Local PDPA Expertise for Global Brands

Local PDPA Representative (In‑Country Contact)

Appoint Formiti as your official Thailand PDPA Local Representative to meet legal obligations when you are based outside the Kingdom but offer goods, services, or behavioural monitoring to Thai data subjects. Your representative acts as the in‑country contact for data subjects and the PDPC, ensuring you can respond quickly and defensibly to regulatory inquiries.

• Official in‑country point of contact for PDPC and Thai data subjects

• Handling of complaints, inquiries, and regulatory correspondence

• Integrated with your global DPO and wider privacy programme

Beyond Legal Advice

1. (The Winning  Structure) Unlike law firms that strictly offer legal interpretation, our Three-Team Model provides comprehensive, full-spectrum coverage. We do not rely on a single point of contact; instead, we deploy three specialized units: a Legal Team to handle regulatory nuance and Authority correspondence, a Privacy Team to manage technical triage and breach reporting, and an Operations Team to facilitate Data Subject Access Requests (DSARs) through our secure platform.

Annual PDPA Audits and Continuous Improvement (Including AI)

Our annual PDPA audits give you a structured, independent review of how well your controls work in practice across governance, records, notices, DSAR handling, security, vendors, cross‑border transfers, and now AI‑driven processing. The output is a prioritised remediation plan that lets you show regulators, boards, and customers that you are not only compliant today but actively improving year on year.

We start by mapping your business lines, systems, and key data flows, then test a representative sample of processes and records against PDPA requirements and current regulatory expectations. This covers everything from your RoPA or equivalent inventories, consent and notice patterns, retention and deletion, training, and incident handling, through to how you deal with high‑risk processing such as tracking, profiling, and large‑scale analytics. Where you are also subject to GDPR or other regimes, we highlight where Thai PDPA alignment is strong and where local adjustments are still needed.

The audit is designed to be practical and operational rather than purely legal. We speak with process owners, review real tickets and DSAR cases, sample vendor contracts, and look at how new products or features are approved from a privacy perspective. This helps uncover not just documentary gaps but real‑world issues such as inconsistent practices between teams, untracked shadow IT, or data uses that have evolved away from the original purpose and notice. Each finding is risk‑rated and linked to concrete actions, owners, and suggested timelines.

AI and automated‑decision auditing

As part of the annual review, we assess how you use AI, machine learning, and automated decision‑making that involves Thai personal data, whether for recommendations, fraud detection, personalisation, scoring, or internal analytics. We identify which AI use cases fall within PDPA’s scope for profiling and high‑risk processing, and check that you have appropriate legal bases, transparency, and safeguards in place. This includes looking at model inputs, training data, retention, and any human‑in‑the‑loop oversight you provide.

We review how you inform users about AI‑driven processing, how they can exercise their rights (including the right to access information about automated decisions where applicable), and whether there are effective ways to challenge or seek human review of significant decisions. We also examine governance: who approves new AI use cases, how you document risk assessments, bias checks, and impact assessments, and how AI‑related incidents or model drifts are monitored and escalated. The result is an AI‑specific set of findings and recommendations that can be folded into your broader PDPA remediation plan and your global AI governance framework.

Key elements include:

• Structured PDPA audit across governance, notices/consent, DSARs, security, vendors, and cross‑border transfers, using a clear controls framework.

• Risk‑rated gap analysis with practical remediation tasks, owners, and timelines that your teams can realistically implement over the year.

• Management‑ready reporting that summarises key risks, trends, and progress, suitable for boards, investors, and regulators.

• Dedicated AI and profiling review, covering legal bases, transparency, rights handling, data minimisation, and bias or fairness considerations.

• Integration of AI audit findings into your overall PDPA and global privacy roadmap, so AI governance becomes part of “business as usual” rather than a separate silo.

Formiti PDPA  Structured Engagement Model

Service comparison table

Thailand PDPA service components

Secure Your Thai Market Access with Confident PDPA Compliance