Salesforce Consulting in Thailand

Bangkok is 90 minutes ahead of India, so nearly the whole working day overlaps. GeekMidst works with organisations in Thailand remotely from India; we have no office, staff or phone number in Thailand. We work in English, not Thai, and quote each project in a proposal.

The topic Thai teams most need to understand early is hosting. As far as our sources show, Salesforce has no Hyperforce location in Thailand, which brings the PDPA's cross-border rules into almost every project.

Working across time zones

Indochina Time is UTC+7, with no daylight saving.

No Hyperforce region in Thailand: what it means

In Salesforce's Infrastructure and Sub-processors document, Thailand doesn't appear as a Hyperforce hosting location. It appears only as the base of a Salesforce support entity, salesforce.com (Thailand) Co., Ltd. We couldn't read Salesforce's official region list for this page, so check the current list in Salesforce Help before you decide anything.

In practice:

• Expect your org to be hosted outside Thailand. The same document lists hosting in countries such as Singapore, India, Japan and Australia. Which location your org uses is agreed with Salesforce.
• Cross-border transfer rules apply to the personal data you store in Salesforce, so your transfer basis should be documented.
• A support entity isn't hosting. Having a Salesforce company in Thailand doesn't put your data in Thailand.
• Products vary. Even within a region, not every service is hosted in every location.

Data and privacy rules to plan for

The Personal Data Protection Act B.E. 2562 (2019) (PDPA) was published in May 2019 and came into full force on 1 June 2022. The regulator is the Personal Data Protection Committee (PDPC). According to HSF Kramer, it issued fines in five cases totalling more than THB 21.5 million in 2025.

• Reach. The PDPA applies to overseas businesses that offer goods or services to people in Thailand or monitor their behaviour there.
• Consent is one lawful basis and can be withdrawn at any time. We haven't confirmed marketing-specific consent rules, so ask your adviser.
• Breaches. Notify the PDPC within 72 hours where possible, and notify individuals when the risk to them is high.
• Transfers need an adequate destination, approved binding corporate rules or safeguards such as ASEAN model clauses or SCCs. Rules issued in December 2023 took effect in March 2024.
• Penalties. Administrative fines go up to THB 5 million.

We couldn't confirm an official PDPC page for this summary, which relies on law-firm sources listed below. Check with your legal adviser.

Services teams in Thailand ask us about

• Salesforce implementation with the hosting and transfer questions settled first
• Security and governance to control who can see personal data
• Data migration from older CRMs and spreadsheets
• Marketing Cloud consulting with withdrawable consent built in
• Managed support

Industries

We haven't researched Thai sectors for this page. Our industries hub lists the sectors we cover.

Sources

• Salesforce Infrastructure and Sub-processors (PDF)
• HSF Kramer: six years of Thai PDPA enforcement
• PwC: Thailand data protection overview (PDF)
• Hunton: Thailand's first data protection law