This chapter will discuss and provide basic background information on the Personal Data Protection Act, B.E. 2562 (2019) (the “PDPA”), which has been effective since 1 June 2022 after a two-year postponement. The PDPA is the primary law regulating processing of Personal Data (as defined below). The PDPA focuses on the protection of data subjects whose Personal Data is processed, including the collection, storage, use, and disclosure, thereof, regardless of the original source of such Personal Data. Entities that make decisions on and process Personal Data (known as “Personal Data Controllers” under the PDPA) are required to have a lawful basis for processing such Personal Data and must maintain proper security measures to prevent any loss, unauthorized access, use, or disclosure of the Personal Data. These requirements also apply to service providers which process Personal Data as instructed by or on behalf of a Personal Data Controller (known as “Personal Data Processors” under the PDPA).