Q1083. What compliance rules govern corporate privacy policy (PDPA/GDPR) translations?

Answered by the NYC Visa & Translation certified translation team

Thailand's Personal Data Protection Act (PDPA) applies to Thai operations of multinationals, and the privacy documentation must exist in Thai for Thai data subjects — a privacy policy only in English does not satisfy the notification obligation for Thai individuals. The compliance translation rules: the Thai privacy notice must be a faithful, complete rendering of the data-processing practices — not a summary — covering the collection purposes, legal bases, retention periods, third-party disclosures, cross-border transfers, and data-subject rights with the contact channel for exercising them; where the group policy is drafted for GDPR, the Thai version must be adapted, not just translated, because the PDPA's requirements differ in detail (the PDPA has its own consent and cross-border transfer rules, and the Thai regulator's guidance uses specific Thai terminology — the Personal Data Protection Committee's published Thai terms should be followed); and consent forms, cookie notices, and data-subject request forms each need their own Thai versions. Practice points: maintain the Thai and English versions under version control with a record of which version was shown to which data subjects — this matters in complaints; where the group updates the global policy, the Thai version must be updated in step; and for employee privacy notices, Thai labour practice expects Thai-language notification. Caution: a Thai translation that softens or omits disclosures present in the English original creates regulatory exposure — the PDPA Committee assesses the Thai text shown to Thai data subjects. Confirm current PDPA Committee guidance when preparing the Thai versions.