Notary attorneys
The Personal Data Protection Act B.E. 2562 has been fully in force since 1 June 2022. Any organisation that co
Corporate services
The Personal Data Protection Act B.E. 2562 has been fully in force since 1 June 2022. Any organisation that collects, uses or discloses personal data needs a correct lawful basis for each activity, the supporting documentation, and a working channel for data subjects to exercise their rights.

Many organisations still equate PDPA with cookie banners and collecting as many consents as possible. That approach wastes effort and increases risk: consent is the weakest lawful basis and can be withdrawn at any time. In employment and regulatory contexts another basis is usually more appropriate.
This page sets out the minimum document set, a workable implementation order, and the points regulators and complainants probe first. It is general planning information, not case-specific legal advice. Fees are not published — ask our team by phone, LINE or email.
The Personal Data Protection Act B.E. 2562 has been fully in force since 1 June 2022. Any organisation that co
Provinces · 50+77
Checked against the intended destination and receiving authority
Send your company profile, headcount and existing documentation by LINE, phone or email — we scope the work an
A DPO must be appointed in specified cases, including where the core activity involves large-scale processing requiring regular monitoring, or processing of sensitive data. Organisations outside those cases should still name an internal owner.
The detailed criteria sit in notifications issued by the Personal Data Protection Committee, which continue to be published. Check the latest notifications from the PDPC office before concluding that your organisation is exempt.
Maximum administrative fines, DPO appointment thresholds and the criteria for cross-border transfers sit in the Act and in Committee notifications that continue to be issued. Check the current text with the PDPC office before making a decision.
This page is general planning information rather than legal advice on a specific matter, and we do not guarantee the outcome of any complaint or regulatory review.
Limitations and variable facts
Maximum administrative fines, DPO appointment thresholds and the criteria for cross-border transfers sit in the Act and in Committee notifications that continue to be issued. Check the current text with the PDPC office before making a decision.
When did the PDPA take full effect?
The Personal Data Protection Act B.E. 2562 came fully into force on 1 June 2022, after royal decrees had postponed several chapters.
Do we need consent for everything?
No. Consent is one lawful basis among several. Contract performance, legal obligation and legitimate interest often fit better. Collecting unnecessary consent makes the process fragile because it can be withdrawn at any time.
Does the PDPA apply to very small companies?
Yes — there is no size exemption, although the depth of documentation should be proportionate to actual risk. Small organisations should start with the processing record, privacy notices and vendor agreements.
Is workplace CCTV covered?
Yes. Identifiable footage is personal data. You need signage, a stated purpose, a retention period, defined access rights and security controls over the recording system.
Who must be notified after a data breach?
The PDPC office must be notified without delay and, where feasible, after document review of becoming aware. Where the breach poses a high risk to individuals' rights and freedoms, the affected data subjects must also be notified together with remedial guidance.
Can we send employee data to our overseas parent?
Yes, where a lawful cross-border transfer condition is met — for example an adequate destination standard or approved binding intra-group data protection policies. Check the current Committee notifications before transferring.
How long can we keep unsuccessful job applications?
The Act sets no fixed number of years. Set a necessary and reasonable period for the stated purpose, disclose it in the applicant privacy notice, and delete or anonymise the data when the period ends.
Must every organisation appoint a DPO?
No. Appointment is mandatory only in the specified cases, such as large-scale regular monitoring or sensitive data as a core activity. Review the latest Committee notifications to assess your position.
How is your PDPA implementation fee set?
By number of departments, systems holding personal data, vendor count and training scope. Contact our team by phone, LINE or email for a written quotation.
Answers written from real files: what to prepare, who certifies what, and business-day estimates.
Not always. A DPO is required where core activities involve regular monitoring of personal data on a large scale, or where processing sensitive data is a core activity. Companies outside those triggers still need a privacy policy, a record of processing activities, a correct lawful basis for each purpose and a working channel for data subject requests, so the compliance work does not disappear.
You need a lawful basis plus a recognised cross-border transfer mechanism, such as standard contractual clauses between exporter and importer, binding corporate rules within the group, or consent obtained after the risks were explained. Record the data categories, purpose, retention period and recipient in your processing register so you can answer a regulator or a customer's audit team without reconstructing the file.
It can. The law reaches organisations outside Thailand that offer goods or services to data subjects in Thailand or monitor their behaviour there. In many of those cases a representative in Thailand must be appointed in writing. Keep a record of processing activities and provide a contact channel that genuinely answers data-subject requests during Thai business hours.
The working standard is notification to the Personal Data Protection Committee office without delay and within seventy-two hours of becoming aware, unless the breach is unlikely to affect the rights and freedoms of individuals. Where the risk is high, the affected individuals must also be told, together with remedial guidance. Prepare an incident log template and an owner list before anything happens.
Not always. The obligation arises where core activities involve regular monitoring of personal data on a large scale, or where processing sensitive data is a core activity. A small business holding basic customer contact details usually falls outside that, but it still needs a privacy notice, a record of processing activities and a working channel for data subject requests.
Notify the regulator without delay and within seventy-two hours of becoming aware, unless the breach is unlikely to affect individual rights and freedoms. Where the risk is high, affected individuals must also be told, together with remedial guidance. Prepare an incident log template and an escalation chart in advance, because a live incident rarely leaves time to design the process from scratch.
It can. The law reaches controllers and processors outside Thailand where they offer goods or services to data subjects in Thailand or monitor their behaviour here. In that case a local representative may be required. Assess this before launching a Thai-language website or a Thai payment flow, rather than after the first data subject request arrives.
A DPO is required where core activities involve regular and systematic monitoring of data subjects on a large scale, where large-scale sensitive data is processed, or where a public authority is involved. Many companies below that threshold still name an accountable privacy contact, because responding to access and deletion requests within the statutory window needs a named owner.
Scope and purpose of processing, the categories of data and data subjects, security measures, sub-processor approval, breach notification timing back to the controller, assistance with data subject requests, audit rights, and deletion or return at the end of the engagement. Reviewing existing vendor contracts against that list is usually the fastest gap-closing exercise available.
The appointment duty follows the nature of the processing, not headcount alone. If core activities involve systematic monitoring on a large scale or processing sensitive data as a principal activity, the duty applies to a small team as well. Build the record of processing activities first, then test it against the statutory triggers rather than judging by organisation size.
Identify the lawful basis, post a visible notice before the monitored area is entered, set a retention period with automatic deletion, restrict who can access footage and log those accesses, and have a route for a data subject asking to see footage of themselves. Any disclosure to an outside party needs a lawful ground and a written record of the transfer.
As a general rule the regulator is notified without delay and where feasible within seventy-two hours of becoming aware, and where the incident poses a high risk to rights and freedoms the affected individuals are told as well, together with remedial steps. Prepare the incident log, the named responsible person and the notification channel in advance; seventy-two hours passes faster than teams expect.
Yes. The obligation follows the collection and use of personal data, not headcount. The minimum set is a privacy notice, a record of processing activities, a lawful basis for customer and employee data, a channel for data-subject requests, and agreements with external processors. Start by mapping what data you actually hold, then write documents that match the practice rather than an ideal.
Yes, with a lawful basis and appropriate safeguards — typically an intra-group transfer agreement setting out purpose, data scope, retention period and data-subject rights, with advance written notice to staff. The point most often challenged is transferring more data than the purpose requires. We narrow the field list to what is genuinely used and draft the supporting documents around it.
A clear lawful basis, an employee privacy notice, a record of processing activities, and an intra-group data transfer agreement. Where the recipient requires wet-ink originals, the authorised signatory's signature is usually certified first. We advise on the drafting of the transfer terms alongside the certification work, because the wording is what a regulator or counterparty reviews — not the stamp.
Record the request in writing, check whether a statutory retention duty — accounting or tax records, for example — requires part of it to be kept, then respond in writing stating what was erased, what was retained, and why. Keep the exchange in the governance file. If it later has to serve as evidence across borders, we arrange the certification layers so the file is actually usable.
A clearly identified lawful basis, an intra-group data transfer agreement setting out safeguards, and an employee privacy notice that already discloses the cross-border transfer. If the parent asks for verified copies, we prepare a certified translation and signature certification bundle usable across jurisdictions. We treat this as advisory work rather than pure document handling, so the wording is reviewed before anything is certified.
Issue it as a certified translation bound to the Thai original, and state in the document that the Thai version prevails if the two conflict. The counterparty can then review it without your company being bound by a drifting translation. If they need more assurance, an authorised-signatory signature certification layer can be added. We advise which layer to stop at based on the real risk in the transaction.
You need a lawful basis for the cross-border transfer and supporting paperwork, typically an intra-group data protection agreement, alongside notice to the data subjects consistent with your published policy. The common failure is transferring first and papering it afterwards. We put the sequence in the right order and prepare a bilingual set when the parent wants it for its own records.
At least annually, and immediately whenever you change the systems that hold personal data, add an external processor, or open a new collection point such as an online form or a new CCTV position. A notice that no longer matches actual collection is the easiest gap for anyone to spot. We set a review cycle and align the wording with what the business really does.
Data needed to run the employment relationship — name, bank account, tax details — belongs under contract or legal obligation, not consent. Consent can be withdrawn at any time, which would leave you unable to pay salaries. Reserve separate written consent for optional uses such as event photography or marketing. Choosing the wrong basis is the single most common defect we find in employee document sets.
An intra-group transfer agreement identifying the data categories, purpose, retention period, and security measures, plus a record of processing activities that shows the data route, and a privacy notice telling employees in advance. Where the foreign counterparty wants a signed original for its own audit, that set can proceed to Notarial Services Attorney signature certification and MFA Consular legalisation.
No, and defaulting to consent is a common design error. The law provides other lawful bases — performance of a contract, legal obligation, vital interest, and legitimate interest among them. Payroll processing, for example, rests on contract and legal obligation, not on an employee's consent, because consent given under an employment relationship is easy to challenge. Map each processing activity to the basis that genuinely fits before drafting any notice.
A DPO is required where the core activity involves regular and systematic monitoring of personal data on a large scale, or where sensitive personal data is processed as a core activity, and for public authorities. Many small service companies do not meet the threshold, but they still need a named contact point for data subject requests. Appointing someone with no authority to change a process is worse than naming a reachable owner who can.
Contain first, then record. Note the time of discovery, the categories and approximate volume of data involved, and the likely cause, because notification timelines run from awareness rather than from the end of the investigation. Thai law expects notification to the regulator without undue delay where the incident risks affecting rights and freedoms, and notification to affected individuals where the risk is high. A contemporaneous incident log is the evidence that decisions were reasonable.
Cross-border transfer is permitted where the destination has adequate protection, or where recognised safeguards such as binding corporate rules or contractual clauses are in place, or where a specific exception applies. In practice the answer is a written intra-group data transfer agreement plus a transfer record that names the data categories, purpose and recipient. Group companies frequently already move the data before anyone documents the basis; the paperwork should precede the pipeline.
ลูกค้าจริง 60+ สัญชาติทั่วโลก ใช้บริการ Notary, แปลรับรอง, MFA และสถานทูตกับเรา
"ทีมงานช่วยจัดเตรียมหนังสือมอบอำนาจสำหรับใช้ที่ออสเตรเลียได้รวดเร็วมาก พร้อมประสานงาน NAATI ครบจบในที่เดียว"
"Very professional notary service. Document was certified, translated and ready for the UK embassy in two business days."
"ใช้บริการรับรอง Affidavit + รายชื่อผู้ถือหุ้นเพื่อจดทะเบียนสาขาที่สิงคโปร์ ทีมงานละเอียดและตอบกลับไว"
Compliance work rarely stops at one page. These are the neighbouring topics in this cluster and the certification steps most files continue into.
Other topics in this cluster
Certification steps this often leads to
See the cluster overviewSend your company profile, headcount and existing documentation by LINE, phone or email — we scope the work and reply in writing within one business day.
Short answer: Company documents such as certificates, board resolutions, powers of attorney and financial statements must be signed by the authorised directors shown on the company affidavit, sealed where required, then have the signature certified by a notarial services attorney before consular and embassy legalisation in the order the receiver requires.
Thai legal entities
Foreign companies and branch offices
Tenders, contracts and investment files
1. Verify signing authority against the affidavit
Match director names, the number of required signatories and the seal condition against the latest affidavit; a signature outside those conditions invalidates the whole set.
⏱ Confirmed with quotation
2. Draft the documents and translation
Draft resolutions or powers of attorney with a defined scope, validity period and covered transactions, with names spelled exactly as in the passport.
⏱ 1–2 working days (estimate)
3. Sign before a notarial services attorney
Authorised signatories appear in person with original identity documents so the attorney can certify the signature and the signer's capacity.
⏱ 1 working day (estimate)
4. File for consular legalisation
Submit the certified set to the Department of Consular Affairs through the channel currently offered.
⏱ 1–3 working days (estimate, excluding agency queues)
5. File at the destination embassy and deliver
Submit to the receiving country's embassy or consulate under its own conditions, then deliver with a backup copy for company records.
⏱ 2–10 working days (estimate, varies by mission)
| Criterion | In-house | Our team handles it |
|---|---|---|
| Signing authority check | HR or the company secretary checks it internally | We reconcile the affidavit and seal conditions before printing |
| Resolution and POA drafting | Generic templates that may not match the transaction | Drafted for the actual transaction with wording receivers have accepted |
| Multi-layer filing | Staff make repeated trips between agencies | We run the layers continuously and report status at each one |
| Risk to the closing date | High when a rejection lands near signing day | Screened in advance by a team with more than 15 years in this field |
If you would rather your team not spend days moving files between agencies, we can run the chain from authority check to delivery. Initial consultation is available by phone, LINE or email.
All durations are working-day estimates excluding agency queues, and are not a guarantee of any authority's decision.
Sources: กรมพัฒนาธุรกิจการค้า (DBD) — บริการข้อมูลนิติบุคคล · กองสัญชาติและนิติกรณ์ กรมการกงสุล กระทรวงการต่างประเทศ · สภาทนายความในพระบรมราชูปถัมภ์ · Last reviewed: 2026-08-10
Document and legalization advisers with 15+ years of practice
Before we start, we read your actual documents and confirm the legalization route matches what the receiving authority asks for. During the work we report progress, and after delivery we still answer questions about how to submit the file.
We prepare documents to the requirements of the receiving authority. Any approval decision remains at that authority's discretion.
Send your documents on LINE for a preliminary review, a recommended legalization route and a written quote.
General guidance, not a case-specific determination. Requirements change with agency notices — confirm with the receiving authority before you act.
Sources: กรมพัฒนาธุรกิจการค้า กระทรวงพาณิชย์ (DBD) · สำนักงานคณะกรรมการส่งเสริมการลงทุน (BOI) · กองสัญชาติและนิติกรณ์ กรมการกงสุล กระทรวงการต่างประเทศ · สภาทนายความในพระบรมราชูปถัมภ์ · Last reviewed: 2026-08-04
What foreign tax authorities and banks actually ask for, how Thai tax documents are certified for use abroad, and where the process usually stalls.
The basic test in the Revenue Code is presence in Thailand for an aggregate of 180 days in a tax year. How days are counted and how foreign-sourced income is treated follow Revenue Department practice, which has been updated in recent years. Confirm your own position with the Revenue Department or your accountant before filing anything abroad.
It is issued by the Revenue Department and shown to a foreign tax authority to claim relief under a double tax agreement — typically a reduced withholding rate on dividends, interest or royalties. Foreign payers usually want the latest year and sometimes ask for consular legalisation on top. Ask the recipient exactly which form they need.
Usually yes. The receiving body normally wants a certified English translation, and many countries also require legalisation by the Department of Consular Affairs followed by their own embassy. The documents seen most often are the residence certificate, tax payment receipts, filed returns and an employer's letter.
For the paperwork, yes. Once the Apostille Convention enters into force for Thailand on 28 February 2027, documents used in another contracting state carry a single apostille instead of a further embassy step. The substance of treaty relief does not change — that still depends on the specific treaty article and the foreign authority's assessment.
Usually the latest company affidavit from the Department of Business Development, the shareholder list, filed financial statements and the relevant board or shareholder resolutions. Where a director signs a statement of fact, a notarial services attorney can authenticate that signature; the document is then translated, certified and put through the legalisation chain the recipient prescribes.
We own the document and certification side — the correct route, in the correct order — and coordinate with your accountant or tax adviser. We do not guarantee any tax authority's decision, and we do not recommend filing before the treaty article has been checked. Have our team review the document set first by phone, LINE or email.
Sources: กรมสรรพากร (The Revenue Department) — ถิ่นที่อยู่ทางภาษีและ อนุสัญญาภาษีซ้อน · กองสัญชาติและนิติกรณ์ กรมการกงสุล กระทรวงการต่างประเทศ · HCCH — Apostille Section (สถานะภาคีของไทย) · Last reviewed: 2026-08-11
These are illustrative composites of common corporate document patterns, not individual client records, and not a guarantee of any authority's decision. Durations are approximate working-day ranges.
Illustrative scenarios, not individual client records · Last reviewed 2026-08-09
Short answer: Registrars refuse names that clash or breach naming rules, objectives that do not cover the real business, foreign shareholder powers of attorney without a complete certification chain, and incomplete office-address evidence.
We design the shareholding, objectives and foreign-document chain around the licences you will need next — advice first, filing second.
Durations are working-day estimates excluding agency queues, and are not a guarantee of any authority's decision.
Sources: กรมพัฒนาธุรกิจการค้า (DBD) · สภาทนายความในพระบรมราชูปถัมภ์ · Last reviewed: 2026-08-10
Company documents such as certificates, board resolutions, powers of attorney and financial statements must be signed by the authorised directors shown on the company affidavit, sealed where required, then have the signature certified by a notarial services attorney before consular and embassy legalisation in the order the receiver requires.
If you would rather your team not spend days moving files between agencies, we can run the chain from authority check to delivery. Initial consultation is available by phone, LINE or email.
Durations are working-day estimates excluding agency queues and are not a guarantee of any decision.

Statements on this page follow the authorities below. Confirm current requirements with the authority before filing. Last reviewed 2026-07-29.
Fees are not published online — ask our team by phone, LINE or email for a scope-based quote.