DPO Appointment Service (PDPA & GDPR) â Thailand (PDPA) ðđð
PDPA B.E. 2562 · Personal Data Protection Committee (PDPC)
Thailand (PDPA) is regulated by Personal Data Protection Committee (PDPC) under PDPA B.E. 2562 â breach notification within 72 hours.
Partner network â Bird & Bird, OneTrust, BSI, DNV â for ISO certification, cross-border SCC, EU representative service.
Thailand (PDPA) legal regime: PDPA B.E. 2562 â enforced by Personal Data Protection Committee (PDPC) with max fines of 5,000,000 THB + 1% turnover. PDPA Section 37 requires PDPC notification within 72 hours â criminal liability for unlawful disclosure.
Breach notification: 72 hours â 24/7 incident hotline available.
End-to-end: DPO Appointment Service (PDPA & GDPR) â mapping â control implementation â Personal Data Protection Committee (PDPC) registration (where applicable) â ongoing audit.
GDPR fine avoidance â 0 enforcement actions in 4 years (n=42 EU-facing clients) via proactive DPIA + SCC + Art. 27 representative.
Coverage
How it works
- 1
Map PDPA B.E. 2562
Compliance plan aligned with Personal Data Protection Committee (PDPC).
- 2
Prepare DPO Appointment Service (PDPA & GDPR)
7-14 working days at 35,000-120,000 āļāļēāļ/āđāļāļ·āļāļ.
- 3
Transfer mechanism
SCC + BCR + TIA + adequacy assessment as required.
- 4
Local representative
Local DPO or representative per destination law.
- 5
DPA registration
Notification/filing with Personal Data Protection Committee (PDPC) where required.
- 6
Ongoing monitoring
Quarterly review + annual audit + breach drill + DSAR queue monitoring.
Frequently asked questions
Which law applies in Thailand (PDPA)?
PDPA B.E. 2562
Supervisory authority?
Personal Data Protection Committee (PDPC)
Maximum fine?
5,000,000 THB + 1% turnover
Breach window?
Within 72 hours.
Market-specific caution?
PDPA Section 37 requires PDPC notification within 72 hours â criminal liability for unlawful disclosure.
Local representative required?
Depends on scope of processing.
Cross-border transfer requirements?
SCC + TIA + (for CN/RU) data localisation + government security assessment.