PDPA for Thai Organizations — What IT & Legal Should Prepare

Thailand’s Personal Data Protection Act B.E. 2562 (PDPA) has been fully in force since 1 June 2022, and complying takes close cooperation between IT and Legal. This article summarizes what both teams should prepare together.

1. Build a data map

Identify what personal data you collect, where it is stored, who can access it, who it is shared with and how long it is kept. The result is a record of processing activities that underpins all your PDPA work.

2. Define lawful bases and privacy notices

Document the lawful basis for each processing activity, such as consent, contract or legitimate interest, and publish a clear privacy notice that people can actually understand.

3. Assign ownership and a DPO

Appoint a Data Protection Officer where the law requires it, for example with large-scale or sensitive data processing, and define policies and responsibilities clearly.

4. Set up a data subject request (DSAR) workflow

Individuals can request access, correction, deletion or objection. Provide an intake channel, identity verification and a way to search data across systems so you can respond within the legal timeframe, generally 30 days.

5. Put security measures in place

Apply role-based access control, encrypt sensitive data, keep access logs and protect endpoints and networks appropriately to meet your data security obligations.

6. Prepare a breach response plan

When a breach is likely to put people’s rights at risk, notify the Personal Data Protection Committee Office without delay and, where feasible, within 72 hours of becoming aware, and inform affected individuals if the risk is high. Rehearse this plan in advance.

7. Manage vendors and processors

Review contracts with third parties such as cloud and HR providers so that data processing terms and security measures are clearly agreed.

How Seqrite can help

Seqrite Data Privacy helps discover and manage personal data and supports data mapping and data subject request processes. This content is general information, not legal advice; consult your legal counsel for your specific situation.