PDPA in practice articles
PDPA in practice articles are 17 AIPDPA pieces that quote Thai law word for word and say what organisations must do. They suit DPOs, legal teams and business owners, who get answers with the legal text and links to read further.
PDPA in practice · page 2 of 2
PDPA in practiceFinishing a RoPA That Works, and Knowing When You Need a DPIA
Many Thai companies start a record of processing activities (RoPA) and stall at a half-filled spreadsheet. This article sets out what section 39 of the PDPA actually requires, who can be exempt, how the TDPG 4.0 guidelines suggest doing the work, and which activities should go on to a data protection impact assessment (DPIA).
PDPA in practiceThe Sensitive Data Your Company Holds Without Knowing It
Doctor's notes, the food-allergy box on an event form, the fingerprint scanner by the lifts: all section 26 data that cannot be collected without explicit consent or an exception, and each one drags other duties along with it.
PDPA in practiceYou don't need consent for everything: pick the right PDPA basis
Many Thai companies add an 'I consent' box to every form because it feels safest. TDPG 4.0 says plainly that consent is a high-risk basis, and in HR it often does not work at all.
PDPA in practiceBefore You Sign a Vendor That Touches Customer Data: What to Check
The contract a vendor sends you is written to protect the vendor. Here is what Thailand's PDPA section 40 and two 2022 PDPC notifications require that contract to contain, and what to ask before anyone signs.
PDPA in practiceWhich Thai Companies Must Appoint a DPO? The 2023 Test
Thai law does not make every company appoint a DPO. But the PDPC's 2023 notification draws the line more sharply than most people realise, with a 100,000-person threshold and a list of businesses that qualify automatically.
Topic index
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)