PDPA Privacy Notice & Consent Drafting
ร่าง Privacy Notice และ Consent ตาม PDPA · § Instrument
What to know before you act
A privacy notice must tell people what you collect, why, on which lawful basis, who receives it, how long you keep it and how to exercise their rights. Consent is only for cases with no other basis, and must be separate and easy to withdraw. We draft notices per audience (customers, staff, applicants, CCTV) and consent wording that works in practice.
Timing and external dependencies: A basic notice set is usually ready within a few weeks once we have your real data uses.
Official fee: No government fee, but missing notices or invalid consent can bring administrative fines — check the latest PDPC guidance.
Timing is not a promise of an outcome or hearing date. Check the notice, limitation period and current authority rules for your matter.
What to send for the first review
Send every relevant page, a dated sequence of events, any hearing or filing deadline, and the outcome you need. This lets counsel identify urgent steps, missing evidence and a precise scope of work.
- Data inventory of fields collected
- Purpose of use and retention
- Third parties receiving the data
Legal Basis
PDPA §23 (purpose notice) §19 (consent) and PDPC Consent Guideline 2022 — must specify lawful basis, retention, and the 8 data-subject rights.
📚 Official sources — check the current law and procedure before acting
- สำนักงานคณะกรรมการคุ้มครองข้อมูลส่วนบุคคล (สคส.)— PDPC Thailand
- สำนักงานคณะกรรมการกฤษฎีกา — ตัวบทกฎหมายฉบับทางการ— Office of the Council of State
Who Needs This
Ecommerce sites, mobile apps, clinics, hotels, HR onboarding, and event organisers collecting attendee data.
Required Documents
- Data inventory of fields collected
- Purpose of use and retention
- Third parties receiving the data
- Cookies used on the website (analytics, ads, functional)
Common Pitfalls
- Copying another website's notice that does not match your actual data
- Bundling marketing consent into mandatory terms checkboxes
- Forgetting notices for CCTV and employees
Typical Use-cases
- Delivery app enabling driver-location consent
- Hotel scanning passports needs a Hotel-Act lawful basis
- B2B SaaS providing a DPA to EU customers
FAQ
- Do we need consent every time we collect data?
- No. Many uses rely on contract, legal obligation or legitimate interest; consent is for when no other basis applies.
- Should the notice be in English?
- It should be in a language the data subject understands; businesses with foreign customers should be bilingual.
- How is sensitive data such as health different?
- It needs explicit consent unless a legal exception applies, plus stronger security measures.
Other Legal Services
Request a quote — Call 083-2494999 · LINE @NYC168 · contact@nyclegal.co.th
Knowledge bases behind every service
3,307 answered questions written by our lawyers and translators, grouped by service. Free to read, no sign-up.
- Master Service Hub — every service we file
The cross-service index: certified translation, interpreting, visa/work permit/BOI, tax-legal-estate, cross-border M&A, aviation & maritime, and holding-company structuring.
649 answered questions
- Certified translation — every language
Certified translation across civil, academic, corporate, contractual, financial, medical, technical and IP documents — with the Notary → MFA → embassy legalization chain handled end to end.
500 answered questions
- Thai MFA consular legalization
Thai MFA legalization workflow: fees, turnaround, inbound foreign documents, and how the chain connects to destination-country apostille requirements.
500 answered questions
Official sources — legal services
The information on this page follows the official sources below. Always check the latest version before you file.
- Office of the Judiciary— Office of the Judiciary
- Ministry of Justice— Ministry of Justice
- Lawyers Council of Thailand — Notarial Services Attorneys— Lawyers Council of Thailand
- Office of the Council of State — Thai law database— Office of the Council of State
- Royal Thai Government Gazette— Royal Thai Government Gazette
Related services
Most document work runs across several steps — jump straight to the next one you need.
Contact us by phone, LINE or email for a free initial enquiry and a quote after document review. Timing depends on the work and relevant authorities.
General information before proceeding: Confirm current requirements with the receiving authority before using your documents. This page is not a legal opinion for your individual case — meet the team · editorial policy
Not sure which service you need? Read the guides
Each guide answers first, then explains: decision criteria, comparison tables, the real process and the mistakes we see most often.
- Choosing a certified translation provider
How to pick a translator accepted by consular, embassy and receiving bodies
- Services for expats living in Thailand
Signature certification, residence, marriage and everyday paperwork
- Notary Public and consular legalization
The correct order of steps before sending documents abroad
- Choosing the right visa and work permit
Compare visa categories and the documents each one needs translated
- Translation by language
English, Chinese, Japanese, European, Arabic, Russian and embassy rules
- Specialized translation
Contracts, financial statements, MSDS, ISO and BOI filings
Talk to us first: 083-2494999 · LINE @NYC168 · contact@nyclegal.co.th
Frequently asked questions
- Can a foreigner own 100% of a Thai company?
- Full foreign ownership is possible for some activities, but there is no blanket permission. Check the Foreign Business Act definition, actual activities, sector-specific restrictions and any required licence or certificate. BOI promotion and treaty rights apply only within their approved scope; they do not automatically confer land rights, visas or work permits. Do not use nominee shareholders. Verify the proposed structure with DBD.
- What is the minimum registered capital for a Thai company?
- Do not apply one capital figure to every incorporation, foreign-business licence, visa or work-permit application. Registered capital and paid-up capital are different, and the applicable requirements depend on actual activities, ownership, permit category and any BOI or treaty conditions. Capital is a company funding requirement, not our service fee. Confirm the relevant criteria with DBD, the Department of Employment and Immigration before choosing the structure. Ask our team for a quotation for the agreed work.
- How long does company registration take?
- Separate document preparation, name reservation, signatures and DBD review from VAT registration, Social Security and bank onboarding. Timing depends on the filing channel, complete documents and any requests for corrections or additional evidence; no completion date is guaranteed. Ask our team for a quotation and a planning estimate after the proposed structure and documents have been reviewed.
- What ongoing accounting obligations does a Thai company have?
- A Thai limited company keeps statutory books and prepares audited annual statements even without trading. Tax returns depend on its payments, VAT status, accounting period and taxpayer category: PND1, PND3 and PND53 are not universal monthly returns for every company, and PP30 applies to VAT-registered businesses, including nil-return months while registration remains active. Check PND50, PND51 and each filing deadline with RD; check annual statements and shareholder filings separately with DBD.