What a PDPA gap analysis in Thailand covers, what good output looks like and how to choose a provider. See a sample gap report from Formiti.
The short answer
A PDPA gap analysis in Thailand compares how you handle personal data with what the Personal Data Protection Act requires. It scores your current position, rates each gap by risk and gives you a prioritised plan to fix it. For most organisations, a PDPA assessment in Thailand takes a few weeks and costs a fixed fee.
However, not every gap analysis is equal. Some deliver a long checklist. Others deliver a decision tool your board can act on. This guide explains the difference, so you can commission the right one.
Why boards are commissioning PDPA assessments now
Thailand's PDPA has been fully in force since 1 June 2022. At first, enforcement was light. That has now changed.
In August 2024, the Personal Data Protection Committee (PDPC) fined a major IT retailer THB 7 million. The failures were basic: no data protection officer, weak security and a late breach response. As a result, PDPA compliance moved from the legal team's list to the boardroom agenda.
Moreover, the PDPA reaches beyond Thailand. Under Section 5, it applies to foreign businesses that offer goods or services to people in Thailand. It also applies to those that monitor behaviour there. Therefore, regional headquarters in Singapore, Hong Kong, the UK or the US are often in scope too.
The penalties are significant:
- Administrative fines of up to THB 5 million per breach
- Criminal penalties, including imprisonment, for certain offences
- Civil damages, with punitive awards of up to twice the actual damages
In short, a PDPA gap analysis is the fastest way to find out how exposed you are.
What a PDPA gap analysis in Thailand covers
A thorough assessment reviews eight core areas of the PDPA. In each one, it checks both your documents and what actually happens in practice.
| PDPA domain | What is checked |
|---|---|
| Lawful basis and consent (s.19–24) | Lawful bases, consent wording and how people withdraw consent |
| Privacy notices (s.23) | Thai-language notices on websites, apps and forms |
| Data subject rights (s.30–36) | How requests are logged and answered within 30 days |
| Security and breach response (s.37) | Security measures and 72-hour notification to the PDPC |
| Records of processing (s.39) | Whether your records are complete and current |
| Processor contracts (s.40) | Data processing terms with your vendors |
| DPO and governance (s.41–42) | Whether you need a DPO, and who owns privacy |
| Cross-border transfers (s.28–29) | Data sent abroad and the safeguards in place |
In our experience, cross-border transfers and processor contracts are where international groups score lowest. Many rely on regional cloud platforms without Thai-specific transfer safeguards.
What a good PDPA gap analysis report looks like
The output is where most gap analyses fall short. A 60-page PDF rarely changes anything. Instead, decision makers need five things:
- A readiness score. One number for the board, broken down by PDPA domain.
- A risk-rated gap register. Every gap rated high, medium or low.
- Clear actions with owners. Each gap has a named owner and a due date.
- A 30-60-90 day roadmap. High-risk gaps first, then process fixes, then governance.
- A way to track progress. Ideally live, not a static document that ages on a shared drive.
At Formiti, we deliver results through Privacy360, our privacy operations platform. Consequently, clients track remediation in real time. You can see a sample Privacy360 gap report on our service page. It uses a fictional company, because client reports stay confidential.
Sample report. Fictional company and data.
How to conduct a PDPA gap analysis in Thailand: step by step
Follow these five steps to run a PDPA gap analysis that leads to action.
- Step 1: Define the scope. First, agree which entities, systems and data are in scope. This sets a fixed fee and avoids surprises.
- Step 2: Gather evidence. Next, interview key teams and review notices, contracts and systems. Thai-language documents need a reviewer who reads Thai.
- Step 3: Score and report the gaps. Then, score each domain and present findings to leadership.
- Step 4: Fix the highest risks first. Finally, close the gaps, starting with the highest risks.
- Step 5: Track progress. Re-score each quarter, so the board sees the readiness score rise.
After remediation, many organisations move to ongoing support. For example, they appoint an outsourced DPO or a Thailand PDPA local representative.
PDPA gap analysis vs DPIA vs audit
These terms are often confused. However, each answers a different question.
| PDPA gap analysis | DPIA | Annual audit | |
|---|---|---|---|
| Question it answers | Where do we stand overall? | Is this one activity high risk? | Are our controls still working? |
| Scope | Whole programme | One processing activity | Whole programme |
| When | Before or early in a programme | Before high-risk processing starts | Every year |
In practice, a good gap analysis tells you where you also need a DPIA.
How to choose a PDPA assessment provider in Thailand
Use these questions to compare providers:
- Do they have an in-country team that reads Thai documents?
- Is the fee fixed after scoping, or billed by the hour?
- Will you get a scored report and roadmap, or only a checklist?
- Can they help remediate, not just report?
- Can they also act as your DPO or local representative?
- Do they cover your other markets, such as the EU, UK or Singapore?
If a provider answers all six well, you have a partner, not just an auditor.
Key takeaways
- A PDPA gap analysis in Thailand scores your programme against eight PDPA domains.
- The PDPC now issues multi-million baht fines, so boards want evidence of compliance.
- The PDPA applies to foreign businesses that serve or monitor people in Thailand.
- Good output is a readiness score, a risk-rated gap register and a 30-60-90 day roadmap.
- Choose a provider with an in-country team, fixed fees and remediation support.
Key terms
PDPA: Thailand's Personal Data Protection Act B.E. 2562 (2019), fully in force since June 2022.
PDPC: the Personal Data Protection Committee, Thailand's data protection regulator.
Gap analysis: a structured comparison of current practice against legal requirements, with risk-rated gaps.
DPO: a data protection officer, required under Section 41 in certain cases.
DPIA: a data protection impact assessment of one high-risk processing activity.
Start with a fixed-fee PDPA assessment
Formiti's in-country team in Thailand works alongside global privacy specialists in the UK, Ireland and Switzerland. Together, we score your programme, hand you a prioritised gap report and help you close the gaps.
Ready to find out where you stand? Book a free PDPA assessment scoping call.
Frequently asked questions
What is a PDPA gap analysis?
A PDPA gap analysis compares your data practices with Thailand's PDPA. It identifies gaps, rates their risk and sets out the actions needed to close them.
Is a PDPA assessment mandatory in Thailand?
The PDPA does not name a gap analysis as mandatory. However, you must be able to show compliance. An assessment is the most practical way to prove it.
How long does a PDPA gap analysis in Thailand take?
Most take a few weeks from scoping to final report. Larger groups with several entities may take longer.
Does the PDPA apply to companies outside Thailand?
Yes. Under Section 5, it applies to foreign businesses that offer goods or services to people in Thailand, or monitor their behaviour there.
What happens after the gap analysis?
You fix the gaps, starting with the high-risk ones. Many organisations then appoint an outsourced DPO to keep the programme running.