If you take bookings, you handle guest data — names, phone numbers, sometimes ID or payment details. Thailand's PDPA sets simple expectations for that, and for a small property the practical version fits on one page. (This is general guidance, not legal advice — check your own situation with a professional.)
Know what you actually collect
List it once: booking-form fields, LINE chats, a guestbook, a prize draw. You can't look after data you haven't noticed — and most small stays collect more than they need.
Ask, and say why
When a guest gives you their details, it should be clear what you'll use them for and that they're okay with it. A short privacy note on your site and booking form — what you collect, why, and how to reach you — covers most of it.
Collect less, keep it safe
The less you store, the less you have to protect. Don't keep ID scans longer than you need, don't share guest lists in open group chats, and use individual logins — not a shared password taped to the desk.
Let guests reach you
A guest can ask what you hold about them, or ask you to delete it. Make that easy: one clear contact — email or LINE — that a real person answers.
When in doubt, ask
PDPA isn't meant to trap small businesses, but the details matter for contests, marketing messages, and payment data. For anything beyond the basics, a short chat with someone who knows the law is worth it.
A clear privacy note and a few tidy habits cover most of what a small property needs. If you'd like, we can add a simple, PDPA-aware privacy page and booking form to your site — plain, honest, and easy to keep.