PDPA in practice articles
PDPA in practice articles are 17 AIPDPA pieces that quote Thai law word for word and say what organisations must do. They suit DPOs, legal teams and business owners, who get answers with the legal text and links to read further.
PDPA in practice · page 1 of 2
PDPA in practiceCCTV already installed? Secure it in seven steps this week
NCSA's guideline gives seven starter steps for owners who have cameras but have not secured them. Here they become a day-by-day plan: who does what, a rough time estimate, and which parts are advice and which are PDPA duties.
PDPA in practiceCCTV Signs, Privacy Notices and Footage Requests
The sign at the door says who is recording and why. A request to see footage needs a process, not just a sign. This article walks through both, following the NCSA guideline and PDPA.
PDPA in practiceHow Many Days of CCTV Footage to Keep, and How Much Disk It Takes
The NCSA guideline gives no fixed retention figure, but it does give a storage formula. This article joins the two so you can decide before you buy a recorder.
PDPA in practiceAccess, Erasure, Objection: Answering Data Subject Requests on Time Under Thailand's PDPA
Each kind of PDPA request runs on its own clock: 30 days for a copy, 90 days for erasure, immediately for an objection to marketing. This article sets out the deadlines from the legal texts, how to verify the requester, when you may refuse, and a step-by-step playbook from intake to close.
PDPA in practiceCCTV in offices, shops and condos: what the PDPA expects
The duty to inform under Section 23 starts when the camera starts recording. What a sign needs to say, how long to keep footage, who may watch it, and what to check before handing it to police or a customer.
PDPA in practiceChildren's Data in Thailand: Whose Consent Counts, the Child's or the Parent's?
Section 20 of the PDPA says who consents for a child. But the first question is whether you need consent at all, and the PDPC Office has already answered both questions for a bank and for the education sector.
PDPA in practiceData Mapping in One Week: From Nothing to Your First RoPA
Most companies do not get stuck on the RoPA template. They get stuck because nobody knows where the data goes. This plan splits the work by day so each team maps its own data, then turns the map into a section 39 record within a week.
PDPA in practiceMarketing to Existing Customers in Thailand: When You Need Consent, and When You Don't
Your marketing team has a customer list, a LINE Official Account and an ad pixel on the website. Before every send, someone asks whether consent is needed. This article lines up PDPA sections 19, 24 and 32 with the TDPG 4.0 guidelines and a published PDPC consultation answer to show where the line actually falls.
PDPA in practicePDPA for Small Shops and SMEs: The First 10 Steps
A notebook of delivery customers, a LINE group of regulars, a camera over the till, files on three staff. A small shop holds every kind of personal data a big company does. The good news: most of the work is done once, if you know where to start.
PDPA in practiceHow to Write a Privacy Notice People Actually Read
Most privacy notices run to ten pages, are copied from a template, and nobody finishes them. Thai law does not ask for that. Section 23 requires six things; the rest is writing.
PDPA in practiceData Processing Agreements: The Clauses You Cannot Leave Out
Your payroll bureau, cloud CRM and email agency are all data processors, and Thailand's PDPA requires an agreement with every one of them. Yet most service contracts say nothing about personal data at all.
PDPA in practiceA Retention Schedule an Auditor Will Accept
“We keep personal data only as long as necessary” cannot be audited. An auditor wants a table that shows, row by row, how long each dataset is kept, when the clock starts, which law justifies it, and who deletes it at the end.
Topic index
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)