# Thailand PDPA Compliance Assessment Record

## Organisation Details

| Field | Value |
|-------|-------|
| Organisation Name | Zenith Global Logistics (Thailand) Co., Ltd |
| Tax ID | 0105562012345 |
| Address | 18F, Sathorn Square, 98 North Sathorn Road, Silom, Bangrak, Bangkok 10500 |
| Assessment Date | 14 March 2026 |
| DPO | Siriporn Chaiyaporn, Compliance Manager |

## Processing Activity Register

| Activity ID | Description | Lawful Basis | Sensitive Data | Cross-Border |
|------------|-------------|-------------|----------------|-------------|
| PAR-TH-001 | Customer freight services | Contract (S.24(3)) | No | Yes — EU HQ |
| PAR-TH-002 | Employee HR management | Contract (S.24(3)) + Legal (S.24(6)) | Health data (S.26) | Yes — Regional HR |
| PAR-TH-003 | Marketing communications | Consent (S.19) | No | No |
| PAR-TH-004 | Customs clearance | Legal obligation (S.24(6)) | No | Yes — International authorities |

## Cross-Border Transfer Register

| Transfer ID | Destination | Mechanism | Notification | Status |
|------------|-------------|-----------|-------------|--------|
| CBT-TH-001 | Germany (EU HQ) | Consent with disclosure (S.28(4)(b)) | Consent form provided | Active |
| CBT-TH-002 | Singapore (HR hub) | Consent with disclosure (S.28(4)(b)) | Employee consent collected | Active |
| CBT-TH-003 | Japan (APAC ops) | Contract necessity (S.28(4)(a)) | Privacy notice updated | Active |

## Data Subject Rights Log

| Request ID | Date | Type | Deadline | Status |
|-----------|------|------|----------|--------|
| DSR-TH-2026-001 | 15 Jan 2026 | Access (S.30) | 14 Feb 2026 | Completed |
| DSR-TH-2026-002 | 10 Mar 2026 | Erasure (S.33) | 9 Apr 2026 | In progress |

## Compliance Checklist

| Requirement | Section | Status |
|------------|---------|--------|
| DPO appointed | Section 41 | Compliant |
| Privacy notice in Thai | Section 23 | Compliant |
| Consent mechanism (explicit, purpose-specific) | Section 19 | Compliant |
| ROPA maintained | Section 39 | Compliant |
| Breach notification procedure (72 hours) | Section 37(4) | Compliant |
| Cross-border transfer safeguards | Section 28 | Compliant |
| Data subject rights portal | Sections 30-36 | Compliant |
| Annual PDPA training | Best practice | Compliant |