Cookie Consent + Consent Management Platform
ePrivacy Directive + GDPR + PDPA · For EU-visitor websites · AdTech compliance · Google Ads/Analytics 4
NYC Legal's Data Protection team has delivered 500+ Cookie Consent + Consent Management Platform engagements across PDPA, GDPR, CCPA, PIPA, APPI and ISO/IEC 27701.
Partner network — Bird & Bird, OneTrust, BSI, DNV — for ISO certification, cross-border SCC, EU representative service.
Cookie Consent + Consent Management Platform takes 7-21 working days at 35,000-145,000 บาท — includes gap analysis + drafting + implementation + training + ongoing support.
We coordinate with PDPC Thailand, EDPB and destination DPAs across Schrems II adequacy jurisdictions.
Privacy program coverage: PDPA Pack · GDPR Pack · CCPA · DPO · DPIA · ROPA · SCC/BCR · Breach · CMP · DSAR · Privacy Policy · ISO/IEC 27701.
95% DSAR backlog reduction — automated DSAR portal + 30-day SLA + audit trail.
Coverage
How it works
- 1
Data discovery + mapping
System audit + data-owner interviews + identification of processing activities + data-flow diagram.
- 2
Gap analysis + risk
Map against PDPA/GDPR/CCPA + risk register + DPIA for high-risk processing.
- 3
Drafting + controls
Draft policies + procedures + DPA + consent + security controls per NIST SP 800-53 / ISO 27001.
- 4
Implementation + training
Roll out CMP/DSAR portal + train DPO + staff awareness + privacy-by-design checklist.
- 5
Audit + ongoing support
Annual audit + monthly DPO report + breach drills + ROPA refresh + DPA inspection prep.
Frequently asked questions
Who needs Cookie Consent + Consent Management Platform?
EU-visitor websites, AdTech compliance, Google Ads/Analytics 4 and any organisation processing personal data.
Total cost?
35,000-145,000 บาท, scaling with size and number of processing activities.
Timeline?
7-21 working days — faster if ISO 27001 baseline exists.
Is a DPO mandatory?
PDPA Sec. 41 mandates DPOs for public authorities, large processors, and sensitive data — GDPR Art. 37 mirrors the trigger.
Can we notify PDPC within 72 hours?
Triage likelihood + severity within 24h → notify decision within 72h — Tier-1 incident runbook included.
What is required for cross-border transfers?
PDPA Sec. 28: SCC, BCR, adequacy, consent, or derogation — we draft SCC + TIA.
DSAR SLA?
GDPR 30 days (extend 60) · PDPA 30 days · CCPA 45 days (extend 90) — DSAR portal tracks all.
Does ISO 27701 require ISO 27001?
Yes — 27701 is an extension of 27001 (combined implementation 9-12 months).