PDPA Thailand: every control, and what you already have

38 controls 132 frameworks share controls with it Thailand verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

Thailand PDPA Evidence & Implementation Kit

38 controls is the documentation set somebody has to write. This is that set, already written: an adopt-ready artifact for every control in policy and procedure text you edit rather than draft, and the evidence checklist an auditor asks for against each.

See what is in it, $249

The same set every buyer of this kit receives. Nothing here is produced on request.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you run	Shared controls
Bahrain PDPL	6	measure it →
Barbados Data Protection Act 2019	6	measure it →
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)	6	measure it →
GDPR	6	measure it →
Personal Data Act (personopplysningsloven)	6	measure it →
Privacy Act 1988 (Australia)	6	measure it →
Privacy Act 2020	6	measure it →
Singapore Government Instruction Manual on ICT&SS Management (IM8)	6	measure it →
South Korea PIPA	6	measure it →
Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023)	6	measure it →
Turkey KVKK	6	measure it →
NIST Privacy Framework	5	measure it →

Every control

Code	Control	Also in
`PDPATH-1`	Scope, Extra-Territorial Application, Lawful Basis, and Notice	0
`PDPATH-2`	Consent Requirements and Special Consent for Sensitive Data	0
`PDPATH-3`	Data Subject Rights, Automated Decisions, Accuracy	25
`PDPATH-4`	DPIA, Privacy by Design, Children's Data	75
`PDPATH-5`	Security Measures and Data Protection	89
`PDPATH-6`	Cross-Border Transfer and Processor Engagement	26
`PDPATH-7`	DPO, Records of Processing, Retention, Marketing, Training	48
`PDPATH-8`	Data Breach Notification, Complaints, Compliance, Enforcement	82
`Section 19`	Lawful Basis and Consent Requirements	0
`Section 20`	Consent for Minors	0
`Section 21`	Purpose Limitation	0
`Section 22`	Data Minimisation	0
`Section 23`	Privacy Notice Requirements	0
`Section 24`	Lawful Bases Other Than Consent	0
`Section 25`	Historical and Pre-PDPA Data	0
`Section 26`	Sensitive Personal Data	0
`Section 27`	Disclosure to Third Parties	0
`Section 28`	Cross-Border Data Transfer	0
`Section 29`	Intra-Group Transfer Rules	0
`Section 30`	Right of Access	0
`Section 31`	Right to Data Portability	0
`Section 32`	Right to Object	0
`Section 33`	Right to Erasure	0
`Section 34`	Right to Restriction of Processing	0
`Section 35`	Right to Rectification	0
`Section 36`	Retention and Deletion	0
`Section 37`	Controller Security Obligations	0
`Section 37(4)`	Breach Notification to Data Subjects	0
`Section 39`	Record of Processing Activities (RoPA)	0
`Section 40`	Processor Obligations	0
`Section 41`	Appointment of Data Protection Officer	0
`Section 42`	DPO Duties	0
`Section 43`	PDPC Authority and Powers	0
`Section 5`	Extraterritorial Application	0
`Section 6`	Definitions and Scope of Personal Data	0
`Section 7`	Local Representative Requirement	0
`Section 95`	Effective Date and Enforcement	0
`Section 95(2)`	Complaint Handling	0

Tell me when PDPA Thailand files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What an auditor will ask you to produce

The artefacts named on the failure modes this framework speaks to.

Withdrawal mechanism as easy as giving
Lawful basis register per processing
Consent records (granular and withdrawable)
Direct collection notification evidence
consent records
lawful basis register
security charter
board reporting pack
risk register
policy library

How programmes fail on this

Failure modes named by this framework and others. Each opens the full record.

no withdrawal mechanism named by 8 frameworks
no executive sponsor named by 8 frameworks
no maturity assessment named by 4 frameworks
no root cause analysis named by 3 frameworks
delayed notification named by 3 frameworks

What this page is

A control-level reference for PDPA Thailand, drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition