AIPDPA is a PDPA and AI governance platform for Thai organisations. It connects personal data, AI systems and organisational risk through an intelligent decision system, so you get the work done more easily, with 40 ready-to-use documents that fill in your company details for you.
Signals across the organisation
Decision Engine
Stops at the first confident stepRetention linked · request routed
Template match · vendor risk level
Refuse a request · approve AI use
Connected by design
Registers, documents, risk and decisions all read the same organisation data — no duplicate files, no two numbers that disagree. Change it once and everything related follows.
Save a RoPA activityDPIA screened, retention linked, tasks assigned
Pick a vendorThe DPA fills in the vendor and contract from the register
Log a breachThe 72-hour clock starts · the PDPC notice pulls from the incident
Try it first, no sign-up
Use them now. No account, nothing to install.
Answer 8 questions to get a risk level and a six-axis radar straight away. It runs in your browser and stores no answers.
Sample result · Six-axis radar
Enter a domain and we check TLS, the certificate, security headers, cookies, DNSSEC and security.txt, then show a score and the 3 things to fix first.
Smart DSR
Every company gets its own request portal, an A4 QR poster for branches, a receipt, and a tracking page that reveals no details.
Statutory clocks, calculated for you
Your Company Co., Ltd.
Exercise your PDPA rights here
Scan the QR code to file a request, or ask our staff at the counter
10 request types
Standards and law
134 Thai checklist items to self-assess against today, with evidence on every item. Requirement text is checked against the official source by a person.
56items
WSS 1.0
Website Security Standard B.E. 2568 (2025)
End to end: impact rating per tables C1–C5, required items per C6, the C1 checklist form, a C2 remediation plan with owner and due date, and a printable report. The system states who must comply (state agencies, regulators, CII) and that private organisations are encouraged to follow it.
55items
Rec. 4-2559
Web Application Security Recommendation
A developer-side checklist for web applications, available on the same website page as WSS 1.0.
23items
s.37(1)
Personal data security measures
A plain-language checklist referencing PDPA s.37(1) and the PDPC Notification on Security Measures B.E. 2565 (2022).
134
items you can use today · evidence on every item
20 automated checks keep raw values as evidence and suggest results for 12 requirements for a person to confirm. Rescans run on a schedule and warn before a TLS certificate expires.
Suggested, a person confirms
All 39 customer-side requirements are in the catalogue with human-checked text. The assessment screen is in progress.
International frameworks built into the assessments
AI Risk Radar
20 questions
Linked to clause numbers that exist in the library: 18 PDPA, 22 NIST AI RMF, 27 ISO/IEC 42001 and 20 EU AI Act references.
DPIA
66 questions
Mapped to PDPA sections (49 links), ISO/IEC 27001 Annex A (6) and GDPR (3), with help text based on TDPG 4.0.
Generative AI (ETDA)
16 items
A 3-group checklist from ETDA's guideline on Generative AI in organisations, with hints from 10 facts the system already holds.
One piece of evidence, several standards
The system suggests overlapping requirements across standards. A pair counts only after a person confirms it.
The AI assistant is designed to search this library before answering, and a check command confirms the database matches the source file of every document.
The AI assistant is designed to search the law library before answering and to cite section numbers from the text it retrieves. Treat answers as working support and open the cited text before relying on it.
6 Thai Acts · 14 notifications · 1 rule · the EU AI Act consolidated with Regulation 2026/1744 · 5 guidelines (including TDPG 4.0 and ETDA AI guides) · 2 standards (ISO/IEC 42001, NIST AI RMF) · 8 practice notes by the AIPDPA team
ISO/IEC 42001 is held as a clause index for reference; the full text is not published.
Laws and standards in the system
Every standard is used as self-assessment criteria inside the tools. None of this is a certification by NCSA, ETDA or the PDPC, and we do not issue certificates.
AI governance
From the AI system register to staff AI licences. AI suggests, people decide, and scores come from a fixed formula, not a model.
AI system register
Classified on the EU AI Act's four-tier frame. A person picks the tier and writes the reason, the screen says plainly that this is not Thai law, and there is a printable overview for management.
Catch shadow AI
A form for staff to declare the AI tools they actually use, so you can see where data goes.
ETDA Generative AI checklist
16 items in 3 groups (structure, strategy and risk, operations and monitoring), with hints from what the system already knows, such as whether the policy is approved.
An AI licence for staff
A quiz based on ETDA's sample policy: 20 random questions, at least 16 correct to pass, one attempt at a time, a 24-hour wait after a fail, valid for 12 months.
Check text before pasting into AI
Detects Thai ID numbers (check digit), card numbers (Luhn) and bank accounts. The text never leaves the browser.
The five tools above and the full Risk Radar are in the AI register module, from the GROWTH plan up · the free 8-question check needs no account
20 questions (6 on exposure, 14 on controls) produce a six-axis radar. The question wording has been confirmed, and results are stored against the questionnaire version.
Ask once, see several lenses · references
Ready-to-use documents
Privacy notices, consent forms, processing agreements and IP contracts, issued in either language from the registers you already keep.
Your Company Co., Ltd.
Privacy notice for customers
Examples in the system
Cloudflare R2Evidence and attachments live on Cloudflare R2, opened only through signed links that expire on their own. Approved documents are sealed with SHA-256.
Modules
Enter it once and every open module shares it · Each plan opens a different set (STARTER 11 · GROWTH 20 · PRO 23 · ENTERPRISE 23 modules)
The tag on each module shows the first plan that includes it
Records of processing (RoPA)
s.39 · CSV export and print
Rights requests (DSR)
Portal + QR + deadline clocks
Data breaches
72-hour clock · 8 factors
Impact assessment (DPIA)
66 questions, 9 sections
Consent + cookie banner
Consent Mode v2
Processors and vendors
Vendor risk assessment
Systems and data map
Where data lives and flows
Retention and disposal
Retention periods
Multi-standard controls
Evidence on every item
Website security
WSS 1.0 · ETDA 4-2559
AI register + Risk Radar
EU AI Act · NIST · ISO 42001
Staff training
Courses · end-of-lesson quizzes
Regulatory radar
Changes curated by our team
AI assistant
Searches the law library, cites sections
Group benchmark
Across companies in your group
Executive dashboard
Readiness score, 8 indicators
Ready-to-use documents
40 in Thai and English
Workflow and tasks
Assign, track, approve
Audit log
SHA-256 hash chain
Users and permissions
11 roles · 72 permissions
Public API
Read-only · v1
The record is the source
The system reads your processing record and pre-answers the impact assessment. Your team reviews and decides instead of retyping.
Processing record · RoPA-0142
Impact assessment · DPIA-0087
Why AIPDPA
Every point below can be verified in the running system.
Isolation in the database
The core tables of customer data are separated by PostgreSQL row-level security in the database, a second layer on top of the app's permission checks. The app's database account is not a superuser, so it cannot bypass RLS.
A change log for registers you cannot rewrite
Changes to the RoPA, vendor, controls, users and other core registers form a per-organisation SHA-256 hash chain. The database forbids updates and deletes, so any change to history breaks the chain.
Evidence files you can prove
Each file's SHA-256 is computed on upload and mismatches are rejected. CSV exports block Excel formulas, open correctly in Thai and are logged.
Breaches: the 72-hour clock
Counted from when the breach became known, assessed on the 8 factors in clause 12 of the 2022 breach notification, with who rated it and when, and a check of vendor reporting against the contract.
Built for real groups
Parent, subsidiaries, branches and units, with 11 customer roles such as group DPO, external DPO, group auditor and privacy champion, and 72 granular permissions.
A readiness score that never rewrites history
Built from the live registers on 8 indicators, including AI and website security. Each point is stored with its formula version, so past results are never recalculated.
Encrypted AI keys, capped spend
AI provider API keys are encrypted with AES-256-GCM in the app, and you can set a daily AI spending cap in baht.
Read-only API
Pull the RoPA, DSR and breach registers with scoped API keys. Rate limits are enforced in the database.
Main screens in Thai and English
Main screens, documents, guides and the cookie banner work in both languages. Some print views and the payment page are still Thai only.
text-embedding-3-large · pgvectorThe AI assistant searches by meaning with OpenAI text-embedding-3-large on pgvector — over a legal corpus transcribed by people from the Royal Gazette — then answers with GPT-6.1 and the section number.
Free guides
Each reads in one sitting, with steps, common pitfalls and 114 citations to the law library.
Cookie consent under Thailand's PDPA must be express, purpose-specific, refusable and easy to withdraw (Section 19). Set up your banner the TDPG 4.0 way.
4 min readThai PDPA access requests must be met within 30 days (Section 30). See the 15-day ID check, extensions and refusal rules in the 2026 DSR notification.
5 min readThailand's PDPA gives you 72 hours from awareness to notify the PDPC Office. See the steps, what to report, the email channel and what to do if you are late.
5 min readThe EU AI Act reaches Thai firms that sell AI into the EU or whose AI output is used there. It has applied generally since 2 August 2026.
7 min readStart ISO/IEC 42001 without certification: self-assess against Clauses 4–10, then write your AI policy, SoA and impact assessment.
6 min readThailand's PDPA Section 39 requires at least 8 items in your RoPA. A step-by-step guide by department, the small-business exemption and audit-ready tips.
5 min readPricing
Higher plans add modules and usage. The price you see is the price you pay.
Try before you buy: open the demo account with a sample company's data and see the real system now, no sign-up
See the demo accountSTARTER
1 legal entity · No branches
2,900THB/year
GROWTH
1 legal entity · No branches
4,900THB/year
PRO
1 legal entity · 4 branches
9,900THB/year
ENTERPRISE
4 legal entities · 12 branches
19,900THB/year
| Key modules | STARTER | GROWTH | PRO | ENTERPRISE |
|---|---|---|---|---|
| Records of processing (RoPA) | Included | Included | Included | Included |
| Rights requests (DSR) | Not included | Included | Included | Included |
| Data breaches | Not included | Included | Included | Included |
| Impact assessment (DPIA) | Included | Included | Included | Included |
| Consent + cookie banner | Included | Included | Included | Included |
| Processors and vendors | Not included | Included | Included | Included |
| Website security | Included | Included | Included | Included |
| AI register + Risk Radar | Not included | Included | Included | Included |
| AI assistant | Included | Included | Included | Included |
| Group benchmark | Not included | Included | Included | Included |
| Branches | Not included | Not included | 4 | 12 |
Easy payment
PromptPay or card through Stripe, with the receipt emailed to you
Reminders before the period ends
Emails 30 and 7 days before the period ends · card payments auto-renew, and you can turn that off any time
No lost days
Pay for the same plan early and the new year starts from your old end date
Warned before expiry
Reminders 30, 7 and 1 day ahead · after expiry, 15 days at the normal price, then 12 more months to restore your data
The price you see is the price you pay — no VAT added · Organisations with branches or subsidiaries need PRO or above · Upgrade any time and the unused value of your current plan is credited · Downgrades take effect when the period ends
FAQ
If your question is not here, email us and ask.
Yes. Open the demo account to see the real system with a sample company's data right away, no sign-up (view only), and use the website scan and AI risk check for free. Self sign-up opens soon: join the waitlist and we will email you when it does. Then pick a plan (STARTER 11 · GROWTH 20 · PRO 23 · ENTERPRISE 23 modules); once paid, the full plan is yours straight away.
See the demo accountIn two ways: the modules they open (STARTER 11 · GROWTH 20 · PRO 23 · ENTERPRISE 23 modules) and their usage limits — legal entities, branches, admin seats, document storage and AI credits per month (staff accounts for training and incident reports don't take a seat). Organisations with branches or subsidiaries need PRO or above. The system reads the tax ID to tell a branch from a separate legal entity, so quotas apply automatically.
1 credit = 0.20 THB of real AI cost, charged by the actual work each time: about 6 per question to the AI assistant (median of real use) · the AI assistant and the RoPA and DPIA AI buttons show the estimated credits before you click · monthly credits reset at the start of each month · if you run out early, top up on the plan page (100 credits for 199 THB · 300 credits for 590 THB · 1,000 credits for 1,900 THB), valid for 12 months and used automatically once that month's credits are gone · a daily cap guards against abnormal use, and you get an in-app alert at 80%.
Pay by PromptPay or card through Stripe and receive the receipt by email. We email reminders 30 and 7 days before your period ends, plus one more the day before it expires if you have not renewed yet. Auto-renew is on only when you pay by card and have not turned it off, and the card is then charged within the last 3 days before the period ends. Turn auto-renew off any time on the billing page and keep access until the paid period ends.
You can pay for the same plan early: the new year starts from your old end date, so no days are lost. You can upgrade to a higher plan any time from the billing page: the unused value of your current plan is credited and the new period starts that day. Downgrades can be chosen when the period ends.
When a plan expires the account locks straight away; pay the normal price within 15 days and carry on at once. After that your data is kept locked for another 12 months and can be fully restored by paying the plan plus a restore fee; only then is it deleted for good. We do not refund plan fees, except when the service is unavailable for more than 7 consecutive days because of a problem on our side · AI credit top-ups are non-refundable once bought.
The price you see is the price you pay, with no VAT added, because the company is not VAT-registered yet. Every plan is priced per year and paid once per cycle, with no setup or joining fee. After payment you receive an emailed receipt from The Kooru Data Tech & Law (Thailand) Co., Ltd. that your company can file as an expense.
No. The system helps you self-assess against each standard's criteria, keep the evidence and plan fixes in one place, but it is not a certification by NCSA, ETDA or the PDPC, and we do not issue certificates.
No. Core customer tables are separated per organisation by row-level security in the database, with a second permission check in the app. Inside one organisation, access follows roles too: a department head sees only their own department's records, rights requests and pending decisions. Every change to a register is written to a log that cannot be edited afterwards, so you can see who changed what and when.
Different kinds of data use different providers. For example, consent proof from customers' websites is kept on Cloudflare D1, separate from the main database, and payments go through Stripe. Some data is processed outside Thailand. The privacy policy names the providers we use.
Read the privacy policyNo. It runs in the browser with nothing to install. Your legal team or DPO can start alone by filling in the organisation profile once, and every module reuses that data. The cookie banner goes on your site with a single script tag after you verify domain ownership with a DNS TXT record or a .well-known file.
No. AI suggests and people decide: a person picks each AI system's risk tier and writes the reason, radar scores use a fixed formula, AI answers in a DPIA wait for confirmation, and DSR flags never change the request type on their own.
Yes. The main screens, guides, cookie banner and all 40 ready-to-use documents work in English, except some print views and the payment page. The AI assistant is designed to answer English questions citing Thai section numbers from the text it retrieves.
Maintained by the AIPDPA legal team · content owner Phuwara Krobtaku, attorney-at-law · Thai Barrister-at-Law · Last updated
Open the demo account now, no sign-up. Self sign-up opens soon; join the waitlist and we will email you when it does.
Groups with several companies, or anyone who needs a bank-transfer invoice, can reach us by email. Talk to us · support@aipdpa.com