# Thailand PDPA Compliance Workflow Reference

## Workflow 1: Consent Collection

### Step 1 — Prepare Consent Request
1. Draft consent request in clear, easily understandable Thai (and English if applicable).
2. Include: purpose of processing, data items, recipients, retention period, rights, consequences of refusal.
3. Separate consent requests per processing purpose — no bundling with terms and conditions.
4. Display consent request prominently; not buried in terms of service.

### Step 2 — Collect Consent
1. Obtain explicit opt-in action (checkbox, signature, digital acknowledgment).
2. For sensitive data: explicit consent with clear statement of the sensitive data category.
3. For children under 10: obtain consent from parent/legal guardian with identity verification.
4. Record: data subject identifier, timestamp, purpose, consent version, channel.

### Step 3 — Manage Withdrawal
1. Provide withdrawal mechanism as easy as consent collection (same channel or easier).
2. Process withdrawal without unreasonable delay.
3. Cease processing; notify processors to cease.
4. Inform data subject of consequences before actioning withdrawal.

## Workflow 2: Cross-Border Transfer

### Step 1 — Assess Transfer Basis
1. Check if destination has PDPC adequacy determination — none published as of March 2026.
2. If no adequacy: assess contract necessity (Section 28(4)(a)) — if transfer is necessary for contract performance with data subject.
3. If contract necessity does not apply: obtain data subject consent with disclosure that destination may not have adequate protection.
4. For intra-group transfers: assess whether group binding rules can be submitted for OPDPC certification.

### Step 2 — Document and Execute
1. Record the transfer basis in the cross-border transfer register.
2. Implement appropriate safeguards (contractual clauses, encryption, access controls).
3. Update the privacy notice to disclose international transfers.
4. Schedule annual review.

## Workflow 3: Data Subject Rights Response

### Receipt (Day 0)
1. Request received via privacy portal, email, or written submission.
2. Verify data subject identity.
3. Classify: access, portability, objection, erasure, restriction, rectification.

### Fulfilment (Days 1-28)
1. Locate all personal data across systems.
2. Assess exemptions (legal obligations, public interest, legal claims).
3. Execute the request type per PDPA provisions.
4. For portability: export in structured, machine-readable format.

### Response (Day 30)
1. Deliver response in Thai (and English if requested).
2. If refused, provide reasons and inform of complaint rights to PDPC.
3. Record in DSR management log.

## Workflow 4: Breach Notification

### Detection to Notification (72 hours)
1. Detect breach and activate incident response.
2. Assess: personal data affected, number of subjects, severity, likely impact.
3. If breach likely to affect rights and freedoms: prepare OPDPC notification.
4. Submit OPDPC notification within 72 hours using prescribed form.
5. If high risk to data subjects: notify affected individuals without delay.
6. Implement containment and remediation.
7. Document all actions for PDPC inspection.

## Workflow 5: DPO Appointment Assessment

### Step 1 — Assess Requirement
1. Is the organisation a public authority? → DPO required.
2. Do core activities involve large-scale systematic monitoring? → DPO required.
3. Do core activities involve large-scale processing of sensitive data? → DPO required.
4. If none apply, DPO appointment is voluntary but recommended.

### Step 2 — Appoint and Register
1. Appoint a qualified individual (internal or external).
2. Ensure DPO has adequate resources, independence, and direct reporting line.
3. Publish DPO contact details in privacy notice.
4. Register DPO details with the OPDPC as required.