Outsourced Data Protection Officer (DPO)

Legal Basis

PDPA §§41–42 and PDPC DPO Notification 2022 — the DPO must be independent, report to top management, and act as the contact point with the PDPC.

Who Needs This

Organisations processing large-scale sensitive data (clinics, hospitals, financial institutions, HR outsourcers) or performing systematic monitoring (insurance, logistics).

Required Documents

• DPO appointment letter
• Job description and contact channels
• Reporting line

Common Pitfalls

• Appointing HR or IT manager as DPO — breaches independence (§42(2))
• No data-subject hotline — DSRs slip through the cracks
• PDPC not notified when the DPO changes

Typical Use-cases

• Private hospital without an in-house legal team
• MNC with a Group DPO needing a local liaison
• Pre-Series-B startup evidencing a DPO for VC due diligence

FAQ

Must the DPO reside in Thailand?

Not required, but a Thailand-based representative must be reachable during business hours (§5).

Can one DPO cover multiple companies?

Yes per PDPC guidance — provided there is no conflict of interest and workload is manageable.

Do we notify customers when the DPO changes?

Best practice is to update the Privacy Notice within 30 days.

Other Legal Services