For heads of school, bursars, DPOs and IT managers in Thailand
The Thailand PDPA Compliance Toolkit for International Schools
Consent forms, sensitive data handling, cross-border transfers and DPO appointment — a seven-step operational blueprint that turns a privacy notice on your website into evidence your board, insurer and regulator can rely on.
- Seven-step operational blueprint with templates, checklists and decision trees
- Verifiable parental consent and sensitive-data handling for schools
- Cross-border transfer mechanisms for group offices and EdTech suppliers
- DSAR, security and vendor workflows your front office can run
- An audit-ready evidence pack, operationalised in Privacy360
A privacy notice is not compliance
An international school in Bangkok, Chiang Mai or Phuket holds one of the densest concentrations of sensitive personal information in the country: medical histories, safeguarding notes, background checks, biometric gate access and passport scans for families from thirty nationalities — all carried on behalf of children.
Thailand PDPA enforcement is now active, with administrative fines, civil claims and — for the most serious misuse of sensitive categories — criminal exposure for the school and named individuals. Boards are no longer asking what you do with student data. They are asking whether you can evidence it.
Inside the Toolkit
Seven steps, each with a documented output
Work through the steps in order. By the end you hold a defensible evidence pack covering mapping, consent, transfers, access rights, security, suppliers and governance.
Appoint a DPO and map your data
Who must appoint a Data Protection Officer under the PDPA, and how to build a complete map of pupil, parent and staff data flows — including the shadow systems nobody wrote down.
Privacy notices and parental consent
Rewrite admissions, medical and safeguarding consent so it is verifiable, purpose-specific and defensible — with templates you can adapt directly.
Cross-border transfers
A documented transfer mechanism for every overseas data flow: group head offices, offshore admissions agencies, cloud-hosted learning platforms and EdTech suppliers.
DSAR workflow for parents and staff
A working access-request process the front office can actually run, with response timelines, redaction rules and escalation paths.
Safeguards for sensitive data
Technical controls for health records, counselling notes, biometrics and background checks — the categories that carry the heaviest penalties.
Vendor and supplier compliance
Executed processing agreements with every MIS vendor, cloud host, coach operator and assessment platform — because controllership never transfers with the data.
Governance that survives an audit
The training records, evidence pack and annual review cycle that turn a privacy notice on the website into demonstrable compliance.
Who this is for
Written for the people who actually have to run PDPA compliance inside an international school — not for lawyers reading the statute.
- Heads of school and governors carrying board-level accountability
- Bursars and operations directors who own the compliance budget
- Data Protection Officers — internal, outsourced or about to be appointed
- Admissions registrars and IT managers running the day-to-day workflows
Frequently asked questions
About this toolkit
Is the toolkit specific to international schools in Thailand?
Yes. It translates Thailand's PDPA into practical workflows for admissions, safeguarding, HR, IT, communications and school operations.
What templates are included?
The guide includes implementation checklists and working templates for consent, data subject rights, incidents, vendors, retention and audit evidence.
Can a school use it without an internal DPO?
Yes. It helps leadership organise the work and identify where independent DPO advice or managed support is needed.
Does downloading it create an obligation to buy services?
No. The toolkit is free, and downloading it creates no obligation to appoint Formiti or subscribe to Privacy360.
How is the toolkit delivered?
Complete the form with a business email address and the PDF download link will be provided immediately and sent by email.
Co-produced by Formiti and Privacy360
Advisory expertise, operationalised in a platform.
Formiti brings the advisory side: Legal Consultants who interpret the statute, Privacy Architects who convert it into school workflows, and Technical Operations engineers who implement the controls. Privacy360 is the platform that turns each compliance step into an audit-ready dashboard, so evidence is produced in minutes rather than reconstructed over weeks.
Next step
Thailand PDPA compliance, run for you
Once you've reviewed the Toolkit, talk to us about our Thailand PDPA compliance service — DPO appointment, consent frameworks, transfer mechanisms and audit-ready evidence, delivered as a managed service.