How to Build a Record of Processing Activities (RoPA) under Section 39 A Record of Processing Activities (RoPA) is the register that Section 39 of the Personal Data Protection Act B.E. 2562 (2019) requires every data controller to keep, so that data subjects and the Office of the Personal Data Protection Committee (PDPC Office) can inspect it. It must cover at least 8 items, including the data collected, the purposes, the retention period and a description of security measures, and it may be kept on paper or electronically.
The owner of a mid-sized auto-parts factory gets a questionnaire from an overseas customer asking for its record of processing activities within two weeks. HR, sales and IT each keep their own spreadsheet, and nobody can say how long job applicants' data is kept or who can see it.
What you need to know
The 5 points that matter most, drawn from the law and guidance cited at the end of this guide. Read just this part and you can decide your next move.
- Section 39 requires data controllers to record at least 8 items that data subjects and the PDPC Office can inspect.
- The record may be kept on paper or in an electronic system, as long as every item is there and it can be inspected.
- Refused data subject requests and objections must be logged with reasons in the RoPA (Section 39(7)).
- Small businesses may be exempt from some items, but not if their processing is risky, more than occasional, or involves sensitive data under Section 26.
- The TDPG 4.0 guidelines recommend building the RoPA department by department so no activity is missed.
How to do it in 6 steps
Work through these 6 steps in order. Each one is written so a team in a Thai organisation can act on it without waiting for a consultant, and keep the evidence an auditor will ask for.
- Map processing by departmentGo through each function, such as HR, sales, marketing, finance and IT, as TDPG 4.0 recommends, and list every task that touches personal data. Merely storing data already counts as processing.
- Record the data and the purposesNote the categories of personal data collected and the purpose of each category (Section 39(1) and (2)). A good practice is to record the lawful basis under Section 24 or 26 next to each purpose.
- Add controller details and retentionRecord details of the data controller and the retention period for each activity (Section 39(3) and (4)), and link them to the deletion checks that Section 37(3) requires.
- Define access and disclosuresRecord the rights and methods of access, the conditions on who may access the data (Section 39(5)), and any use or disclosure under Section 27 paragraph three (Section 39(6)).
- Describe security measuresSummarise the Section 37(1) security measures that protect each activity, such as access control, encryption and backups (Section 39(8)).
- Log refusals and keep it currentAdd a place to log refused requests and objections with reasons (Section 39(7)), and review the RoPA whenever a new system or activity starts.
What must a RoPA contain under Section 39?
Section 39 requires a data controller to record at least the following 8 items so that data subjects and the PDPC Office can inspect them. The record may be written or electronic.
- (1) The personal data collected
- (2) The purpose of collecting each category of data
- (3) Information about the data controller
- (4) The retention period
- (5) Rights and methods of access, including conditions on who may access the data
- (6) Uses or disclosures under Section 27 paragraph three
- (7) Refused requests or objections under Sections 30, 31, 32 and 36
- (8) A description of security measures under Section 37(1)
Do small businesses need a RoPA?
Usually yes, though some items may be waived. Section 39 paragraph three allows small businesses that meet criteria set by the Personal Data Protection Committee to be exempted from items (1) to (6) and (8), and the Committee issued a notification on this exemption in 2022 (B.E. 2565).
The exemption never covers item (7), refused requests. It also does not apply where the processing risks affecting data subjects' rights and freedoms, where processing is more than occasional, or where Section 26 sensitive data is involved, so check the notification's criteria before relying on it.
Why does a RoPA matter beyond the audit file?
According to the TDPG 4.0 guidelines, an organisation that cannot identify all of its processing activities risks processing data unlawfully and may fail to put adequate technical and organisational measures in place.
TDPG 4.0 also notes that a RoPA supports data governance and better business processes, because the organisation knows what personal data it holds, why it holds it and for how long.
Common problems and how to fix them
Most organisations slip on the same 3 points. The table shows how to fix each one yourself, and how AIPDPA gets it done faster with the evidence in place.
| Problem | Fix |
|---|---|
| ✗ The RoPA was written once at project kickoff and never updated. | ✓ Set a review cycle and ask each department to flag new systems or activities. In AIPDPA, the RoPA register auto-fills from your org structure, so adding a department or activity is a single edit and the Section 39 report reprints instantly. |
| ✗ Retention is left blank or set to 'forever'. | ✓ Set a real retention period for each activity and a check that deletes or destroys data when it expires, as Section 37(3) requires. AIPDPA's retention module keeps retention rules, review schedules and disposal logs: the evidence an auditor asks for. |
| ✗ There is nowhere to log refused requests. | ✓ Add a refusal log with reasons for Section 39(7). AIPDPA's DSR portal keeps a log of every request, so the reason behind each refusal can be traced and recorded. |
Start a Section 39 RoPA with all 8 items in minutes
AIPDPA's RoPA register auto-fills from your org structure, offers a lawful-basis picker that cites Sections 24 and 26, and prints a Section 39 report on demand. See the demo account, no sign-up needed.
Included in every plan, from 2,900 THB/year · demo account, no sign-up
Frequently asked questions
The questions people search for most on this topic. Each answer is short, direct and stands on its own.
Can we keep our RoPA in Excel?
Yes. Section 39 allows the record to be kept in writing or in an electronic system. What matters is that all 8 items are covered and the record is ready for data subjects and the PDPC Office to inspect.
Do we have to submit our RoPA to the PDPC Office every year?
Section 39 requires controllers to keep the record so that it can be inspected; the section does not say it must be filed on a schedule. You should be able to produce it whenever a data subject or the PDPC Office asks.
Do data processors need a RoPA too?
Yes. TDPG 4.0 explains that data processors must keep their own records under a 2022 PDPC notification for processors, with a separate record for each category of activity carried out on behalf of a controller.
Does data we only store, and never use, belong in the RoPA?
Yes. TDPG 4.0 explains that processing starts when an organisation first collects or records data and continues until the data is securely destroyed, and that simply holding personal data counts as processing.
Does a data controller's representative in Thailand need a RoPA?
Yes. Section 39 paragraph two applies the record-keeping duty to the representative of a controller under Section 5 paragraph two, and Section 37(5) requires that representative to be located in Thailand.
Sources
This guide relies on 3 sources. Statutes are cited by section or clause; guidelines and standards are guidance, not law.
- Personal Data Protection Act B.E. 2562 (2019), Section 39
- Personal Data Protection Act B.E. 2562 (2019), Section 37(1), (3) and (5)
- Thailand Data Protection Guidelines 4.0 (TDPG 4.0), paras A24–A37 (guidance, not law)
The law cited here comes from AIPDPA's legal knowledge base, transcribed from the Royal Gazette · This is general information; if your situation has unusual facts, our lawyers can review it with you.
Tools and services that help right now
Want to do it yourself, faster? Use the tools in AIPDPA. Want a lawyer to handle it, or to learn the skill yourself? Pick the service in our network that fits.
The register fills itself from your org chart, picks the lawful basis with its section, and prints a Section 39 report in one click.
Join the waitlist →Retention rules, review schedules and disposal logs — the Section 37(3) evidence auditors always ask for.
Join the waitlist →A lawyer-led team checks your readiness and sets up PDPA end to end — ideal for SMEs without the time.
See the service →Courses to build PDPA, DPO and AI-governance skills, plus ready-to-use digital toolkits.
See courses & products →
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)
Keep reading
Guides that usually come next after this one. Read them in the order your organisation needs.