How to Implement a Thailand PDPA Compliance Toolkit for International Schools in 2026

Introduction: Why Thailand PDPA Compliance Is Now a Board-Level Issue for International Schools

An international school in Bangkok, Chiang Mai or Phuket holds one of the densest concentrations of sensitive personal information in the country. Medical histories and allergy plans. Safeguarding and pastoral notes. Criminal background checks on teaching staff. Religious affiliation recorded at admission. Biometric gate access for pupils aged four upwards. Passport scans and visa records for families from thirty different nationalities. Very few commercial organisations of comparable size carry that risk profile, and none of them carry it on behalf of children.

Thailand PDPA enforcement is now active. The regulator has moved from an education-first posture to active investigation and penalty, and the statutory framework attaches civil liability, administrative fines and — for the most serious misuse of sensitive categories — criminal exposure to the school and to named individuals within it. Governors and boards are now asking a question they didn't ask three years ago: can we evidence what we do with student data, not merely describe it?

That is the gap this guide closes. A privacy notice published on the school website does not constitute compliance. It is a single artefact from a control framework that also requires a lawful basis register, verifiable parental consent records, a documented transfer mechanism for every overseas data flow, a functioning data subject access request workflow, encrypted storage for health and psychological files, executed processing agreements with every supplier, and a training record proving that the front office knows what to do when a parent asks to see their child's file. Compliance is an ongoing process of monitoring and updating your internal systems as the regulatory landscape evolves — it is a management cycle, not a legal filing that is completed and shelved.

This toolkit is co-produced by Formiti Consulting and Privacy360. Formiti brings the advisory side: Legal Consultants who interpret the statute, Privacy Architects who convert it into school workflows, and Technical Operations engineers who implement the controls. Privacy360 is the platform that operationalises each compliance step into an audit-ready dashboard, so that when the regulator, an insurer, an accrediting body or the board asks for evidence, it is produced in minutes rather than reconstructed over weeks.

What follows is a seven-step operational blueprint written for the people who actually have to run it — the DPO, the bursar, the admissions registrar, the IT manager and the head of school. Each step includes a practical template, checklist, decision tree, or callout you can integrate directly into your compliance file.

Callout — How to use this guide: Work through the steps in order. Each one produces a documented output. By the end you will hold a defensible evidence pack covering mapping, consent, transfers, access rights, security, suppliers and governance.

Understanding the PDPA: What International Schools Must Know in 2026

Who is covered

The PDPA applies to any organisation that collects, uses or discloses the personal data of individuals located in Thailand, regardless of where the organisation itself is incorporated. A school licensed in Thailand is clearly in scope. So is an overseas group head office that receives pupil records from its Thai campus, and so is an offshore admissions agency recruiting families into a Thai school. International status increases exposure rather than reducing it, because a greater share of routine processing crosses a border.

Personal data and sensitive personal data

Personal data is any information that identifies a living individual, directly or indirectly — a pupil number, a parent's mobile, a photograph in the yearbook, an IP address in the learning platform log.

Sensitive personal data under the PDPA is a narrower and far more tightly controlled set. It carries a stricter consent standard, heavier penalties for misuse and a higher expectation of technical protection. Schools routinely hold more of it than they realise:

Religious data requires particular attention. Thai admissions forms frequently carry a religion field inherited from a template, then nobody can articulate why the school needs it. If you cannot state the purpose and the lawful basis, delete the field.

Controller or processor — who is accountable

The school is the data controller for pupil, parent and staff records. It determines why and how the data is processed, and accountability sits with it. Suppliers that process data on the school's instruction — the MIS vendor, the cloud host, the coach operator, the assessment platform — are processors. Controllership does not transfer with the data. If an EdTech supplier leaks a class list, the school remains answerable to the families and to the regulator, which is why the vendor controls in Step 6 matter as much as the internal ones.

Beware of shared arrangements. Where a group head office sets the admissions CRM configuration and the retention rules for all campuses, both entities may carry controller responsibilities, and the allocation must be written down.

Enforcement exposure

Three tracks run in parallel. Administrative penalties are imposed by the regulator for breaches of the operational duties — notices, consent, security, transfers, DPO appointment. Civil liability allows affected individuals, including parents acting for their children, to claim compensation, with punitive damages available. Criminal liability attaches to the unlawful disclosure of sensitive categories and can reach responsible individuals personally, not only the legal entity.

For a school, the reputational consequence usually outruns the financial one. A safeguarding file circulating outside the school is an admissions problem, an accreditation problem and a board problem on the same morning.

Step 1 — Appoint a Data Protection Officer and Map Your Student Data Flows

Outcome of this step: a named, documented DPO with defined authority, and a completed inventory showing every system, purpose, lawful basis, retention period and transfer destination for pupil, parent and staff data.

Before you start: secure written board authorisation for the DPO role, a list of every IT system in use including departmental spreadsheets, and thirty minutes of interview time with each data-owning department.

Decide whether the appointment is mandatory

Appoint a DPO where your core activities require regular and systematic monitoring of individuals on a large scale, or where your core activities involve processing sensitive categories at scale. Both limbs commonly apply to schools. Continuous biometric access logging, CCTV across a campus and behavioural tracking inside a learning platform sit within systematic monitoring. Clinic records, safeguarding files and staff background checks sit within sensitive processing. Public authorities and state entities have their own trigger.

Consider the mandatory test as a baseline rather than a limit. A board that decides to appoint a school DPO in Thailand voluntarily converts an argument about thresholds into a demonstrable control. Where you appoint, notify the individual's contact details to the regulator and publish them so that parents can reach the office directly.

Define the DPO's remit in writing

The role fails when it is bolted onto an existing job title with no authority and no time. The written remit must cover:

• Advising the head of school and the board on statutory obligations, with a direct reporting line that bypasses line management on privacy matters.
• Monitoring compliance through internal audit of admissions, clinic, pastoral, HR and IT processing.
• Running staff training and maintaining the attendance record that evidences it.
• Acting as contact point for the regulator and for data subjects, including parents and former pupils.
• Reviewing data protection impact assessments before any new system goes live.
• Protection from dismissal or penalty for performing the role, and freedom from conflicting duties. The IT manager who selects and administers the MIS should not also be the person certifying its lawfulness.

If the school lacks in-house capacity, an outsourced appointment gives you qualified cover without the conflict problem. Formiti's outsourced DPO service provides the function on a fractional basis, and the internal versus outsourced comparison sets out the trade-offs before you commit a headcount. Where the board wants a formal answer to whether it must appoint a DPO in Thailand at all, work through the 2026 DPO decision framework.

Map the data before you write another policy

Nothing downstream works without the map. Interview each department and record what it actually does, not what the procedures manual says it does. Cover admissions and enquiries, the school clinic, pastoral and safeguarding, teaching and assessment, examinations, the library, transport, catering, trips and excursions, alumni and development, marketing and photography, HR and payroll, CCTV and access control, and the parent portal.

For each flow, ask where the data entered the school, which system holds it, who can see it, where it is copied to, when it is deleted, and whether it leaves Thailand.

Toolkit: Student Data Inventory Template

Callout — the shadow systems problem: The first mapping pass always misses something. Ask every department head one closing question: "What do you keep in a spreadsheet, a shared drive folder, a personal notebook or a messaging group?" Trip consent forms in a teacher's email inbox and clinic notes in a WhatsApp thread are the flows that surface during a breach, not during an audit. Privacy360 holds the completed inventory as a living register rather than a static document, so each new system is added at procurement instead of discovered later.

Step 2 — Update Privacy Notices and Parental Consent Forms

Outcome of this step: bilingual privacy notices matched to your inventory, and a versioned PDPA consent form set that separates explicit consent for sensitive categories from general enrolment processing.

Before you start: complete Step 1. You cannot write an accurate notice without the map, and a notice that describes processing you no longer perform is worse than no notice at all.

Build the notice from the inventory

Transparency under the PDPA is specific. A generic statement that the school "respects your privacy and processes data in accordance with applicable law" fails. Each notice must set out:

• The identity and contact details of the school as controller, and the DPO's contact point.
• The categories of personal data collected, naming the sensitive categories explicitly.
• The purpose of each processing activity.
• The lawful basis relied on for each purpose, and where the basis is legitimate interest, what that interest is.
• Whether provision of the data is required by statute or contract, and the consequence of refusal.
• The recipients or categories of recipients, including named processors and group entities.
• Overseas transfers, the destination countries and the mechanism relied on.
• Retention periods or the criteria used to determine them.
• The full set of data subject rights, including access, rectification, erasure, restriction, objection, portability and the right to withdraw consent.
• The right to lodge a complaint with the regulator.

Run separate notices for distinct audiences. A pupil-facing notice written in age-appropriate language, a parent notice, a staff notice, a job applicant notice and a visitor and CCTV notice. Bundling them into one document buries the information the reader needs.

Publish in Thai and English

Serving a bilingual community from a single English document is an accountability weakness and a practical one. Thai-speaking support staff, Thai national families and the regulator all read the Thai version. Produce both, ensure legal equivalence rather than approximate translation, and state which language governs in the event of divergence.

Get consent right for sensitive categories

Explicit consent is the default route for sensitive data in a school setting, and the standard is exacting. Consent must be freely given, specific, informed and unambiguous, made by a clear affirmative act, and as easy to withdraw as it was to give. Practical consequences:

• Unbundle it. A single tick box covering enrolment, medical treatment, photography, religious information and marketing is not specific consent. Separate each purpose with its own control.
• No pre-ticked boxes and no consent inferred from silence or continued use of the parent portal.
• Do not bury consent in the enrolment contract. Where a service cannot be refused without losing the school place, consent is not freely given and you need a different lawful basis.
• Separate photography and marketing from operational processing entirely. A parent must be able to decline the prospectus photograph while still accepting the medical treatment authorisation.
• Record the withdrawal route and make sure the registrar knows how to action it in the MIS.

Handle consent for minors

Parental or guardian consent is required for pupils below the statutory age threshold; above it, the pupil may consent personally. Two operational issues follow. First, your MIS must know each pupil's age band and route consent requests accordingly, because a form sent to a parent for a pupil who is old enough to decide for themselves is defective. Second, you must verify guardianship. Records held by a school frequently involve separated parents, legal guardians, sponsoring relatives and agency guardians for boarding pupils. Capture who holds parental responsibility at admission, store any court documentation, and review annually.

Toolkit: PDPA Consent Form Checklist

• [ ] Purpose stated in plain language, one purpose per consent control
• [ ] Sensitive categories identified explicitly by name
• [ ] Controller and DPO contact details included
• [ ] Withdrawal mechanism stated, with named contact
• [ ] Overseas transfer disclosed where the purpose involves one
• [ ] Retention period stated
• [ ] Signature block identifying the signatory's relationship to the pupil
• [ ] Date, form version number and language version recorded
• [ ] Stored against the pupil record, retrievable within the access request window

Callout — version control is the audit failure point: A signed consent proves only what the form said on the day it was signed. Store the form version alongside the signature and archive every superseded version. Privacy360 timestamps each consent capture against the notice version in force, which converts "we think they agreed" into evidence.

Step 3 — Secure Cross-Border Data Transfers for International Families

Outcome of this step: a documented, legally valid mechanism for every flow of personal data out of Thailand, recorded against the inventory entry that generates it.

Before you start: extract every row in your inventory marked "leaves Thailand". Include the ones nobody thinks of as transfers.

Recognise the transfers you already make

International schools export data constantly, usually without labelling it as such:

• Cloud-hosted MIS, learning platforms, assessment tools and admissions CRMs with servers outside Thailand.
• Group head office reporting — enrolment statistics, safeguarding escalations, HR files sent to a parent company abroad.
• University applications, transcripts, predicted grades and confidential references sent to institutions in the UK, Australia, the US and elsewhere.
• Examination boards processing candidate entries and access arrangements offshore.
• Overseas parents receiving reports, medical updates and pastoral correspondence by email.
• Offshore recruitment agencies, insurers, alumni platforms and payment processors.
• Remote IT support with administrative access to systems from another country.

Remote access counts. If a support engineer abroad can read the database, the data has been transferred.

Work through the mechanisms in order

A PDPA cross-border transfer requires one of a defined set of legal grounds, and the order matters.

1. Adequacy. Transfers to a destination recognised as having adequate data protection standards proceed on that basis. Confirm current recognition before you rely on it; adequacy positions change, and a mechanism that was valid at procurement may not be valid at renewal.

2. Group-wide rules. Multi-campus school groups transferring between affiliated entities may rely on binding corporate rules once approved by the regulator. This is the cleanest route for a group with campuses in several countries, because it covers all intra-group flows under one instrument rather than a patchwork of contracts.

3. Standard contractual clauses. For transfers to non-adequate destinations outside a group, execute appropriate safeguards in contract. The clauses must bind the recipient to equivalent protection, grant enforceable rights to the data subject and survive the commercial relationship. Pair the clauses with a transfer risk assessment covering the destination's government access regime, the recipient's security posture and the sensitivity of the categories moving.

4. Derogations. Explicit informed consent, contractual necessity, and vital interests exist as fallbacks. Use them for genuine one-off cases — an emergency medical disclosure during an overseas trip, or a specific university application the family has asked you to submit. Do not use a derogation to underpin a permanent systemic flow such as your cloud MIS. That is the most common structural error in school transfer files.

Document the university applications properly

The careers and university guidance office is the single highest-volume transfer point in most international schools, and it usually operates on nothing more than an assumption that the family wants the application sent. Formalise it. Capture a purpose-specific consent naming the destination institutions, covering the confidential reference and any access-arrangement or health information included, and record it against the pupil file.

Toolkit: Cross-Border Transfer Decision Tree

1. Does personal data leave Thailand, including by remote access? If no, stop — no transfer mechanism required. If yes, continue.
2. Are sensitive categories involved? If yes, apply heightened scrutiny and confirm your explicit consent position is sound before proceeding.
3. Is the destination recognised as adequate? If yes, record the recognition and the date checked. Review annually.
4. Is the recipient an affiliated entity within your school group? If yes, and approved binding corporate rules are in place, apply them. If not approved, use standard contractual clauses.
5. Is the recipient a third party in a non-adequate destination? Execute standard contractual clauses and complete a transfer risk assessment.
6. Can no safeguard be put in place? Assess whether a derogation genuinely applies to this specific, non-repetitive transfer. If it does not, do not transfer.
7. Record the outcome, the mechanism, the date and the reviewer against the inventory row.

Callout — the renewal trap: Transfer mechanisms decay. Vendors migrate hosting regions, sub-processors change, adequacy findings are revised and group structures are reorganised. Diary a transfer register review at least annually and at every contract renewal. Privacy360 attaches the mechanism, the risk assessment and the expiry date to each flow, so an expiring safeguard raises an alert rather than surfacing during an investigation.

Step 4 — Establish a DSAR Workflow for Parents and Students

Outcome of this step: a written, tested procedure that identifies, logs, verifies, fulfils and closes a data subject access request inside the statutory response window.

Before you start: confirm your inventory is complete. A request you cannot fulfil on time is almost always a mapping failure, not a legal one.

Know who can ask

Requests come from more directions than schools anticipate: current pupils above the age threshold, parents and guardians exercising rights on behalf of younger children, former pupils requesting records years after leaving, staff and former staff, unsuccessful job applicants and rejected applicant families. Separated parents make the hardest cases — verify who holds parental responsibility before releasing anything, and take advice where a request appears to be an instrument in a custody dispute.

Requests are valid in any format. An email to a class teacher, a message to the admissions office or a comment at the school gate can all start the clock. There is no requirement for the requester to use a form, cite the statute or explain why they are asking.

Train the front line to recognise and escalate

The reception desk, admissions office, school nurse and form tutors are where requests land. Give them one rule: any request from a parent, pupil or staff member to see, correct, delete or receive a copy of their information goes to the DPO on the day it is received, in writing, with the date recorded. Escalation, not assessment, is their job.

Verify identity proportionately

Verification protects the pupil, but it must not become an obstruction tactic. Match the verification effort to the sensitivity of the data. Confirm the requester against the MIS record, use a known registered email or the parent portal where possible, and request photographic identification only where the channel is unverified or the file contains sensitive categories. Never ask for more information than you need, and never treat the verification exchange as a way of pausing the clock indefinitely.

Search, review, redact, deliver

Search every location in the inventory, including email archives, safeguarding systems, paper registry files and the shadow systems you found in Step 1. Then review for third-party data: a pastoral note that names another pupil, a reference that identifies its author, a complaint that quotes another parent. Redact what cannot lawfully be disclosed and record the reasoning for each redaction. Deliver through a secure channel — a password-protected portal or encrypted transfer, never an unprotected email attachment containing a child's clinic record.

Toolkit: DSAR Response Process Flowchart

1. Receive — any staff member logs the request and forwards it to the DPO the same day.
2. Log — DPO records requester, relationship to data subject, date received, scope and deadline in the request register.
3. Verify — confirm identity and, for a child's records, confirm parental responsibility.
4. Clarify — where the scope is unclear, ask a narrowing question promptly. Do not delay the initial acknowledgement to do so.
5. Search — issue the search brief to every system owner in the inventory, with a fixed internal return date well inside the statutory deadline.
6. Review and redact — remove third-party and exempt material; record justifications.
7. Approve — DPO signs off the disclosure pack.
8. Deliver — release through the secure channel with a covering explanation of the rights the requester still holds.
9. Close — record the completion date, the material disclosed and any redaction rationale.

Callout — run a fire drill each term: Submit a test request as though you were a parent and time the full cycle. Schools that have never rehearsed a request routinely discover that the clinic system has no export function or that alumni records sit with a former development manager's personal account. Privacy360 runs the register, the internal search briefs and the deadline countdown in one place, so the board can see open requests and time remaining at a glance.

Step 5 — Implement Technical Safeguards for Sensitive Student Records

Outcome of this step: documented technical and organisational measures proportionate to the sensitivity of the data, plus a tested incident response plan that meets the statutory notification deadline.

Before you start: obtain your MIS vendor's security documentation and a current list of all administrative accounts.

Encrypt what matters most

Encrypt health, psychological, safeguarding and disciplinary records at rest and in transit as a baseline. Enforce TLS across the parent portal, the MIS and every web-facing service. Encrypt the laptops and mobile devices staff carry off campus — a lost device holding a downloaded class medical list is a reportable breach in a way that the same list behind an encrypted login is not. Where paper clinic and safeguarding files persist, physical security is the equivalent control: locked cabinets, keyholder register and an access log.

Apply least privilege rigorously

Schools default to generous access because it is convenient. Reverse that. A form tutor needs allergy and emergency contact information, not counselling notes. The finance office needs billing contacts, not medical history. The IT administrator needs system access, not clinical content. Build role-based profiles in the MIS, enforce multi-factor authentication on every administrative account and on the parent portal, and review the access matrix each term. Deprovision leavers on their last working day — dormant accounts belonging to departed staff are a persistent finding in school audits.

Test the systems you depend on

Commission vulnerability assessments against the school management information system, the parent portal and any externally exposed service, and repeat them after major upgrades. Patch on a defined schedule. Segment the pupil-facing network from administrative systems so that a compromised classroom device cannot reach the clinic database. Verify that backups exist, are encrypted and have been restored in a test, not merely scheduled.

Prepare for the breach before it happens

Detection is the weak link in most school environments because nobody is watching the logs. Enable alerting on bulk exports, failed administrative logins and unusual out-of-hours access. Then write the plan: who declares an incident, who assesses risk to the pupils affected, who drafts the regulator notification within the statutory deadline, who communicates with families, and who records the decision log. Rehearse it once a year with the senior leadership team present, because the decisions that go wrong in a live breach are management decisions, not technical ones.

How the Three-Team Methodology applies here

Security failures at schools are rarely purely technical. They occur in the seam between the legal requirement and the system configuration. Formiti's Three-Team Methodology closes that seam: Legal Consultants define what the statute demands for each category of pupil data, Privacy Architects translate that into access rules, retention logic and workflow design, and Technical Operations implement and test the controls inside the school's actual estate. One team specifying and another team building, with no translation layer between them, is how a school ends up with an excellent policy and an unencrypted clinic export.

Toolkit: Technical Security Checklist for Schools

• [ ] Encryption at rest for health, safeguarding and HR records
• [ ] TLS enforced on all web-facing services
• [ ] Full-disk encryption on staff laptops and mobile devices
• [ ] MFA on all administrative and parent portal accounts
• [ ] Role-based access matrix documented and reviewed termly
• [ ] Leaver deprovisioning completed on final working day
• [ ] Network segmentation between pupil and administrative systems
• [ ] Vulnerability assessment on the MIS within the last twelve months
• [ ] Encrypted backups with a documented restore test
• [ ] Logging and alerting on bulk export and privileged access
• [ ] Written incident response plan naming decision-makers
• [ ] Annual breach simulation completed with SLT participation

Step 6 — Vendor and Third-Party Supplier Compliance

Outcome of this step: an executed data processing agreement and a completed due diligence record for every supplier that touches pupil, parent or staff data.

Before you start: pull the supplier list from finance, not from IT. The finance ledger catches the small EdTech subscriptions that departmental budgets have quietly accumulated.

Identify who actually holds your data

The list is longer than expected: MIS and learning platform vendors, cloud hosting, assessment and reading-progress apps, catering providers holding allergy data, coach operators holding pupil manifests, medical insurers, uniform and payment portals, photography firms, alumni platforms, recruitment agencies, examination boards and outsourced IT support. A free classroom app adopted by one enthusiastic teacher is a processor with access to a class list.

Insist on a compliant processing agreement

Every processor relationship requires a written agreement setting out the subject matter, duration, nature and purpose of processing, the categories of data and data subjects, and binding the processor to:

• Process only on the school's documented instructions.
• Impose confidentiality obligations on its personnel.
• Apply appropriate security measures.
• Obtain prior authorisation before engaging any sub-processor, and pass the same terms down.
• Assist the school with access requests and breach notification within a defined timeframe, shorter than the school's own regulatory deadline.
• Delete or return all data at the end of the contract, with written confirmation.
• Submit to audit and provide evidence of compliance.
• Disclose hosting locations and support the transfer mechanism identified in Step 3.

Run due diligence annually

Assess each supplier at onboarding and on a yearly cycle thereafter. Weight the assessment by risk — the clinic system vendor gets a deeper review than the stationery supplier.

Toolkit: Vendor PDPA Due Diligence Checklist

• [ ] Data categories the supplier will access, sensitive categories flagged
• [ ] Executed data processing agreement on file, current version
• [ ] Hosting locations named and transfer mechanism documented
• [ ] Sub-processor list obtained and change-notification clause in force
• [ ] Security certification or completed security questionnaire
• [ ] Breach notification timeframe stated in the contract
• [ ] Deletion and return commitment at termination
• [ ] Named privacy contact at the supplier
• [ ] Review date set and owner assigned

Callout — red flags that should stop a procurement: No published privacy notice. Refusal or inability to sign a processing agreement. No named privacy contact. An undisclosed sub-processor chain. Terms of service that grant the supplier rights to use pupil data for product improvement or model training. Any one of these means the contract does not proceed until it is resolved — and the AI training clause now appears routinely in EdTech terms, so read it every time.

Step 7 — Maintain Long-Term Compliance Through 2026 and Beyond

Outcome of this step: a governance rhythm that keeps the evidence current between audits, owned by named individuals and visible to the board.

Run the DPIA cycle properly

Complete a data protection impact assessment before deploying any high-risk processing: new biometric systems, AI-assisted marking or behaviour analytics, CCTV expansion, wellbeing monitoring tools, or any new platform handling sensitive categories. Then review existing assessments annually, because risk changes when a vendor is acquired, a feature is added or the pupil population grows. Record the consultation with affected groups and the residual risk decision, and have the DPO sign it before go-live rather than after.

Train every term, not every year

Data handling failures in schools are behavioural. Run short, role-specific training each term: reception on request recognition, teaching staff on photography and messaging, the clinic on health record handling, HR on background checks, and admissions on consent capture. Keep the attendance register — an untrained member of staff who causes a breach is a governance finding, and the register is the only defence.

Monitor the regulator

Assign someone the standing task of tracking regulatory guidance, sub-regulations and published enforcement actions, and reporting materially relevant changes to the DPO. Enforcement patterns tell you where scrutiny is heading before a notice arrives.

Report to the board in numbers the board can act on

Governance committees need a standing item with a consistent format: open and overdue access requests, incidents recorded and their severity, training completion rate by department, overdue vendor reviews, transfer mechanisms nearing expiry, and DPIAs outstanding. A narrative assurance paragraph is not oversight.

Toolkit: Annual PDPA Compliance Calendar for Schools

How Formiti and Privacy360 Support International Schools

Most schools do not fail at PDPA compliance because they misread the statute. They fail because a registrar, a bursar and an IT manager with full-time jobs are asked to run a continuous control framework alongside them. That is the problem Formiti Consulting is built to solve.

Advisory and delivery in one engagement

Formiti provides Global Privacy & AI Governance Managed Services including outsourced DPO, cross-border representation, and the Privacy360 governance platform. The Three-Team Methodology puts Legal Consultants, Privacy Architects and Technical Operations engineers on the same engagement, so the interpretation of the law, the workflow design and the system configuration are produced by people working to a single brief. The school receives implemented controls, not a report recommending them.

Privacy360 turns the steps into evidence

Every output in this guide — the data inventory, versioned consent records, the transfer register with expiry alerts, the access request log with deadline countdowns, vendor agreements and review dates, DPIAs, training records and incident logs — lives in Privacy360 as a single audit-ready dashboard. When the regulator, the board, an insurer or an accrediting inspector asks what you do with pupil health data and how you prove it, the answer is produced on screen.

Built for multi-campus school groups

Formiti delivers audit-ready compliance across 120+ jurisdictions. For a group operating campuses in Thailand alongside sites in other countries, that matters operationally: one framework covering Thai PDPA obligations, group transfer mechanisms between campuses, and whichever local regimes apply to the sister schools, rather than a separate consultant and a separate spreadsheet in each country.

Outsourced DPO for schools without in-house capacity

Where a school must appoint a DPO but has no qualified candidate free of conflicting duties, Formiti's DPO-as-a-service places an experienced external Data Protection Officer into the role — handling regulator liaison, access request oversight, training delivery, DPIA sign-off and board reporting, with the independence the statute expects.

Take the next step. Book a consultation with the Formiti Consulting team to scope a PDPA readiness assessment for your school, or arrange a walkthrough of Privacy360 configured for an international school environment. Bring your current privacy notice and supplier list — the gaps are usually visible in the first hour.

Frequently Asked Questions

Does the PDPA apply to international schools in Thailand?

Yes. The PDPA applies to any organisation collecting, using or disclosing the personal data of individuals located in Thailand, irrespective of the school's ownership, curriculum or licensing structure. A British, American, Australian or IB curriculum school operating on Thai soil is a data controller under Thai law. An overseas group head office receiving pupil data from a Thai campus is also caught.

What happens if our school suffers a data breach?

Contain the incident, assess the risk to the affected pupils and staff, and notify the regulator within the statutory deadline where the breach is likely to result in risk to individuals. Where the risk is high, notify the affected families directly with a description of the breach and the steps they should take. Document every decision, including a decision not to notify and the reasoning behind it. Enforcement exposure includes administrative penalties, civil claims from affected individuals and criminal liability for the unlawful disclosure of sensitive categories.

Do we need a DPO if we are a small school?

Volume of pupils is not the test. The triggers involve large-scale systematic monitoring and processing of sensitive categories, and a small school running biometric gate access, campus CCTV, a clinic and staff background checks can meet the second limb comfortably. Assess it formally, record the reasoning either way, and revisit the decision when you deploy a new monitoring system. Formiti Consulting can complete the assessment and, where appointment is required, provide the function externally.

Can we transfer student records to parents or institutions overseas?

Yes, with the correct mechanism documented. Confirm whether the destination is recognised as adequate; if not, rely on approved binding corporate rules for intra-group transfers or standard contractual clauses supported by a transfer risk assessment for third parties. Use consent-based derogations only for genuine one-off cases, and never as the standing basis for your cloud platforms. For university applications, capture a purpose-specific consent naming the institutions and covering the confidential reference.

How long does it take to achieve PDPA compliance?

Most international schools reach an audit-ready baseline within a small number of school terms, with the data mapping exercise consuming the largest share of that time. The pace depends on how many legacy systems exist, how dispersed the records are and whether vendor agreements need renegotiating. Compliance is then maintained through the annual cycle in Step 7 rather than declared finished.