Personal data protection (PDPA) programme

Policies, records of processing activities and consent forms aligned with the Personal Data Protection Act. It sits within technology and organisational data governance, so it can be planned alongside related work without duplicating filings.

Organisations holding customer, employee or partner data, and processors acting for others. If you are unsure whether your case qualifies, share the documents and the receiving authority so the scope can be assessed first.

Normally: Inventory of personal data held and the purpose of each set · Contracts with third parties that access the data · Current privacy notice and consent forms · Security measures actually in place. The receiving authority may require additional items.

1) Map data flows and the lawful basis for each activity 2) Update the privacy notice and consent forms 3) Build the record of processing activities 4) Define procedures for data-subject requests and breach response 5) Train the teams involved and review on a cycle

• Bundled consent covering every purpose in one clause rarely survives scrutiny • Cross-border transfers need separate conditions assessed before they start

Unlike publishing a privacy notice alone, this requires processing records and procedures that actually run.

Personal Data Protection Committee Office is the primary authority. Business services in Thailand map onto clearly separated authorities: company registration sits with the Department of Business Development, taxation with the Revenue Department, social security with the Social Security Office, certification of translations for overseas use with the Department of Consular Affairs (MFA), and signature certification with lawyers authorised under Lawyers Council regulations. Routing each task to the correct authority from the start is what prevents re-filing and rejection.

Send the documents you hold, the intended use, and the receiving authority or destination country. We assess scope, flag missing items and propose a filing order that reduces rejection risk. Available in Bangkok, Khon Kaen, Udon Thani, Nong Khai and online nationwide.

Yes. Most matters begin with a scan review, with originals couriered only when required. Clients across all 77 provinces and overseas clients can proceed online, in many cases with a power of attorney.

The content follows the published mandates of the responsible authorities and was last reviewed on 2026-08-17. Confirm current requirements with the receiving authority before filing, as forms and conditions change.

This item evidences a fact the receiving desk must verify before approval. If it is missing or inconsistent with the rest of the bundle, the file is usually returned at intake rather than at assessment.

This item evidences a fact the receiving desk must verify before approval. If it is missing or inconsistent with the rest of the bundle, the file is usually returned at intake rather than at assessment.

This item evidences a fact the receiving desk must verify before approval. If it is missing or inconsistent with the rest of the bundle, the file is usually returned at intake rather than at assessment.

This item evidences a fact the receiving desk must verify before approval. If it is missing or inconsistent with the rest of the bundle, the file is usually returned at intake rather than at assessment.

Map data flows and the lawful basis for each activity This step must complete before the next one begins; working out of order usually forces a restart.

Update the privacy notice and consent forms This step must complete before the next one begins; working out of order usually forces a restart.

Build the record of processing activities This step must complete before the next one begins; working out of order usually forces a restart.

Define procedures for data-subject requests and breach response This step must complete before the next one begins; working out of order usually forces a restart.

Train the teams involved and review on a cycle This step must complete before the next one begins; working out of order usually forces a restart.

Check it before work starts: reconcile the data across every document in the bundle and confirm the destination authority's conditions in writing before any step that incurs real cost.

Check it before work starts: reconcile the data across every document in the bundle and confirm the destination authority's conditions in writing before any step that incurs real cost.

Book ahead at the Bangkok office, or send scans for review first and bring the originals in a single visit. This keeps clients travelling from nearby areas from making a second trip over missing paperwork.

Book ahead at the Khon Kaen office, or send scans for review first and bring the originals in a single visit. This keeps clients travelling from nearby areas from making a second trip over missing paperwork.

Book ahead at the Udon Thani office, or send scans for review first and bring the originals in a single visit. This keeps clients travelling from nearby areas from making a second trip over missing paperwork.

Book ahead at the Nong Khai office, or send scans for review first and bring the originals in a single visit. This keeps clients travelling from nearby areas from making a second trip over missing paperwork.

Policies, records of processing activities and consent forms aligned with the Personal Data Protection Act. By contrast, designing the document path from intake and verification through approval and archiving, so every step is auditable and re-filing is reduced. Both sit in technology and organisational data governance and share base documents, so planning them together avoids duplicate filings when the destination requires both.

Policies, records of processing activities and consent forms aligned with the Personal Data Protection Act. By contrast, practices for electronic signing, supporting evidence retention, and identifying the cases that still require wet-ink documents with certification. Both sit in technology and organisational data governance and share base documents, so planning them together avoids duplicate filings when the destination requires both.

Policies, records of processing activities and consent forms aligned with the Personal Data Protection Act. By contrast, connecting accounting, HR and document systems so one dataset flows through without re-keying. Both sit in technology and organisational data governance and share base documents, so planning them together avoids duplicate filings when the destination requires both.

Policies, records of processing activities and consent forms aligned with the Personal Data Protection Act. By contrast, reviewing website claims, mandatory disclosures and organisational contact details so they match the facts and applicable requirements. Both sit in technology and organisational data governance and share base documents, so planning them together avoids duplicate filings when the destination requires both.

Follow the receiving authority. Thai documents used abroad normally need an English or local-language translation; foreign documents used in Thailand need a certified Thai translation.

In many cases yes, using a power of attorney that states the scope, with ID or passport copies of both parties. Some authorities still require the applicant in person for specific steps, so confirm before travelling.

Always obtain the reason in writing first, then check three things: name and date consistency across every document, a complete certification chain, and the destination authority's required format. Refile only after the order is corrected.

Documents are used only as required to complete the matter, are not disclosed to third parties without consent, and working files are returned or destroyed on request once the matter closes.