A RoPA is the record of processing activities that section 39 of the PDPA requires a data controller to keep, with at least eight items. A DPIA is not named in the PDPA, but TDPG 4.0 recommends one when an activity meets two or more high-risk criteria. This is for DPOs and business owners who want to know what to record, which exemptions small businesses get, and when a DPIA is needed.
- Section 39 requires at least eight items, kept on paper or electronically.
- Small businesses can be exempt from every item except (7), the record of refused rights requests, which is always required.
- The exemption falls away for regular processing, processing that risks people's rights, or sensitive data under section 26.
- A contractor that processes on a client's behalf keeps a section 40 (3) record instead of a section 39 RoPA (PDPC answer to Company S.).
- TDPG 4.0: two or more high-risk criteria usually means a DPIA, and the RoPA should be reviewed at least once a year.
RoPA projects usually start with good intentions. The DPO sends a spreadsheet to every department asking what personal data they hold. A month later half of it comes back. The purpose column says "as required by our duties", the retention column says "per policy", and the file goes quiet.
Lack of cooperation is only part of the problem. More often the exercise starts in the wrong place: it asks legal questions of people in sales or HR. This article starts from what section 39 actually requires, turns it into questions each department can answer, and then shows which activities should carry on to a DPIA.
What must a RoPA contain under section 39?
Section 39 of the Personal Data Protection Act B.E. 2562 (2019) requires a data controller to record at least eight items, and states its own purpose: to let data subjects and the Office of the Personal Data Protection Committee (PDPC Office) check what the controller is doing.
The Data Controller shall maintain, at least, the following records in order to enable the data subject and the Office to check upon, which can be either in a written or electronic form:
| Section 39 | What the Act requires | Ask the department | An answer that works |
|---|---|---|---|
| (1) | The collected personal data | Whose data do you hold, and what exactly? | Job applicants: name, phone, email, education, work history |
| (2) | The purpose of collection for each category | What do you use it for, on which basis? | Selecting candidates; steps at the applicant's request before a contract, s.24 (3) |
| (3) | Details of the data controller | Who decides, and how can they be reached? | Company name, address and DPO contact (if any) |
| (4) | The retention period | How long do you keep it, counted from when? | A number the company sets, with a start point, e.g. 1 year from closing the vacancy |
| (5) | Rights and methods of access, and who may access | Who inside can open it; how does the person ask to see it? | HR and the hiring manager; applicants request through an online form |
| (6) | Use or disclosure under section 27 paragraph three | Have you used or shared it without consent, and on what basis? | Data sent to a government agency on official request, relying on s.24 (6) |
| (7) | Refused requests or objections under sections 30, 31, 32 and 36 | Have you ever refused a rights request? Why? | Date, requester, right requested, reason for refusal |
| (8) | Explanation of security measures under section 37 (1) | How is this data protected? | Role-based access, encrypted files, access logging |
Items (6) and (7) are the columns most RoPAs leave empty. They do not come from asking what data is held; they come from events that happen later: using or disclosing data without consent, and turning down a data subject's request. Someone has to update them every time such an event occurs.
Section 27 paragraph three makes this explicit: a controller that uses or discloses data under a consent exemption must log it in the section 39 record. A PDPC consultation answer to an online platform about sharing merchant data with government agencies made the same point, citing section 39 (6).
Answers that make a RoPA useless
TDPG 4.0 includes a table of cautions with examples of wrong answers. A reviewer can use it as a ready-made rejection list.
Says nothing about what is actually held; TDPG lists it as an incorrect answer.
Cannot explain what the measures are, so item (8) is empty in practice.
No scope and no lawful basis; nobody can check whether use goes beyond purpose.
TDPG flags pointing to a policy without a clear period as making the record incomplete.
A number, a start point and an end state. A reviewer understands it at once.
Are small businesses really exempt from RoPA?
Only in part. Section 39 paragraph three allows an exemption, but only for some items, and with conditions that can remove it entirely.
The provisions in (1), (2), (3), (4), (5), (6) and (8) may not apply to the Data Controller who is a small organization pursuant to the rules as prescribed by the Committee, unless the collection, use, or disclosure of such Personal Data is likely to result in a risk to the rights and freedoms of data subjects, or not a business where the collection, use, or disclosure of the Personal Data is occasional, or involving in the collection, use, or disclosure of the Personal Data pursuant to section 26.
Two things stand out. First, item (7), the record of refused requests and objections, is not on the exemptible list: however small the business, a refusal must be recorded. Second, the exemption does not apply where processing is risky, is not occasional, or involves sensitive data under section 26.
The "not occasional" condition quietly removes many businesses from the exemption. An online shop taking orders every day, or a company running payroll every month, will struggle to argue its processing is occasional. A clinic holding treatment records is caught by the sensitive-data condition from day one.
PDPC answer: the condominium is exempt, the management company is not
Company S., which manages several condominiums and housing estates, asked whether a condominium juristic person counts as a non-profit organisation exempt from the record. The opinion relied on clause 3 of the PDPC notification on exempting small-business controllers, whose 2022 version listed six groups: small and medium enterprises, community enterprises, social enterprises, cooperatives, foundations and non-profit organisations, and household businesses.
หากนิติบุคคลอาคารชุดดังกล่าวไม่ได้ขายสินค้าหรือให้บริการใดกับบุคคลอื่นซึ่งมิใช่เจ้าของห้องชุดหรือผู้พักอาศัย หรือกระทำกิจการใดที่มีลักษณะเพื่อแสวงหากำไร จะมีฐานะเป็นผู้ควบคุมข้อมูลส่วนบุคคลที่เป็นองค์กรที่ไม่แสวงหากำไรIn English: a condominium juristic person that sells nothing and provides no services to anyone other than unit owners or residents, and does nothing profit-seeking, is a non-profit controller. Even then, the same opinion noted the exemption excludes risky, regular or sensitive processing. The management company itself got no exemption at all, and the reason was its role, not its size.
บริษัทฯ จึงไม่ต้องดำเนินการบันทึกรายการตามมาตรา ๓๙ ในส่วนของการบริหารอาคารชุดและหมู่บ้านจัดสรร เพราะไม่มีฐานะเป็นผู้ควบคุมข้อมูลส่วนบุคคล แต่บริษัทฯ มีหน้าที่จัดทำและเก็บรักษาบันทึกรายการของกิจกรรมการประมวลผลข้อมูลส่วนบุคคลตามมาตรา ๔๐ (๓) ในฐานะผู้ประมวลผลข้อมูลส่วนบุคคลของนิติบุคคลอาคารชุดหรือนิติบุคคลหมู่บ้านจัดสรรIn English: for its building-management work the company is not a controller, so it does not keep a section 39 record, but as the processor it must keep a record of processing activities under section 40 (3). The lesson applies to every contractor, from accounting firms to payroll bureaus to marketing agencies. Work done for clients goes into the processor record; data the firm uses for itself, such as its own staff records, still needs a controller RoPA.
Where should a RoPA project actually start?
With a data map, not a form. TDPG 4.0 item D9 splits the work into preparation and execution, and recommends bringing in a senior manager with authority from the outset, so the project carries the weight of a company instruction rather than a favour asked by the DPO.
The plan below follows the TDPG steps and is a pacing example for a mid-sized company, not a legal deadline. A business with many branches may need longer.
- Week 1Management issues an instruction forming the team and lists every department, branch and affiliate, including those that believe they hold no personal data.TDPG D9; Dos 1
- Week 2Map where data comes in, which systems hold it and who receives it. Start with HR, which holds a lot of data about many groups.TDPG D9; department example
- Week 3Send a plain-language questionnaire of six questions: why you use it, whose data, what data, shared with whom, kept how long, protected how.TDPG D9 step 1
- Week 4Hold focus sessions with IT and legal, and review existing documents such as the retention policy, processing agreements and data sharing agreements.TDPG D9 steps 2–3
- Week 5The DPO checks answers against the eight items of section 39, returns vague ones, and flags high-risk activities for a DPIA.PDPA s.39; TDPG P9
- Every 12 months or on any new systemReview the whole record, add new activities, and move discontinued ones to an archive kept for later checks.TDPG D8; Dos 4
TDPG 4.0 item D18 recommends organising the record by activity and main purpose. Activities with the same purpose can share one row: a monthly meeting that always uses the same attendee data does not need a new entry each month. This keeps the RoPA small enough that someone will actually maintain it.
Preparing a record of processing activities is not a one-time activity. The recorded data must reflect the current situation regarding personal data processing. In addition, the data controller should review the record of processing activities at least once a year
Another way RoPAs die is by scattering across files that link to one another. TDPG warns against linking to documents a reviewer cannot open, such as an internal drive, and against splitting the record into fragments where activities can fall through the gaps. The step-by-step version is in our RoPA guide.
When do you need a DPIA?
When an activity carries a high risk to the rights and freedoms of data subjects. One point first: the PDPA never names the DPIA, and TDPG 4.0 says so itself.
Although DPIA is not specifically mentioned in the Personal Data Protection Act B.E. 2562 (2019), it is considered an important process that supports compliance with the duties under the Personal Data Protection Act B.E. 2562 (2019)
TDPG therefore frames the DPIA as a tool for meeting other duties, such as section 37 (1), which requires security measures to be reviewed as technology changes, and section 39 paragraph three, where risk decides whether the small-business exemption applies. Skipping a DPIA is not an offence in itself, but it makes it much harder to show those duties were met.
Generally, if a case falls within two or more of these factors, it is considered likely to carry a high risk of impact on the rights and freedoms of individuals
| Criterion | In short | Example in a Thai business |
|---|---|---|
| Evaluation or Scoring | Profiling or scoring to predict, e.g. economic status, behaviour, location | Scoring customers to offer instalment credit |
| Automated-decision with legal effect | Automated decisions with legal or similarly significant effects | A hiring system that rejects applicants on its own |
| Systematic monitoring | Systematic observation or control of people, including in public spaces | CCTV covering an entire shopping mall |
| Sensitive data | Special categories, including criminal records | A clinic holding treatment records |
| Large scale | Volume judged by number of people, amount of data, duration and geography | A membership app used nationwide |
| Combining datasets | Merging data from different processes or controllers beyond what people expect | Matching a customer list with a partner's data |
| Vulnerable data subjects | Children, minors, employees and others in a weaker position | Software that tracks employee activity |
| Innovative use | New technology people are not familiar with | Face scanning at building entry combined with AI |
| Prevent data subjects' right or access | The outcome grants or denies a service or contract | Credit checks before setting a loan limit |
Item P10 keeps this from becoming a mechanical points system.
In some cases, even where two of the above factors apply, a DPIA is not always required if the data controller is confident that the processing in question does not create a high risk of impact on the rights and freedoms of individuals; the data controller need only record the reasons for that determination. However, if only one of the above factors applies but the data controller assesses that there is a high risk, a DPIA must still be carried out
Item P11 adds that where the law itself requires the processing, on a legal-obligation or public-task basis, no DPIA is needed. Item P17 says the DPIA should start at the design stage, before processing begins, not after the system has gone live.
How do RoPA and DPIA fit together without duplicated work?
The RoPA tells you what activities exist; the DPIA goes deep on the risky ones. If the RoPA is complete, the list of activities needing a DPIA falls out of its columns on data type, number of people and technology used.
- Add a column to every RoPA row: which P9 criteria does this activity meet?
- For rows meeting two or more, run a DPIA, or record why the risk is not high, as P10 allows.
- For rows meeting only one where the DPO still sees high risk, run a DPIA anyway.
- Use TDPG's seven-step form: identify the need, describe the processing, consult, assess necessity and proportionality, assess risk, set mitigating measures, document and plan.
- Copy the measures agreed in the DPIA back into item (8) of the RoPA so both documents say the same thing.
Our DPIA guide walks through each step. If the risky activity is marketing built on customer profiles, read our article on customer lists and cookies for the lawful-basis side, and for how to log refused requests in item (7), see answering data subject requests on time.
Frequently asked questions
Can we keep our RoPA in Excel?
Yes. Section 39 allows a written or electronic record, and TDPG 4.0 item D14 gives spreadsheets such as MS Excel as an example. Keep it as a single source that is easy to edit and access, and review it at least once a year as item D8 recommends.
Does a small online shop need a RoPA?
It may be exempt from items (1) to (6) and (8) under section 39 paragraph three, but not if processing is regular, risky or involves sensitive data. A shop taking orders daily will find the exemption hard to claim, and item (7), the record of refused requests, always applies.
Does a data processing contractor need a RoPA?
Not a section 39 RoPA for work done on a client's behalf, but it must keep a record of processing activities under section 40 (3), as the PDPC told Company S. Data the contractor uses for its own purposes, such as staff records, still needs a controller RoPA.
Is a DPIA a legal requirement?
The PDPA does not mention it. TDPG 4.0 item P4 presents it as a process that helps meet duties under sections 30, 37, 39 and 40, so it is recommended practice rather than a stand-alone obligation. Without one, though, it is hard to show that a high-risk activity has appropriate safeguards.
How often should a RoPA be reviewed?
The Act sets no cycle. TDPG 4.0 item D8 recommends at least once a year, and whenever there is a new activity, a change of purpose, scope, data type or recipient, a new processor or sub-processor, or a new system.
Law and sources
- Personal Data Protection Act B.E. 2562 (2019) — Section 27, para. 3 · Section 37 (1) · Section 39 · Section 40 (3)
- TDPG 4.0 (Thailand Data Protection Guidelines) — guidance, not law — D8–D18 · Clause · P4 · P9–P11 · P17
- PDPC Office: summaries of consultation answers under the PDPA
Text in the "The text" boxes is copied word for word from AIPDPA's legal knowledge base, transcribed from the Royal Gazette and official documents; every edit is checked by the system against that base, character by character. English wording is an unofficial translation; the Thai text prevails. This article is general information, not legal advice for a particular case.
Do it in the system
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)