PDPA Compliance Audit & Gap Assessment
ตรวจสอบความพร้อม PDPA (Compliance Audit) · § Advisory
What to know before you act
A PDPA audit maps what personal data you collect, from whom, why, who receives it and how long you keep it, then tests that against lawful bases, privacy notices, records of processing, processor agreements and security measures. You get a gap list ranked by risk with a remediation plan.
Timing and external dependencies: Depends on the number of departments and systems; small companies may finish in a few weeks, multi-site organisations take longer.
Official fee: No government fee for an audit, but breaches can attract administrative fines under the PDPA — check the latest PDPC notifications.
Timing is not a promise of an outcome or hearing date. Check the notice, limitation period and current authority rules for your matter.
What to send for the first review
Send every relevant page, a dated sequence of events, any hearing or filing deadline, and the outcome you need. This lets counsel identify urgent steps, missing evidence and a precise scope of work.
- Organisation chart with headcount
- IT systems processing personal data (CRM, HRIS, POS)
- Current Privacy Notice / Consent forms
Legal Basis
Personal Data Protection Act B.E. 2562 §§37–42, PDPC Security Measures Notification 2022, and PDPC guidelines — assessment across 12 domains: lawful basis, ROPA, notice, consent, DSR, breach, DPO, DPIA, retention, cross-border, vendor, and security controls.
📚 Official sources — check the current law and procedure before acting
- สำนักงานคณะกรรมการคุ้มครองข้อมูลส่วนบุคคล (สคส.)— PDPC Thailand
- สภาวิชาชีพบัญชี— Federation of Accounting Professions
- สำนักงานคณะกรรมการกฤษฎีกา — ตัวบทกฎหมายฉบับทางการ— Office of the Council of State
Who Needs This
SMEs handling customer/employee data, ecommerce, clinics, hospitals, schools, HR outsourcers, and MNCs aligning PDPA with GDPR/APPI.
Required Documents
- Organisation chart with headcount
- IT systems processing personal data (CRM, HRIS, POS)
- Current Privacy Notice / Consent forms
- Vendor list receiving or transmitting data (payment, cloud, HR)
- Incident / complaint log for the past 2 years
Common Pitfalls
- Relying on consent for everything when contract or legal obligation is the proper basis
- Sending data to overseas cloud or parent companies without cross-border transfer safeguards
- No procedure to notify a data breach within the statutory deadline
Typical Use-cases
- 50-branch aesthetic clinic auditing ahead of PDPC inspection
- Fintech startup evidencing PDPA for Series-A due diligence
- International school aligning PDPA with GDPR for EU parents
FAQ
- Does a small company need PDPA compliance?
- Yes, if it handles customer, staff or partner data. Some relief exists for small businesses, but core duties like notice and security still apply.
- Do we need a DPO?
- It depends on the processing, e.g. large-scale monitoring or sensitive data. We assess whether you meet the threshold.
- What do we receive?
- A gap report, data map, draft privacy notices and a list of documents still to prepare.
Other Legal Services
Request a quote — Call 083-2494999 · LINE @NYC168 · contact@nyclegal.co.th
Knowledge bases behind every service
3,307 answered questions written by our lawyers and translators, grouped by service. Free to read, no sign-up.
- Master Service Hub — every service we file
The cross-service index: certified translation, interpreting, visa/work permit/BOI, tax-legal-estate, cross-border M&A, aviation & maritime, and holding-company structuring.
649 answered questions
- Certified translation — every language
Certified translation across civil, academic, corporate, contractual, financial, medical, technical and IP documents — with the Notary → MFA → embassy legalization chain handled end to end.
500 answered questions
- Thai MFA consular legalization
Thai MFA legalization workflow: fees, turnaround, inbound foreign documents, and how the chain connects to destination-country apostille requirements.
500 answered questions
Official sources — legal services
The information on this page follows the official sources below. Always check the latest version before you file.
- Office of the Judiciary— Office of the Judiciary
- Ministry of Justice— Ministry of Justice
- Lawyers Council of Thailand — Notarial Services Attorneys— Lawyers Council of Thailand
- Office of the Council of State — Thai law database— Office of the Council of State
- Royal Thai Government Gazette— Royal Thai Government Gazette
Related services
Most document work runs across several steps — jump straight to the next one you need.
Contact us by phone, LINE or email for a free initial enquiry and a quote after document review. Timing depends on the work and relevant authorities.
General information before proceeding: Confirm current requirements with the receiving authority before using your documents. This page is not a legal opinion for your individual case — meet the team · editorial policy
Not sure which service you need? Read the guides
Each guide answers first, then explains: decision criteria, comparison tables, the real process and the mistakes we see most often.
- Choosing a certified translation provider
How to pick a translator accepted by consular, embassy and receiving bodies
- Services for expats living in Thailand
Signature certification, residence, marriage and everyday paperwork
- Notary Public and consular legalization
The correct order of steps before sending documents abroad
- Choosing the right visa and work permit
Compare visa categories and the documents each one needs translated
- Translation by language
English, Chinese, Japanese, European, Arabic, Russian and embassy rules
- Specialized translation
Contracts, financial statements, MSDS, ISO and BOI filings
Talk to us first: 083-2494999 · LINE @NYC168 · contact@nyclegal.co.th
Frequently asked questions
- Can a foreigner own 100% of a Thai company?
- Full foreign ownership is possible for some activities, but there is no blanket permission. Check the Foreign Business Act definition, actual activities, sector-specific restrictions and any required licence or certificate. BOI promotion and treaty rights apply only within their approved scope; they do not automatically confer land rights, visas or work permits. Do not use nominee shareholders. Verify the proposed structure with DBD.
- What is the minimum registered capital for a Thai company?
- Do not apply one capital figure to every incorporation, foreign-business licence, visa or work-permit application. Registered capital and paid-up capital are different, and the applicable requirements depend on actual activities, ownership, permit category and any BOI or treaty conditions. Capital is a company funding requirement, not our service fee. Confirm the relevant criteria with DBD, the Department of Employment and Immigration before choosing the structure. Ask our team for a quotation for the agreed work.
- How long does company registration take?
- Separate document preparation, name reservation, signatures and DBD review from VAT registration, Social Security and bank onboarding. Timing depends on the filing channel, complete documents and any requests for corrections or additional evidence; no completion date is guaranteed. Ask our team for a quotation and a planning estimate after the proposed structure and documents have been reviewed.
- What ongoing accounting obligations does a Thai company have?
- A Thai limited company keeps statutory books and prepares audited annual statements even without trading. Tax returns depend on its payments, VAT status, accounting period and taxpayer category: PND1, PND3 and PND53 are not universal monthly returns for every company, and PP30 applies to VAT-registered businesses, including nil-return months while registration remains active. Check PND50, PND51 and each filing deadline with RD; check annual statements and shareholder filings separately with DBD.