PDPA Compliance Audit & Gap Assessment

Legal Basis

Personal Data Protection Act B.E. 2562 §§37–42, PDPC Security Measures Notification 2022, and PDPC guidelines — assessment across 12 domains: lawful basis, ROPA, notice, consent, DSR, breach, DPO, DPIA, retention, cross-border, vendor, and security controls.

Who Needs This

SMEs handling customer/employee data, ecommerce, clinics, hospitals, schools, HR outsourcers, and MNCs aligning PDPA with GDPR/APPI.

Required Documents

• Organisation chart with headcount
• IT systems processing personal data (CRM, HRIS, POS)
• Current Privacy Notice / Consent forms
• Vendor list receiving or transmitting data (payment, cloud, HR)
• Incident / complaint log for the past 2 years

Common Pitfalls

• Copy-paste consent templates that ignore the correct lawful basis — invalidates consent
• Overlooking cross-border transfers to foreign SaaS (Google Workspace, AWS US)
• ROPA not updated when new vendors are added

Typical Use-cases

• 50-branch aesthetic clinic auditing ahead of PDPC inspection
• Fintech startup evidencing PDPA for Series-A due diligence
• International school aligning PDPA with GDPR for EU parents

FAQ

Do small SMEs need a DPO?

Only if the core activity involves large-scale processing of sensitive data (§41) — e.g. clinics, hospitals, HR outsourcers.

What is the maximum penalty?

Administrative fine up to THB 5m (§83), criminal fine up to THB 1m + 1 year imprisonment (§79), plus 2× punitive damages (§78).

Do we need consent for CCTV?

No — legitimate interest applies (§24(5)); post visible notices and cap retention at 30 days.

Other Legal Services