Data mapping is drawing where personal data comes in, where it is stored, who uses it and who receives it. TDPG treats it as the preparation step before the record of processing activities required by section 39 of Thailand's PDPA. This guide gives DPOs and small teams starting from zero a seven-day plan that ends with a first record an auditor can actually check.
- PDPA section 39 requires controllers to record at least eight items, on paper or electronically.
- TDPG recommends data mapping as the preparation step, with every department involved and senior management on board.
- Start mapping with HR, which holds the most groups of data subjects and types of data (a TDPG example).
- Vague answers such as "appropriate measures" or "per the retention policy" are rejected by TDPG.
- Failing to keep the section 39 record carries an administrative fine of up to 1 million baht (s.82).
Most RoPA projects do not fail because the form is hard. They fail on day one. The DPO emails a spreadsheet to every department; two weeks later half come back, each filled in a different way, and nobody can say how the customer data sales collects ends up with the courier company.
The cause is a skipped step. The Thailand Data Protection Guidelines 4.0 (TDPG) call it data mapping: drawing how data flows, so you know where it comes in, where it sits and where it leaves, before turning that into the record required by section 39 of the Personal Data Protection Act B.E. 2562 (2019), the PDPA.
What follows is a seven-day work plan our team built from the steps in TDPG chapter D. The number of days is our proposal; the law sets no timetable. The content of each day is tied to the statute or guideline cited.
How is data mapping different from a RoPA?
Data mapping is the picture; the RoPA is the record the law requires. The map shows how data moves across the whole organisation. The record breaks that picture into activities and answers section 39's questions one by one. TDPG places data mapping as the preparation stage.
the organization should create a data flow diagram or Data Mapping within the organization, in order to understand what data the organization collects, uses, or discloses, including the storage locations of the data, by preparing for every department within the organization to participate
The next part of the same item matters just as much: a senior person or someone with authority should join the preparation, so the work carries the weight of an organisational directive and gets full cooperation. A RoPA the DPO runs alone, without a management mandate, usually ends as the half-filled spreadsheet in the first paragraph.
What must a section 39 RoPA contain?
Know the destination before you start, so you ask the right questions from day one. Section 39 sets eight minimum items.
The Data Controller shall maintain, at least, the following records in order to enable the data subject and the Office to check upon, which can be either in a written or electronic form: (1) the collected Personal Data; (2) the purpose of the collection of the Personal Data in each category; (3) details of the Data Controller; (4) the retention period of the Personal Data;
The other four are (5) rights and methods of access, including who may access the data and on what conditions; (6) use or disclosure under section 27 paragraph three; (7) rejected requests or objections from data subjects; and (8) a description of security measures under section 37 (1).
| Question while mapping | Section 39 item | Best person to answer |
|---|---|---|
| What data, about whom? | (1) Data collected | Process owner |
| Why is it collected, on what basis? | (2) Purpose | Process owner + DPO |
| Who decides about this data? | (3) Controller details | Legal |
| How long is it kept, when is it deleted? | (4) Retention period | Process owner + Legal |
| Who inside the company can open it? | (5) Rights and methods of access | IT |
| Who outside receives it without consent? | (6) Use or disclosure under s.27 para. 3 | Process owner |
| Have we ever refused a data subject's request? | (7) Rejected requests or objections | DPO |
| How is it protected? | (8) Security measures | IT |
What happens on each of the seven days?
The plan suits small and mid-sized companies with five to ten departments. Larger groups with branches can use the same frame but should stretch days 3 to 5, because TDPG advises covering branches and affiliates the same way so no activity falls through.
- Day 1Management issues an instruction forming the team, names the DPO or coordinator, and lists every department, including ones that think they hold no personal data.TDPG D9; Dos 1
- Day 2Send a short six-question questionnaire to every department in advance, in the same plain language company-wide.TDPG D9, step 1
- Day 3Map HR first, from recruitment through hiring and payroll to exit.TDPG example on dividing departments
- Day 4Map sales, marketing, customer service and finance, an hour each at most; finish with IT on systems, storage and access rights.TDPG D9, step 2
- Day 5Gather existing documents (privacy notice, retention policy, processing agreements) and check them against the map.TDPG D9, step 3
- Day 6Turn the map into activities, one row each, and fill all eight section 39 fields. Flag rows with section 26 data.PDPA s.39; TDPG D10
- Day 7Quality-check against TDPG's list of don'ts, have process owners confirm, brief management, and book the next review.TDPG D8; Don'ts
Day 2: the six questions
TDPG gives six sample questions, short enough for a department head to answer without opening the Act. Use them as the core and add department-specific ones later.
- Why is the personal data used?
- Whose data is collected?
- What data is collected?
- Who is it shared with?
- How long is it kept?
- How is it kept secure?
Day 3: why start with HR
TDPG is explicit here, and the reasoning holds. HR has the widest range of data subjects and data types in the company. Once HR is mapped, the team has a template for everyone else.
Begin planning the Data Mapping starting with the Human Resources Department, since it is a department that collects, uses, and discloses a large amount of personal data
On a large sheet, draw five boxes left to right: where data comes from, where it is stored, who uses it, who receives it, and when it is deleted. (That is our team's method, not a required format.) Circle in red any box the department head cannot answer. Those circles are your follow-up list, not a failure.
Day 6: from map to RoPA rows
One path on the map usually becomes one activity: recruitment, payroll, delivering orders. Do not split into hundreds of rows, and do not collapse everything into a single "HR administration" row. The right level is where purpose and lawful basis are the same across the row. For choosing a basis, see You don't need consent for everything.
Flag rows with health, biometric or other section 26 data now, because they affect both the lawful basis and any small-business exemption; see Sensitive data you hold without knowing. If any activity involves children's data, read Children's data: whose consent counts too.
Which answers does TDPG say will not do?
Day 7 is quality control, and the best tool is TDPG's list of don'ts, which gives answers that look complete but tell an auditor nothing.
| Field | Answer that fails | Problem |
|---|---|---|
| Type of data | "Personal data"; "answers from the questionnaire" | Cannot show what was actually collected |
| Security measures | "Appropriate measures" | Cannot show what the measures are |
| Purpose | "To collect data as per duties" | No scope and no lawful basis |
| Retention | "As per the retention policy" with no period | Cannot check how long data is kept |
TDPG also warns on form: do not scatter the RoPA across many documents, do not link to an internal drive the reviewer cannot open, and do not use acronyms outsiders cannot read.
Stating that personal data is kept "just in case" it may be used, for example, a company keeping employees' passport data because HR requires it to be kept, without there being an actual necessity for its use
Do small businesses need a RoPA?
The last paragraph of section 39 lets the Committee exempt small businesses from some items, but the exemption has carve-backs. It does not apply where processing risks data subjects' rights, where collection is not occasional, or where section 26 data is involved. Note too that item (7), rejected requests, is not among the items that can be exempted.
The Committee notification on this exemption is not in the corpus this article draws on, so we do not detail its criteria. If you plan to rely on it, read the notification itself and see the analysis in Finishing a RoPA that works. Either way, a data map pays off for a small business, because it underpins the privacy notice and breach response.
What comes after day 7?
The first RoPA is not the last. TDPG item D8 says the record must reflect current processing and names the moments to update it.
the data controller should review the record of processing activities at least once a year, and update it whenever there is a new processing activity, or when an existing activity changes its purpose, scope, type of data, or recipient, or when a new processor or sub-processor is engaged, or when new systems or technology are adopted
What works is tying RoPA updates to work the company already does. Every time a new system is bought or a vendor that touches customer data is signed, the procurement form asks "does the RoPA need updating?". TDPG also recommends an electronic RoPA as a single source, with drop-down master data instead of free text so every department reads it the same way.
That is why the AIPDPA RoPA register groups activities by department, offers drop-downs for data types, lawful bases and retention, and prints a section 39 report the moment the PDPC Office or a data subject asks. The paper maps from days 3 to 5 go straight in on day 6. See the demo account, no sign-up needed.
Frequently asked questions
What is data mapping, and how is it different from a RoPA?
Data mapping is a diagram of how personal data flows through the organisation: where it comes in, where it is stored, who uses it and who receives it. A RoPA is the record required by PDPA section 39. TDPG treats mapping as the preparation step for the RoPA.
Does the law set a deadline for finishing a RoPA?
Section 39 sets no timetable. The seven-day plan here is our team's proposal to get the work moving. What the law requires is a record of at least eight items that data subjects and the PDPC Office can inspect.
Can a RoPA be an Excel file?
Section 39 allows written or electronic form. TDPG recommends an electronic, single-source record rather than several scattered files.
Which department should we map first?
TDPG suggests HR, because it holds many groups of data subjects and many types of data, such as identity, contact, health data for benefits, and salary.
How often should a RoPA be reviewed?
TDPG recommends at least once a year and whenever there is a new activity, a change of purpose, a new processor, or a new system. That is guidance, not statute.
Law and sources
- Personal Data Protection Act B.E. 2562 (2019) — Section 39 · Section 82
- Thailand Data Protection Guidelines 4.0, chapter D on RoPA (guidance, not law) — TDPG4.0-D (D8–D10 · Dos/Don'ts)
Text in the "The text" boxes is copied word for word from AIPDPA's legal knowledge base, transcribed from the Royal Gazette and official documents; every edit is checked by the system against that base, character by character. English wording is an unofficial translation; the Thai text prevails. This article is general information, not legal advice for a particular case.
Do it in the system
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)