Lead Scraping and PDPA Compliance in Thailand: What’s Actually Legal
Where we're coming from
We build lead-generation pipelines for Thai B2B sales teams, so the first question is always which sources are allowed. This guide sets out the PDPA sections and platform terms that answer it. It is a summary, not legal advice.
"PDPA lead scraping Thailand" comes up often in buyer conversations. This page captures the framing we use from actual client work, not vendor-marketing slide decks.
Quick answer
The PDPA does not ban scraping as such; it governs the personal data you collect, and it applies as soon as the data identifies a person: a name, a personal work email such as somchai.k@company.co.th, or a mobile number. Company-level data (company name, registered address, a generic info@ inbox) is not personal data. If you collect personal data without consent, the basis that can fit B2B prospecting is legitimate interest (Section 24(5)), and only where the person’s rights do not override it. You must tell people where you got their data and why within 30 days, or in your first message if you use it to contact them (Section 25), and stop at once when someone objects to direct marketing (Section 32). Separately, the LinkedIn, Google Maps and Facebook terms forbid automated collection, so a list that meets the PDPA can still breach the platform’s contract.
Updated: 2026-10-02
Key takeaways
- The PDPA covers data that identifies a person (Section 6): names, personal work emails, mobile numbers. Company names, registered addresses and generic inboxes are outside it.
- The PDPA has no exemption for business contact details; a director’s name on a company website is still personal data.
- Without consent, B2B prospecting has to rest on legitimate interest (Section 24(5)): write down why you need each field, and keep to work contact details.
- Tell people what you hold, where it came from and why, within 30 days or in your first message (Sections 23 and 25).
- Every message needs an easy way to object; when someone does, stop and mark them so they are never contacted again (Section 32).
- Never collect sensitive data such as religion, health or political opinions (Section 26).
- Platform terms are a separate contract: LinkedIn, Google Maps and Facebook forbid automated collection.
Decision guide
| Option | Best for | Watch out for |
|---|---|---|
| Your own forms, events and inbound enquiries | The safest source: collected from the person directly, with the notice given at the point of collection (Section 23) | The notice must say you will use it for sales follow-up, how long you keep it, who receives it and what rights the person has |
| Company websites and the DBD company registry | Company name, address, main phone line and generic inboxes, which are not personal data | Directors’ names, personal emails and mobile numbers on the same page are personal data |
| Google Maps | Finding businesses through the official Places API, within its terms | The Google Maps Platform terms (3.2.3(a)) forbid scraping or bulk-downloading places information for use outside Google’s services |
| Manual research and LinkedIn’s own tools | User Agreement 8.2 forbids software, scripts, crawlers or browser extensions that scrape or copy profiles | |
| Facebook groups and pages | Taking part in groups you belong to, under the group’s rules | Meta’s terms (3.2.3) forbid automated collection without permission, and members did not post so their details could feed a sales list |
| Bought or rented lists | Only when the seller can show in writing where the data came from, on what basis, and that the people were told | Once you buy it you are the data controller: Section 25 applies to you, and so do the Section 83 fines |
Frequently asked questions
Is lead scraping legal in Thailand?
The PDPA does not ban scraping as such; it regulates collecting, using and disclosing personal data. Company-level data is fine to collect. Data that identifies a person needs a lawful basis, a notice to the person, and an immediate stop when they object. The terms of the platform you scrape are a separate matter: LinkedIn, Google Maps and Facebook forbid automated collection.
Is a work email personal data under the PDPA?
If it identifies a person, yes. Section 6 defines personal data as information that identifies a person, directly or indirectly, so somchai.k@company.co.th is personal data, while a generic sales@company.co.th usually is not. None of the exemptions in Section 4 covers business contact details.
Do I need consent before cold-emailing a B2B prospect?
Not always. Section 24(5) allows collection without consent where it is necessary for a legitimate interest that the person’s rights do not override. You still have to give the Section 23 details in your first message (Section 25): where you got the data, what you will use it for, how long you keep it and how to reach you. The person can object to direct marketing at any time (Section 32), and once they do you must stop using their data immediately.
Can I scrape LinkedIn?
LinkedIn’s User Agreement (8.2) forbids software, scripts, bots, crawlers or browser extensions that scrape or copy profiles, and forbids copying or distributing information obtained from LinkedIn without the content owner’s consent. Doing it breaches your contract with LinkedIn whether or not you meet the PDPA. Research manually and use LinkedIn’s own tools.
What are the penalties for breaking the PDPA?
Administrative fines of up to THB 1,000,000 for failing to give the Section 23 notice or keep Section 39 records (Section 82); up to THB 3,000,000 for collecting without a lawful basis, collecting from another source outside Section 25, or continuing to use data after a direct-marketing objection (Section 83); and up to THB 5,000,000 for sensitive data (Section 84). Courts can also award actual damages plus punitive damages of up to twice that amount (Sections 77–78), and misusing sensitive data for gain carries up to one year in prison, a fine of up to THB 1,000,000, or both (Section 79).
What if a prospect asks where we got their details?
You have to answer. Section 30 gives people the right to ask how you obtained data collected without their consent, and once they object to direct marketing they can ask you to erase it (Section 33). Record the source, collection date and lawful basis for every contact; that also covers the records Section 39 requires.
Can we buy a lead list?
You can, but once you buy it you are the data controller for every contact on it, and Section 25 applies to you. Ask the seller to confirm in writing where the data came from, on what basis, and whether the people were told. If the seller cannot answer, do not use the list. This guide is a summary, not legal advice; have counsel review your process.
Sources
Our closest related service
Lead Generation
See details →Other guides
Contact Us