Thai e-commerce grew 51.8%: social commerce, creators and the PDPA risk sellers can’t ignore

In April 2026, DealStreetAsia reported Momentum Works’ analysis that e-commerce gross merchandise value (GMV) in Southeast Asia reached about US$157.6 billion in 2025. Thailand led growth at 51.8%, followed by Malaysia at 47.6%.

Thailand Business News, citing the same report, put Thailand’s 2025 GMV at about US$35.5 billion. Shopee remains the market leader, TikTok Shop is described as closing the gap quickly, and Lazada has shifted towards a strategy built on trust in products and service.

The growth is notable because it happened while the Thai economy was sluggish. It suggests consumers moved more of their spending online in search of better prices and convenience.

Thairath English reported on 1 April 2026, citing TikTok Shop and Accenture, that TikTok Shop in Thailand has over 5 million sellers and more than 3 million creators actively selling. The same report projects Thailand’s creator economy to reach about US$172 billion by 2030.

A TikTok public policy director described consumer behaviour as shifting from search-based shopping to “Discovery Commerce”, where people find products through content. Asia-Pacific data in the same report says 76% of consumers are likely to act after seeing credible content.

These figures come from the platform side, so read them with care. Still, the direction matches this year’s ad spend data, where money is flowing towards social and e-commerce placements.

The more a store sells, the more customer data it holds: names, addresses, phone numbers and purchase history. As Thansettakij reported on 1 August 2025, Thailand’s Personal Data Protection Committee (PDPC) announced eight administrative fine orders across five cases, taking total fines since the PDPA came into force past THB 21.5 million.

Several cases involved online sellers directly. A computer equipment seller was fined THB 7 million and a cosmetics seller THB 2.5 million. In the case of a collectible toy seller, the store as data controller was fined THB 500,000, while the data processor running its system was fined THB 3 million.

The key lesson is that system providers and web contractors can be held liable too, and can be fined more than the store owner. In several cases, leaked store data was later used by call-centre scam gangs, which directly damages customer trust.

Selling on marketplaces gives you reach, but the platform owns the customer relationship. Stores that want steady growth should run their own channels alongside, such as a website where people can actually buy, or a LINE Official Account for looking after existing customers and encouraging repeat orders.

Once you start collecting customer data yourself, PDPA responsibilities come with it. Many small stores keep customer lists in spreadsheets, share passwords in team chats, or hire freelancers to build sites without any data agreement. These are the same weaknesses seen in the fined cases.

Trust has become part of the brand. A store that clearly explains what data it collects, why, and how it protects it is more likely to earn repeat customers than one that sells well but leaks data.

This is not legal advice, but these are starting points most online stores can handle themselves before talking to a specialist.

If a contractor manages your website or customer system, ask them to explain how data is stored, backed up and protected. A short written answer now costs far less than explaining a leak to customers and the regulator later.

• List what customer data you collect, where it is stored, and who can access it.
• Publish a clear privacy notice and consent wording on your website and every form.
• Sign data processing agreements with your web developer, back-office providers and couriers.
• Turn on two-factor authentication for store and admin accounts, and stop sharing passwords in chat.
• Prepare a breach response plan, including notifying the PDPC within the legal time limit.