PDPA Privacy Notice & Consent Drafting
ร่าง Privacy Notice และ Consent ตาม PDPA · § Instrument
Quick Answer
Privacy Notice + Cookie Notice + Consent form bundle (TH/EN) from THB 25,000 — segmented by data-subject persona (customer, employee, supplier, marketing lead) with a granular-consent cookie banner script.
Timeline: Questionnaire 2 days · Draft 5 days · Revision 3 days — 7–10 days total.
Official fee: No official fee.
Legal Basis
PDPA §23 (purpose notice) §19 (consent) and PDPC Consent Guideline 2022 — must specify lawful basis, retention, and the 8 data-subject rights.
Who Needs This
Ecommerce sites, mobile apps, clinics, hotels, HR onboarding, and event organisers collecting attendee data.
Required Documents
- Data inventory of fields collected
- Purpose of use and retention
- Third parties receiving the data
- Cookies used on the website (analytics, ads, functional)
Common Pitfalls
- Single blanket consent covering all purposes — violates the granularity principle
- Marketing consent not separated from service consent
- Missing English version for foreign customers
Typical Use-cases
- Delivery app enabling driver-location consent
- Hotel scanning passports needs a Hotel-Act lawful basis
- B2B SaaS providing a DPA to EU customers
FAQ
- Does the cookie banner need a reject-all button?
- Yes — PDPC 2023 guidance requires equal prominence for accept and reject.
- Consent for children under 10?
- Must be obtained from the legal guardian under §20 with identity verification.
- How often to update the Privacy Notice?
- At least annually or whenever a material processing activity changes.
Other Legal Services
Request a quote — Call 083-249-4999 · LINE @NYC168 · contact@ilc.ltd






