The Personal Data Protection Act (PDPA) has become a central compliance consideration for healthcare organisations in Thailand. Hospitals, clinics, laboratories, wellness businesses and healthcare technology providers routinely process sensitive personal data, making privacy governance an operational as well as legal priority.
This article highlights practical areas healthcare organisations should review when assessing their PDPA readiness.
Why PDPA matters for healthcare
Healthcare data can include medical history, diagnosis, treatment information, test results and other sensitive personal data. Organisations should ensure that the collection, use and disclosure of this information is supported by an appropriate legal basis and handled in a manner consistent with applicable privacy requirements.
Key compliance priorities
1. Lawful basis and transparency
Privacy notices should clearly explain what information is collected, why it is needed, how it is used and who it may be shared with.
2. Data security
Healthcare organisations should maintain appropriate technical and organisational safeguards, particularly where records are shared across departments, systems, providers or external vendors.
3. Data subject rights
Internal processes should be established to respond to access, correction, deletion and other rights requests within the required timeframe.
4. Vendor and cross-border arrangements
Cloud services, laboratories, insurers, technology partners and other service providers may create additional data-processing and transfer considerations that should be addressed contractually.
Key takeaway: Privacy compliance should be treated as an ongoing governance process rather than a one-time documentation exercise.
Practical next steps
- Map the organisation’s key data flows.
- Review privacy notices, consent language and internal policies.
- Assess vendor agreements and data-processing terms.
- Review incident response and breach management procedures.
- Provide regular privacy training for relevant teams.
Healthcare organisations should periodically review their privacy framework as operations, technology and regulatory expectations evolve.
