What auditors ask first on PDPA audit day

Thai companies meet three kinds of privacy auditor. The first comes from a certification body to assess ISO/IEC 27001 or ISO/IEC 27701. The second is sent by a large client to check you as a supplier or as its data processor. The third is your own internal audit function.

Their goals differ, yet the first hour looks remarkably similar. The auditor asks for a handful of core documents, then asks questions that can only be answered with evidence. Teams that answer with explanations alone tend to lose ground right there.

What is a two-stage audit, and why do complete documents still fail?

A certification audit is usually split in two. In stage one the auditor reads your documentation to see whether the written system covers the requirements. In stage two the auditor checks whether people actually follow it, by sampling records and forms and by interviewing staff.

Many companies clear stage one because they bought or commissioned a full policy set, then stumble in stage two. The policy promises an annual review, but nobody can find the review minutes. The policy says every new joiner is trained, but half the names are missing from the attendance list. Client audits and internal audits follow the same logic even when they do not split into two separate visits.

In ISO/IEC 27001 a stage-one auditor typically opens three things together: clause 6.1.3, which calls for a document showing which controls you apply and why (the Statement of Applicability, or SoA); clause 9.2 on internal audit; and clause 9.3 on management review. Those three show whether the system is alive or just paper. The order of documents to prepare is in our ISO audit readiness guide.

What do PDPA auditors ask first? The 14 questions to prepare for

The opening round usually circles the 14 topics below. The order shifts with the business, but nearly every one can be answered with a document or a record you can hand over. The table puts each question next to the legal text the auditor will link it to and the evidence that answers it best.

Question 10 needs to be stated carefully. The PDPA text we work from contains no provision that expressly requires a data protection impact assessment. ISO/IEC 27701 auditors and foreign clients ask about it because their standards and laws emphasise it. Running a DPIA for high-risk processing is therefore good practice, and it is useful evidence that your Section 37 (1) measures fit the risk.

Which legal text sits behind each question, and what evidence do auditors accept?

An experienced auditor asks every question twice. The first time: do you have it? The second time: show me one real example. The subsections below quote the words of the law the auditor will turn to and name the item that answers the second question.

The Section 39 record is the first document requested

Auditors do not stop at whether the record exists. They pick one activity, payroll for example, and check whether the retention period written there matches the retention schedule and whether the system named is the one in use. A record untouched for two years after the payroll system was replaced is a finding waiting to be written. How to build a record people keep current is in the RoPA how-to guide.

DPO or no DPO, you must be able to explain either way

If the business falls within Section 41 and must have a data protection officer, good evidence is the appointment letter, a contact channel that actually works, and a trail of the DPO's Section 42 work such as advice given to departments. If you assessed that you do not fall within it, keep that assessment ready. Saying a DPO is unnecessary without a document behind it rarely satisfies an auditor. The assessment steps are in Do we need a DPO?.

The privacy notice is compared with what you actually do

Section 23 lists six things people must be told before or at collection. A careful auditor lifts the retention period from your privacy notice and holds it against the record of processing and the retention schedule. If the three disagree, at least one of them is telling data subjects something untrue.

Unreported incidents are where auditors dig deepest

PDPA Section 37 (4) requires notifying the PDPC Office without delay and, where feasible, within 72 hours after becoming aware of a breach, unless it is unlikely to result in a risk to people's rights and freedoms. Auditors know most companies have small incidents they decided not to report, so they often ask for those before the big ones.

The answer is an incident register that logs everything, including incidents closed as not reportable. Each entry should show when the company became aware, which data was involved, the risk assessment, the reason for not notifying and who decided. A company that only logs the incidents it reported cannot answer this question. Ways to train the team to make that call quickly are in our half-day breach drill.

Rights requests: the auditor counts the days on real cases

That 30-day ceiling is written for access and copy requests under Section 30. The 2026 PDPC notification on access and copies allows a further extension of up to 30 days, provided the data subject is told why. So auditors sample three to five requests from the register and check the date received, the date answered and, where used, the extension letter.

For refusals, Section 30 paragraph three requires the refusal and its reasons to be recorded in the Section 39 record. A request register with no column for refusal reasons is an easy gap to spot. Day-counting details are in Answering data subject requests within 30 days.

Retention: auditors want proof of deletion, not just a schedule

Because Section 37 (3) speaks of an examination system, a retention schedule alone falls short. The auditor will ask what was deleted last month, who approved it, and whether the shredding contractor issued a destruction certificate. If the schedule says rejected job applications are kept for one year but the folder still holds applications from four years ago, expect a finding. Building a schedule you can explain is covered in A retention schedule you can defend.

Staff training is spelled out in the PDPC notification

Auditors often interview one or two front-line staff without warning, for instance asking a call-centre agent where a deletion request goes. That answer weighs about as much as the attendance list. If the list is complete but the agent cannot answer, the auditor concludes the training did not work.

Vendors: there has to be a real agreement

The auditor picks two or three names from the vendor list, such as the payroll bureau, a cloud CRM or the guard company that watches the cameras, and asks for the agreements. Clause 8 of the 2022 breach notification also requires the agreement to oblige the processor to report a breach to the controller within 72 hours of becoming aware, where feasible. Contracts missing that term are one of the most common findings. Pre-signing checks are in Vendor checks before you sign.

Children, sensitive data, CCTV, cookies and transfers abroad

Auditors raise these five only where the business genuinely touches them: a tutoring school is asked about children, a hospital about health data, an online shop about cookies. Sensitive data under Section 26 may be collected with explicit consent or under one of the exceptions that section lists, so the evidence must show which ground applies in each case.

For CCTV, auditors often walk to the actual sign at the entrance, then ask who can view past footage and how many days it is kept. The CCTV security guideline from the National Cyber Security Agency (NCSA) is guidance, not law, but it gives a useful frame for answers about passwords and remote access. For transfers abroad, the strongest evidence is a map showing which country each data set sits in and which Section 28 or 29 basis applies.

How do you sample evidence honestly instead of picking the best files?

Auditors know companies want to show their tidiest files, so they usually choose samples themselves from the full population. Hand over three prepared files and the auditor will ask for the whole list and point at something else. Rehearse the same way, so you meet the problems before the auditor does.

1. Always start from the full population: every request this year, every incident this year, every vendor. If no full list exists, that topic is not ready for audit.
2. Select by risk first, then at random: every refused request, every incident closed as not reportable, every vendor with access to sensitive data, then a random draw from the rest.
3. Write down how you selected before opening any file: what, how many, and why. Auditors trust a rehearsal more when they can see the sample was not chosen after the answers were known.
4. Trace one item end to end. For a deletion request, follow it from receipt and identity check through deletion in each system to the reply letter.
5. Keep the failures. Do not quietly fix them and pretend they never happened; log the fix as new work with its real date.

What separates a major nonconformity from a minor one?

Certification auditors usually grade what they find in three levels: major nonconformity, minor nonconformity and opportunity for improvement (OFI). A major finding commonly blocks the certificate until it is fixed and the fix is proven. A minor finding needs a corrective action plan within a period the certification body sets. Exact criteria vary between bodies, so ask yours before the audit.

A simple test helps: is this a one-off or the whole system? One miss in five samples is usually minor. A miss in every sample, or no process to examine at all, is usually major. Once findings are in, ISO/IEC 27001 clause 10.2 expects you to find the root cause and fix it there, not just close the item the auditor saw.

A two-week audit rehearsal: what happens on which day?

Two weeks is enough for a company that already has a system and wants to know where it will be caught out. If there is no record of processing or incident register yet, build those two first and rehearse afterwards. The plan below is practical advice from real engagements, not a legal requirement.

1. Day 1
   Fix the audit scope: which entities, sites and systems are in. Book the people who must take part: DPO, IT, HR and the owners of core processes.ISO/IEC 27001 clause 9.2
2. Days 2-3
   Gather the stage-one set in one place: policies, record of processing, privacy notices, retention schedule, incident procedure, and the SoA if you are seeking ISO.PDPA Sections 39 and 23
3. Day 4
   Cross-check the documents. Retention periods in the notice, the record and the schedule must match; the DPO's name and contact must be identical everywhere.PDPA Sections 23 (3) and 41
4. Day 5
   Build full lists of requests, incidents and vendors, and write down the sampling method before opening any file.PDPA Sections 30 and 40
5. Days 8-9
   Run a mock stage two. Trace each sampled item end to end, including every incident closed as not reportable.2022 breach notification clause 9
6. Day 10
   Interview three to five front-line staff unannounced about what they would do with a leak or a customer request, and walk past the CCTV signs and the records room.2022 security measures notification clause 4 (7)
7. Day 11
   Grade the results as major, minor or opportunity for improvement, each with its evidence.ISO/IEC 27001 clause 10.2
8. Day 12
   Take the results to a management review. Decide what is fixed before the real audit and what goes into a corrective plan with due dates.ISO/IEC 27001 clause 9.3
9. Days 13-14
   Fix what can be fixed, dated truthfully. Assign a guide for the auditor and someone to drive the systems, and build an evidence index that finds any item in minutes.

Two kinds of tool can speed this up. If you are not on any platform yet, start with the free mock auditor: it covers 9 topics and asks up to 5 follow-up questions the way a real auditor would, runs in your browser and stores nothing. Every AIPDPA plan includes an audit drill of 14 topics with quality criteria; the questions are chosen from your organisation profile and only for the modules you have switched on, with no AI and no credits used. It is internal practice, not certification.

Organisations heading for a real certificate usually need more. The AIPDPA ENTERPRISE plan adds a two-stage mock audit: stage one reviews documents, stage two samples real evidence by risk. Every finding is graded major, minor or OFI by fixed rules; AI only rewords the closing summary, and fix-up tasks are created only after a person confirms the results. It also provides a risk-based internal audit plan, a management review agenda built from live numbers and an SoA exported to Word. All of this helps you prepare; none of it guarantees a pass.

Five ways to lose marks when the work was actually done

• The evidence lives in one person's head. That person is on leave on audit day and nobody can open the system or find the file. At least two people should know where every item sits.
• Only reported incidents are logged. Incidents judged not reportable vanish from the register, even though clause 9 of the 2022 breach notification puts the duty to provide evidence for the exemption on the controller.
• Answering for each other in the room. A manager answers for the employee being interviewed; the auditor re-asks someone else and gives the first answer less weight.
• A scope wider than reality. Every branch is put in scope when only head office has the system, so the unready branches become findings against the whole system.
• An off-the-shelf English template set, imported whole. The systems named in the documents are not the ones the company uses, and the auditor sees in stage one that the paperwork was not written from real work.

Audit day gets much easier once the team has answered the 14 questions above with real evidence at least once. Auditors do not expect zero findings. They want to see that the organisation knows its weak spots and can prove it is fixing them. If your record of processing or impact assessments are still stuck, read Getting RoPA and DPIA finished before you start rehearsing.

Who stands behind this guide?

Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel

Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)