Order PDPA & Cybersecurity — send the file, we handle the rest
PDPA & Cybersecurity: Policies, consent, records of processing and breach response. The principal authority is Personal Data Protection Committee Office. Detailed requirements change over time, so confirm the current conditions before each filing.
If you would rather not deal with the counters yourself, send photos of your documents first. We confirm the exact document set, the certification route the receiving authority accepts, and a realistic timeline before any work begins.
อ่านภาษาไทย: สั่งงานPDPA และความมั่นคงปลอดภัยไซเบอร์
What you send us
- A data-flow map of personal data in the organisation
- Current privacy notice and consent forms
- Contracts with external data processors
- Record of processing activities
- The current record of processing activities (ROPA)
- Data processing agreements with every external service provider
What we do once you order
- 1
Case assessment: define the end purpose and confirm that Policies, consent, records of processing and breach response is what the receiving party actually requires.
- 2
Collect and pre-check every document so names, dates and spelling match before filing with Personal Data Protection Committee Office.
- 3
Prepare translations or supporting papers in the prescribed format, then have a second reviewer verify them.
- 4
File with Personal Data Protection Committee Office through the channel currently open, keeping proof of every submission.
- 5
Track status, answer officer queries and correct documents immediately if anything is challenged.
- 6
Collect the result, verify it before forwarding, and archive a complete set for future reference.
What sets the pace on this service
| Stage | Who acts | What sets the pace |
|---|---|---|
| 1. Case assessment and document check | Our team + client | Starts as soon as complete copies arrive; duration depends on how complete the PDPA & Cybersecurity file is. |
| 2. Prepare translations and supporting papers | Translator + second reviewer | Depends on page count and terminology complexity; rush scheduling is possible. |
| 3. Filing with the authority | Our team ↔ Personal Data Protection Committee Office | Governed by Personal Data Protection Committee Office's queue and discretion at the time, so we do not promise a fixed completion date. |
| 4. Follow-up and handling objections | Our team | If more documents or corrections are requested we refile continuously rather than restarting the process. |
| 5. Final check and delivery | Our team + client | Verified before forwarding, with a complete archived set kept for future filings. |
Where files get rejected — and how we prevent it
- Copying policy templates without mapping them to actual processing
- No tested breach-response procedure
- Cross-border transfers without a lawful basis
- Bundling every purpose into a single blanket consent
- No rehearsed breach-response procedure in place before an incident
Ordering with us vs. handling it yourself
| Aspect | Do it yourself | Order with us |
|---|---|---|
| Pre-submission document check | Self-checked, based on website notes or hearsay | Reviewed page by page by experienced staff, rejection risks flagged before filing |
| Understanding the destination requirement | You ask the receiving party and interpret the answer yourself | We map the destination's requirement against Personal Data Protection Committee Office's current practice before work starts |
| Time and travel | You book queues, file in person and wait at every stage | Our team files on your behalf in the planned sequence and reports progress |
| If the file is challenged | You diagnose the cause and refile yourself | We handle the correction and refiling without starting from scratch |
| Advisory role | No adviser when an unusual case appears | Advice throughout the PDPA & Cybersecurity case, backed by 15+ years of experience — not just filing |
Advisers, not just a processing vendor
Our team has advised on cross-border document work for over 15 years. Before any filing we tell you which document set the receiving authority actually accepts, which certification route fits, and where a faster lawful alternative exists. If a case should not proceed as planned, we say so and propose what will work.
We do not simply process paperwork — we advise throughout the case. With more than 15 years of experience we review your documents before anything is filed, flag where rejection risk sits, and sequence the full chain end to end. If you would rather not run the process yourself, send the documents for a no-obligation review first.
Ask for advice and a quoteQuestions people ask before ordering
What are the end-to-end steps for PDPA?
We review the facts and source documents, assemble and verify the file, submit to the PDPC (Thailand's data-protection regulator), follow up on official queries, and hand over the result with a full copy set. For PDPA a case manager tracks every stage and reports status. Call +66 83-249-4999 · LINE @NYCLI · nyclegal@ilc.ltd
Which documents are required for PDPA?
The baseline set is your ID or passport, the original documents relating to PDPA, proof of connection (house registration, company affidavit or the underlying contract) and a power of attorney if a representative attends. The exact list follows the PDPC (Thailand's data-protection regulator) requirements on the filing date; we send a case-specific checklist first.
How long does PDPA take?
Turnaround depends on the PDPC (Thailand's data-protection regulator) queue, how complete the file is, and public holidays. We give a case-specific estimate after reviewing the actual documents and update it if anything changes — do not plan travel around generic figures found online for PDPA.
What costs are involved in PDPA?
Costs split into official fees at the published government rate and our professional fee. Fees are quoted case by case based on complexity and document volume — ask our team before work starts. For PDPA we confirm the cost breakdown in writing before work starts, so nothing is added mid-way.
Who is eligible to apply for PDPA?
Eligibility is set by the PDPC (Thailand's data-protection regulator) rules and generally turns on your personal status, your connection to the document or matter, and valid identification. Applicants abroad can usually act through a power of attorney. We confirm eligibility for PDPA before any filing.
Can PDPA be handled while I am overseas?
In many cases yes, through a power of attorney certified in the form required where you live; some documents must additionally pass a Thai embassy before use in Thailand. Only steps that legally require personal appearance cannot be delegated. We sequence PDPA to minimise travel.