article is ready to use for solo agents today
• This article is not individual legal advice; consult a specialist for complex cases

Are Agents "Data Controllers" Under the PDPA?

In most cases, yes. An agent who collects tenants' or buyers' personal data and decides how it will be used (for example, forwarding it to the landlord, or keeping it in a client database) qualifies as a data controller (ผู้ควบคุมข้อมูลส่วนบุคคล) under the PDPA — not merely a middleman passing data along.

The exact classification may depend on how each agent's work is structured (working independently, or working under an agency that already sets the data-use policy).

The Data Agents Actually Collect, and How Sensitive It Is

• Names and contact numbers: low sensitivity; used for basic coordination
• ID card copies: higher sensitivity; usually requested when an actual lease is being prepared — clear consent is required before collecting
• Income and affordability information: high sensitivity; use only when necessary for pre-lease screening, and never keep longer than needed

Getting Consent Right

Valid consent under the PDPA must be clear, informed, and specific to the purpose of use — not a single blanket consent covering everything at once.

Practical consent formats already exist in the clinic sector, another industry that routinely asks for consent to collect sensitive personal data. See our PDPA checklist for clinics for consent formats that work in practice

A Practical Checklist for Solo Agents

1. Collect only the data needed for the transaction actually in progress — never "just in case"
2. Get written consent before forwarding ID card copies to the landlord
3. Do not keep data from viewing prospects who did not end up renting for an indefinite period
4. Store data securely — not just photos forwarded over LINE with no protection
5. Tell clients the specific purpose of the data collection, every time

Common Mistakes

The most common mistakes are photographing ID cards "just in case" with no clear purpose, forwarding data over LINE without asking for clear consent first, and keeping data from prospects who did not rent for longer than necessary. All three are widespread in the market — and none of them is consistent with PDPA principles.

Where Jabmue Helps

Jabmue provides an audit trail that records a detailed timestamp for every step, and consent capture that can be verified after the fact through electronic document signing — instead of paper forms that get lost. Jabmue is a document and signing tool, not a DPO consultancy or legal advice. Agents with complex questions should consult a PDPA specialist directly.

Frequently Asked Questions

Do real estate agents need PDPA consent?

In most cases, yes. When collecting tenants' or buyers' personal data (names, addresses, ID card copies, phone numbers), an agent must obtain clear, purpose-specific consent before collecting or forwarding that data.

Can I keep a tenant's ID card copy under the PDPA?

Yes — if there is a clear purpose (for example, preparing an actual lease agreement) and the data subject has consented first. Do not keep copies "just in case" with no purpose, or for longer than necessary.

Is an agent a data controller under the PDPA?

In most cases, yes — if the agent is the one collecting the data and deciding how it is used. The exact classification may depend on how each agent's work is structured; when in doubt, consult a lawyer.

What are the penalties for not complying with the PDPA?

Non-compliance with the PDPA can lead to a range of penalties, from warnings and administrative fines through to civil action, depending on the nature and severity of each violation.

Can I send tenant data to the landlord?

Yes — if you obtain the tenant's clear consent before forwarding it, and the purpose of the transfer matches what was stated when consent was requested. Never forward data without informing the tenant or obtaining consent in advance.

Summary and Next Steps

Real estate agents who collect tenant or buyer data are, in most cases, data controllers under the PDPA. The 5-point checklist in this article (collect only what is needed, get clear consent, keep nothing longer than necessary, store securely, state the purpose every time) is a starting point you can apply immediately. For anything more complex, consult a PDPA specialist directly.

Keep reading: a bilingual condo lease agreement that handles tenant data properly and the real estate broker agreement

Try Jabmue free for 14 days — no credit card required. Get started here or see full plan details on the Jabmue pricing page