When you rent a property in Thailand you hand over some of your most personally identifying information to people you have just met. Your passport copy. Your bank account details. Your home address. Your visa details. These documents travel through WhatsApp messages, LINE threads, email chains, and physical folders in the hands of landlords and agents who may have no formal data handling framework in place. Thailand's Personal Data Protection Act sets out clear requirements for anyone collecting this information. This is what the law covers, what questions to ask, and how to protect yourself.
What Personal Data You Hand Over When Renting in Thailand
Most tenants do not think about their data when they are excited about a new apartment. But the paperwork involved in any Thai rental transaction involves a significant amount of high-risk and personally identifying information.
A standard rental application in Thailand typically involves providing:
- A copy of your passport photo page
- A copy of your visa and most recent entry stamp
- Your bank account details for deposit payment
- Your home or correspondence address
- Your contact number and email address
- Sometimes your employer's name and work address
- Sometimes your TM30 documentation
Each of these is personal data under Thailand's PDPA. When a landlord or agent requests, receives, stores, or shares any of it, they may be acting as a data controller under Thai law with legal obligations attached to that role.
"A passport copy, bank details, and home address are all personal data under Thailand's PDPA. Anyone acting as a data controller over that information has legal obligations about how it is stored, used, and eventually deleted."
What Thailand's PDPA Actually Requires From Anyone Handling Your Data
Thailand's Personal Data Protection Act (PDPA), B.E. 2562, came into full enforcement on 1 June 2022. It applies to any person or organisation that determines why and how personal data is collected, used, or disclosed in Thailand.
The PDPA can apply to individual landlords and rental agents when they determine why and how tenant data is collected and used. Being a small operator does not automatically remove PDPA obligations, although specific statutory exemptions may apply depending on the circumstances. Anyone in doubt about whether the PDPA applies to their specific situation should seek qualified legal advice.
Under the PDPA, those collecting personal data must:
Have a valid lawful basis for any collection, use, or disclosure. Depending on the circumstances, this may be consent, contractual necessity, legal obligation, or legitimate interests.
Inform individuals clearly about why their data is being collected, what it will be used for, how long it will be kept, who it may be shared with, and what rights the individual has. A vague verbal explanation is unlikely to provide all the information required under the PDPA. A clear written or digital privacy notice is the most reliable approach.
Collect only what is genuinely necessary for the stated purpose.
Store data securely with appropriate access controls, retention rules, and deletion procedures in place. Storing passport copies in messaging groups or on personal devices may be inadequate where proper security measures are not in place.
Respect data subject rights when properly exercised: access, correction, erasure, restriction, portability, and objection.
Administrative fines for PDPA violations reach up to THB 5 million. Civil liability can include actual damages plus punitive damages of up to twice the actual damages. Certain criminal offences under the PDPA carry penalties of up to THB 1 million and/or one year imprisonment.
Thailand's New Rental Law 2025: other tenant protections that apply to your tenancy
The Reality of Data Handling in Thailand's Rental Market
Understanding what the PDPA requires is one thing. Understanding what actually happens in Thailand's rental market is another.
Rental Agents Operating Without Mandatory Licensing or a Required Data Protection Framework
Thailand does not currently operate a mandatory national professional licensing or examination regime specifically for real estate agents. This allows individuals to enter the sector without an agent-specific qualification, although other Thai laws and business requirements still apply.
When your passport copy and visa details are sent to an individual operating informally, there may be no company data policy governing what happens to that information, no deletion schedule, and no defined process for responding to a data access or erasure request.
That does not mean every agent operates without care. Many professional agents working within established agencies have proper data handling procedures in place. The absence of mandatory agent-specific licensing simply means there is no uniform floor for data handling standards across the sector.
rental agents in Thailand: what the law says and what the risks are
Individual Landlords and Data Storage
The typical private landlord in Thailand is an individual investor managing one or two units directly. They are unlikely to have a data protection policy, a defined retention schedule, or a secure document management system. Your passport copy may be held in a physical folder, a phone photo album, a LINE chat, or an email thread with no process attached for when it should be deleted.
This is not a criticism of individual landlords. Many are simply unaware that the PDPA may apply to their activities. But awareness does not determine whether the law applies, and tenants should be conscious of what they are handing over and to whom.
Your Data Moving Between Multiple Parties
In Thailand's rental market, a single property search can result in your personal details being passed between multiple agents, building managers, and landlords before you sign anything. Each disclosure of personal data to a third party requires a valid lawful basis under the PDPA. In practice, tenants are rarely informed when their documents have been shared or with whom.
Red Flags That Your Data May Not Be Handled With Care
These situations do not necessarily indicate a legal violation, but each represents a departure from what careful, PDPA-aware data handling looks like.
An agent asks for your passport copy before you have viewed any property or before the purpose for collecting it has been explained.
Your documents are requested via a personal LINE or WhatsApp message to an individual with no company affiliation.
You are given no explanation of what your data will be used for, who it may be shared with, or how long it will be kept.
No privacy notice or data collection statement is provided at any stage of the process.
When you ask what happens to your data after the tenancy ends, there is no clear answer or defined process.
You later receive contact from parties you did not provide your details to directly.
Your PDPA Rights as a Tenant in Thailand
Under the PDPA you have specific rights regarding personal data that any landlord or agent holds about you. You can exercise these rights by submitting a written request.
The right to access: Request a copy of personal data held about you and information about how it is being processed.
The right to correction: Request that inaccurate data is corrected.
The right to erasure: Request deletion of your personal data when the purpose for which it was collected no longer applies. When a tenancy ends, tenants may request deletion of data that is no longer necessary. However, landlords and agents may retain certain records where required by law or reasonably necessary for accounting, contractual, or legal claim purposes.
The right to data portability, restriction and objection in applicable circumstances.
Submit your request in writing and ask for a response without unreasonable delay. Access requests must generally be fulfilled within 30 days unless a lawful exception applies. If your request is refused without valid reason, you can file a complaint with the Office of the Personal Data Protection Committee.
How Lease Shield Handles Your Personal Data
Lease Shield has implemented an internal, self-assessed PDPA Alignment Programme covering its privacy controls and data handling processes.
Your documents stored in Lease Shield are private by default. Staff cannot view your uploaded documents. Only Case Officers handling an active Resolve dispute can access evidence you have explicitly submitted for that case.
You can request a full export of your data through Account, Data Privacy, Export My Data. You can request permanent account deletion by emailing privacy@leaseshield.asia. Certain transaction, accounting, and payment records may be retained for the period required by applicable Thai law and legitimate legal or accounting obligations.
Lease Shield's full privacy policy and data handling information is available at:
Lease Shield Privacy Policy and data handling information
Practical Steps to Protect Your Data When Renting in Thailand
You cannot control every party who handles your data during a rental transaction, but you can reduce your exposure and assert your rights more effectively.
Ask why your data is needed before providing it. A landlord or agent should be able to explain clearly what the data will be used for and on what basis they are collecting it.
Ask who your data will be shared with. If your details are going to be passed to a property owner, building management, or other agencies, you should know this before agreeing to provide the information.
Use more secure channels where possible. Where practical, use email rather than informal social media messages to parties you cannot verify, so you have a documented record of what was sent and to whom.
Ask what happens to your data when the tenancy ends. A landlord or agent who can describe a clear deletion process is operating with greater awareness of their obligations than one who has never considered the question.
Keep your own records of what you provided and to whom. If you later need to make a data erasure request, knowing what each party holds is essential.
Store your rental documents, correspondence, and evidence in one secure location so you maintain a complete and organised record of your tenancy.
store your tenancy documents and evidence securely in the Evidence Vault
