Most hotel PDPA conversations start and end at the front desk: is the consent form worded correctly, does the passport-copy notice say enough, is the guest registration card compliant. Thailand's actual 2025 enforcement record tells a different story. Across the Personal Data Protection Committee's fine cases from that year, one of the clearest involves a collectible toy retailer whose outsourced booking platform was breached—and the fallout landed on both the retailer and the service provider running the system, not on a consent form anywhere in sight.
It sounds like a story about toys, not hotels. It isn't. A hotel that outsources its booking engine, channel manager, or PMS to a third-party vendor is running the exact same structure the PDPC just fined: a business that collects and is legally responsible for guest data, sitting on top of a system it doesn't operate day-to-day. This piece walks through what the PDPC actually fined in 2025, why "we compensated the affected guests" wasn't enough to prevent a penalty in the case that maps most directly onto hotel operations, and what vendor oversight actually needs to look like once you stop treating PDPA as a front-desk problem.
The PDPC's 2025 enforcement record wasn't built on missing consent checkboxes—it was built on outsourced systems that broke and businesses that couldn't show they'd been watching them.
What the 2025 Enforcement Wave Actually Fined
Thailand's Personal Data Protection Committee brought five enforcement cases in 2025, according to legal analysis from DLA Piper, with fines ranging from a few hundred thousand baht up to THB 7 million against a technology retailer. The pattern across the cases wasn't uniform paperwork failure—it was a recurring set of specific gaps: inadequate security measures, breach notification failures in at least one major case, and insufficient oversight of the third-party data processors these businesses relied on. That last category is the one hotels should read most carefully.
The Vendor Blind Spot: What Gets Overlooked in the PDPA Conversation
The case that maps most directly onto hotel operations involved a collectible toy retailer that had outsourced its booking platform to a third-party service provider. When that provider's system was breached, the PDPC didn't just fine the service provider THB 3 million for inadequate security controls—it also fined the retailer itself THB 500,000, because the responsibility for the data didn't transfer away just because the system did. A hotel's booking engine, channel manager, and PMS are the same arrangement: a vendor operates the system, but the hotel is still the business a guest handed their passport number and payment details to, and still the business a regulator will look at first.
That's the vendor blind spot. It's easy to treat PDPA compliance as something you finish once—get the consent language right, post the privacy notice, done, the same checklist mindset covered in a practical rundown of passport data, TM30, and digital check-in requirements for Thai hotels. It's much easier to overlook the ongoing question of whether the vendors actually running your reservation, payment, and guest-data systems are maintaining the security standard your compliance depends on, because that work happens outside your building, on infrastructure you don't control day-to-day.
Why "We Compensated Guests Anyway" Didn't Save the Toy Retailer
This kind of regulatory exposure compounds the same way the rising operating costs squeezing Thailand's budget and mid-range hotels do—a fine or a breach response is a cost a thin-margin property can absorb far less easily than a well-capitalized chain. The retailer in that case had promptly compensated the affected individuals after the breach—and was fined regardless. That's the detail worth sitting with: good-faith remediation after the fact didn't offset the underlying failure to maintain oversight of the processor beforehand. The PDPC's enforcement pattern, across this case and the others DLA Piper documented, isn't primarily about punishing the aftermath of a breach. It's about penalizing the absence of the oversight structure—the data processing agreement, the security due diligence, the documented monitoring—that should have existed before anything went wrong.
Picture a hypothetical restaurant chain called Ploenjai Kitchen, which outsources its loyalty app and customer database to a third-party vendor to save on internal development costs. If that vendor's system is breached, Ploenjai Kitchen doesn't get to point at the vendor and step back—it's still the business whose name is on the loyalty card and whose customers trusted it with their phone numbers and order history. The chain that can show it vetted that vendor, put a data processing agreement in place, and checked in on security practices periodically is in a fundamentally different position than the chain that just signed up for the cheapest loyalty platform and never asked again. Hotels running booking engines, channel managers, and guest-messaging tools through third-party vendors are in exactly the same position.
The Vendor Accountability Playbook
- Vendor Due Diligence Before Signature — check a vendor's security posture and data-handling practices before handing them guest data, not after an incident forces the question.
- Written Data Processing Agreements — put the vendor's obligations, security standards, and breach-notification timeline in writing, not in a verbal understanding from the sales call.
- Periodic Oversight, Not a One-Time Check — revisit vendor security practices on a recurring schedule, since "we checked once at onboarding" is the same gap the PDPC fined in the toy retailer case.
- Know Your Breach-Notification Clock — confirm in writing how fast a vendor will tell you about a breach, since notification failure was one of the specific gaps cited across the PDPC's 2025 cases.
Accountability: what this all comes down to
If there's one word for what the PDPC's 2025 enforcement record actually demonstrates, it's Accountability—responsibility for guest data doesn't transfer to a vendor just because the system does.
So here's the question worth sitting with: if your booking engine or PMS vendor had a breach tomorrow, could you show a regulator the due diligence and oversight that happened before it, or only the apology email you'd send after?
FAQ
Does outsourcing our booking system to a vendor reduce our PDPA liability?
No. The 2025 enforcement cases show businesses being fined alongside their outsourced service providers, not instead of them. The business that collected the guest data remains accountable for how it's protected, even when a vendor operates the system.
What specifically did the PDPC fine businesses for in 2025?
DLA Piper's analysis of the five 2025 cases identifies a recurring pattern of inadequate security measures, breach notification failures, and insufficient oversight of third-party data processors—not, notably, defective consent forms.
Does compensating affected guests after a breach prevent a fine?
Not on its own. In the case involving an outsourced booking platform, the business had promptly compensated affected individuals and was still fined, because the underlying failure was the lack of oversight before the breach occurred.
What should a hotel actually ask its PMS or booking-engine vendor?
Ask for its security practices, whether it can meet a defined breach-notification timeline in writing, and whether a data processing agreement is in place—the same due-diligence gaps the PDPC's 2025 cases cited as failures.
Is this only relevant to hotels with large IT budgets?
No. Vendor oversight is a documentation and process discipline, not a capital expense—smaller properties running on third-party PMS and booking-engine platforms carry the same exposure as larger ones and can close the gap without a large technology budget.
What this looks like with NAWA Hotel
NAWA Hotel keeps reservations, guest details, payments, and finance inside one connected system rather than scattered across separate vendor platforms that each need their own oversight. Fewer third-party systems touching guest data means a smaller vendor-accountability surface to manage and document in the first place.
If you want to map out where your guest data actually lives across your current vendor stack, talk to us about your current systems setup.
Sources: DLA Piper, "Thailand: PDPA Crackdown 2025: Are You Next?"