Prepare for a Thai PDPC audit

A four-week playbook for a Thai hotel expecting a Personal Data Protection Committee audit. Not legal advice — engage a Thai lawyer for anything material.

Week 1 — Records of processing

List every category of Personal Data your property processes (guest, employee, supplier, marketing subscriber). For each, document the purpose, lawful basis, retention period, security measure, and Sub-Processor.

Week 2 — Consent evidence

Pull consent forms for the past 12 months. Confirm each of the six purposes has a separate tick-box (booking, F&B, marketing, loyalty, third-party sharing, extended retention). Bundled consents fail audit.

Week 3 — DPO readiness

Confirm your DPO is registered with the PDPC. Prepare their contact details, work location, and reporting line. Rehearse a data-subject request lifecycle: intake, verification, action, response — within 30 days.

Week 4 — Live dry-run

Ask an internal auditor or an outside PDPA consultant to run a mock audit. Focus on: sensitive data (passport / national ID retention), cross-border transfers, breach-notification playbook.

The PDPA Guest Consent module contributes the consent evidence layer automatically. The workspace's PDPA Portal handles the data-subject request lifecycle with an SLA clock.