โซลูชัน PDPA ที่ออกแบบมาเพื่อ SME และ Startup โดยเฉพาะ

Grow the business and leave PDPA to us

Whether you need a starting document set tailored to the business, a monthly DPO, or the full run at certification — there is a package for it, inside a budget you set.

Is PDPA one of the things keeping you up?

You can stop worrying about it — this service is built for small and mid-sized businesses.

Worried about the budget

Afraid a PDPA programme costs a fortune — and that you'd be buying something built for a bigger company than yours.

Nobody owns it

The team is already at capacity, and nobody in it knows this law well enough to act as your DPO.

Afraid of the complexity

Not sure which documents a business your size needs, and afraid of downloading the wrong template and using it wrongly.

Why your organisation needs PDPA

“Not just a legal duty — business trust.”

Trust

Customers and partners know their data is handled safely, to international standards.

Avoid the big fine

PDPA breaches carry fines up to ฿5M — and possible jail for directors responsible.

Reputation

Professionalism and governance, visible in how you run a digital-age business.

บริการของเรา

A partner from the first document to the last

We turn a complicated law into something the business can actually run on day to day.

Written for your business (customisation)

No one-size-fits-all paperwork. We read how your business actually collects data and write to that.

We set the basics up with you

Guidance on the groundwork and on collecting customer data correctly — hands on until you are running.

A monthly DPO on your side

Like having counsel on staff: questions answered, new campaigns reviewed, and someone ready if an incident happens.

The advisory team working with a client
"It took PDPA — which looked like a mess — and made it something the sales team could actually use."
— An SME client, e-commerce
Packages

Choose the package that fits

Every package comes with guidance suited to the business, inside a budget you set.

Starter Kit

The starting document set

Best for: For a business just starting out that needs its basic documents to be legally right.

One-time, from 5,900฿

(The base document set, customised to your business)

I'm interested
  • The starting set — privacy notice, consent forms, contracts, base policies
  • Customised to your type of business
  • Guidance on putting them into use
Meets the PDPC's 2026 notification

Full Compliance

Ready for certification

Best for: For an organisation going for the certification mark.

Project-based

(Quoted to the size of the organisation)

Request a quote
  • Preparation for the Personal Data Protection Certification Mark
  • A system covering all 4 groups, 10 areas and 128 items of the PDPC's 2026 notification
  • Staff training and a full incident-response rehearsal

Documents, by function

Grouped to cover the whole organisation and every activity that touches personal data.

CUSTOMER FACING

กลุ่มเอกสารลูกค้า

  • Privacy Policy (นโยบายความเป็นส่วนตัว)
  • Cookie Policy (นโยบายการใช้คุกกี้)
  • Marketing Consent (แบบเผยแพร่ยินยอม)
  • Privacy Notice (ประกาศความเป็นส่วนตัว)
HR & INTERNAL

กลุ่มเอกสารฝ่ายบุคคล

  • Job Applicant Notice (ผู้สมัครงาน)
  • Employee Notice (พนักงาน)
  • Sensitive Consent (ข้อมูลอ่อนไหว)
  • CCTV Policy (กล้องวงจรปิด)
CONTRACTS & VENDORS

สัญญาและคู่ค้า

  • DPA (สัญญาสำหรับ Outsource)
  • Data Sharing (สัญญาโอนย้ายข้อมูล)
  • Vendor Due Diligence (ประเมินคู่ค้า)
  • Deletion Cert (หนังสือรับรองการลบ)
GOVERNANCE

งานหลังบ้าน & DPO

  • RoPA Template (บันทึกกิจกรรม)
  • DSAR Form (แบบใช้สิทธิ)
  • Data Breach Form (แจ้งเหตุละเมิด)
  • Internal Policies (ระเบียบภายใน)

How the work runs

Built on understanding the business, so the documents are right and usable.

1

Tell us what you need

Reach a consultant, or send the basics through the site form.

2

Analyse and assess

Specialists assess the risk and keep only the documents you actually need.

3

Propose the plan

The document list and scope, with a clear quotation.

4

Start immediately

Drafting begins, tailored to the business, with guidance for real use.

FAQ

Frequently asked

How the service works, in detail.

How does the monthly DPO package differ from Starter?

Starter (one-time): we produce the document set — privacy notice, consent forms and the rest — for you to publish. It does not include ongoing cover or future revisions.

DPO (monthly): four ongoing services that keep the PDPA system alive.

  • Legal review — marketing campaigns, partner contracts and new activities (a per-month allowance, agreed up front).
  • DSR management — drafting replies and running the process when a customer exercises their rights.
  • Consultation — staff questions answered over LINE or email.
  • Audit and update — risk reviews and policy updates as the regulator issues new notifications.

On a 12-month contract the Starter document set is included, with no joining fee.

What are your response times?

The DPO package works to three levels of urgency.

Normal

  • General advice, campaign checks, contract reviews.
  • Acknowledged within 1 working day, delivered within 3–5.

High

  • A complaint, or a data-subject rights request.
  • Acknowledged and under way within 24 working hours.

Critical — data breach

  • A leak or a breach. The law gives you 72 hours to notify the regulator.
  • Emergency support, answered within 4–6 hours.
What is NOT included in the monthly DPO package?

So the boundary is clear from the start, the DPO service does not cover:

  • Hands-on IT work. A DPO advises on measures; it does not configure servers, write code or install firewalls. We work alongside your IT team.
  • Litigation. If a matter reaches court that is a separate engagement, quoted separately.
  • Paying your fines. In law the data controller — the company — remains responsible. The DPO's job is to steer the system so the risk falls.
What documents does Starter Kit include, and who is it for?

For a small business or startup that needs the baseline the law requires. What you get is not an off-the-shelf template — it is customised to your business.

Because no two businesses are the same:

  • How much customer data you hold, and of what kind.
  • How you communicate with staff and partners.
  • Whether you run CCTV on the premises.

The privacy notice and consent forms cover the activities your business needs. Deeper security documents and internal SOPs are not part of this package.

Why take the monthly DPO package rather than just buying the documents?

Starter clears the urgent paperwork. But PDPA is really about what happens afterwards — and with nobody owning that, it lands on HR or marketing.

The DPO Partner package (from 15,000฿ a month) means:

  • Everything the law requires is looked after.
  • Registers and records — RoPA, breach-response procedures — beyond what Starter covers.
  • Specialists take the first hit if a complaint or an incident arrives.

Less legal exposure, and your team's time back.

How do we get certified under the PDPC's 2026 notification?

Under the PDPC's 2026 notification on personal-data-protection certification, an organisation may apply for a PDPA Certificate and Certification Mark.

It means passing a full assessment: 4 groups, 10 areas, 128 items — and scoring at least 90%.

  • Group 1 — organisation, oversight and policies.
  • Group 2 — training and awareness.
  • Group 3 — process: rights, transparency, RoPA, contracts, risk.
  • Group 4 — technology and security, including breach response.

If the certificate is the goal — for tenders, or for national credibility — Full Compliance is the package that builds the system and prepares all 128 items.

What documents does a full PDPA programme actually need?

An audit-ready programme runs to six groups of documents. How many of each you actually need depends on the size and complexity of the business.

1. Customer-facing

  • Privacy policy and notices — customers, partners, website.
  • Cookie policy and the short-form privacy statement.
  • Marketing consent form and event photography notice.
  • Consent form for minors.

2. HR

  • Job applicant and employee privacy notices.
  • Sensitive-data consent — health and background.
  • CCTV policy and the employment contract addendum.

3. Contracts and vendors

  • Vendor registration and assessment form.
  • Data processing agreement and sub-processor agreement.
  • Data sharing agreement and joint controller agreement.
  • PDPA contract clauses, supplier code of conduct, certificate of data deletion.

4. Organisation-level policies

  • The master data protection policy and consent management policy.
  • Data subject rights policy and breach management policy.
  • AI usage and data processing policy, and data retention policy.
  • Information security, access control and logging, backup and recovery, clean desk.

5. Standard operating procedures

  • DPO appointment letter.
  • DSR handling and breach handling procedures.
  • Deletion and disposal SOP, awareness and training plan, event management guideline.

6. Registers

  • Legitimate interest assessments and data protection impact assessments.
  • RoPA and data mapping, plus cross-border transfer agreements.
  • Consent log, DSR log and the breach incident register.

A small business can start with Starter for groups 1 and 2, or take the monthly DPO package and have the whole system built up over time.

Ready to raise your organisation's standard?

Tell us what you need or what you are unsure about and we will come back to you. Talk to us today and our specialists will give you an initial read and recommendations, free.

Talk to a specialist

How we use your data: The personal data in this form is used only to contact you back, or to answer what you asked.

Marketing consent (optional)

Shall LawMai send you what is new in legal and compliance? Plain-language summaries of new law, useful e-books, and member offers.

Understood — no marketing email from us. You can still follow LawMai's plain-language legal updates through our other channels.

Read the privacy statement

Security: LawMai is committed to protecting the personal data it receives. Your data is deleted within one (1) year following the year the relationship or service ends, or once you withdraw consent.

Your rights under the PDPA: You may request access, a copy, automated delivery, portability, erasure, destruction or suspension of your data via the rights-request form. Security measures, your rights, and full details are in the Privacy Notice for the general public

Withdrawing consent: If you no longer wish to receive LawMai news and legal-update emails, you may withdraw consent at any time, free of charge, via the consent-withdrawal form

Questions? Contact us at:
LINE Official: @Lawmai
เลขที่ 1 อาคารเอ็มไพร์ ทาวเวอร์ ชั้นที่ 47 ยูนิต 4703 ถนนสาทรใต้ แขวงยานนาวา เขตสาทร กทม. 10120
Tel: 065-955-4299, 02-119-5199 (Mon-Fri 09:00-18:00)

Your cart

Total

The final amount is calculated again at checkout.