For hotel DPOs, general managers and group compliance leads in Thailand
The Thailand PDPA Compliance Toolkit for Hotels & Hospitality
Passport scanning at check-in, TM30 immigration reporting, cross-border transfers and DPO appointment — a ten-step operational blueprint that turns a privacy notice on your website into evidence your board, franchisor and regulator can rely on.
- Ten-step operational blueprint with checklists, templates and an annual compliance calendar
- Passport scanning and TM30 immigration reporting handled without over-collecting
- Cross-border transfer mechanisms for OTAs, loyalty programmes and group offices
- Guest rights, security and vendor workflows your front office can run
- An audit-ready evidence pack, operationalised in Privacy360
Guest data is your highest-risk asset
Every check-in desk in Thailand runs two systems at once: a hospitality business, and a document-processing operation the law treats with the same seriousness as a bank branch. A single reservation can generate a passport scan, a visa page, a card authorisation, a dietary or medical note, and a face on lobby CCTV.
Section 38 of the Immigration Act demands a passport record for every foreign arrival within 24 hours — while the PDPA demands you collect no more than you need, secure what you hold, and prove both. Under-collect and you breach immigration law; over-collect or leave scans unprotected and you breach the PDPA. This toolkit shows you how to hold that balance, property by property.
Inside the Toolkit
Ten steps, each with a documented output
Work through the steps in order — but treat passport handling and TM30 reporting as the two you cannot defer. By the end you hold a defensible evidence pack covering mapping, governance, consent, transfers, guest rights, security, vendors and long-term compliance.
Map every guest and staff data touchpoint
A complete inventory of where personal data enters, moves and leaves the property — from the PMS and booking engine to the valet log and lobby CCTV.
Appoint a DPO and build group-wide governance
Who must appoint a Data Protection Officer, and the roles-and-responsibilities model that works across a single property or a multi-country group.
Fix passport and ID scanning at check-in
The highest-volume, highest-risk data flow in the building: encryption, access control and a retention clock the front desk actually follows.
Meet TM30 immigration reporting without over-collecting
How to satisfy the 24-hour Section 38 immigration duty while staying inside the PDPA's data-minimisation rules.
Privacy notices and consent across the guest journey
Booking, check-in, restaurant, spa and loyalty — what runs on contract or legal obligation, and what genuinely needs consent.
Secure cross-border data transfers
Documented transfer mechanisms for overseas reservation systems, group head offices, loyalty programmes and OTA data flows.
Build a guest data subject rights workflow
An access-request process the front office can actually run, with timelines, redaction rules and escalation paths.
Technical and physical security for guest data
Encryption at rest, CCTV governance, biometric kiosk controls and an incident response plan with named decision-makers.
Vendor, OTA and channel manager due diligence
Executed processing agreements with every supplier touching guest data — because controllership never transfers with the data.
Maintain long-term compliance and governance
The annual compliance calendar, training records and evidence pack that turn a privacy notice into demonstrable compliance.
Who this is for
Written for the people who actually run a hotel's data — not for lawyers reading the statute.
- Data Protection Officers — internal, outsourced or about to be appointed
- General managers and front office managers carrying day-to-day accountability
- Group compliance leads and owners spanning multiple properties or countries
- Reservations, IT and security teams running the systems behind the front desk
Frequently asked questions
About this toolkit
Is the toolkit designed specifically for hotels in Thailand?
Yes. It addresses reservations, check-in, passport and TM30 processes, payments, CCTV, marketing, staff data and group operations under Thailand's PDPA.
Can hotel groups use it across several properties?
Yes. The workflows can be applied consistently across a group while documenting property-level systems, responsibilities and local evidence.
Does it cover hotel technology suppliers?
Yes. It helps teams assess the systems and vendors handling guest and employee data, including PMS, booking, payment and security providers.
Does downloading it create an obligation to buy services?
No. The toolkit is free, and downloading it creates no obligation to appoint Formiti or subscribe to Privacy360.
How is the toolkit delivered?
Complete the form with a business email address and the PDF download link will be provided immediately and sent by email.
Co-produced by Formiti and Privacy360
Advisory expertise, operationalised in a platform.
Formiti brings the advisory side: Legal Consultants who interpret the statute and the immigration overlay, Privacy Architects who convert it into front-of-house and back-office workflows, and Technical Operations engineers who implement the controls inside the PMS, the payment estate and the document archive. Privacy360 is the platform that turns each compliance step into an audit-ready dashboard, so evidence is produced in minutes rather than reconstructed over weeks.
Next step
Thailand PDPA compliance, run for you
Once you've reviewed the Toolkit, talk to us about our Thailand PDPA compliance service — DPO appointment, consent frameworks, transfer mechanisms and audit-ready evidence, delivered as a managed service across your property or group.