Thailand PDPA

Personal Data Protection Act: data processing software inventory, controller accountability.


Short name	PDPA
Region	Asia-Pacific
Country or scope	Thailand
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers PDPA

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 13 controls from Safeguard's control catalog for PDPA.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 24: 2 written for PDPA and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`TH-PDPA-37-1` Security Measures	Controllers must provide appropriate security measures to prevent unauthorized loss, access, use, alteration, or disclosure of personal data, which for processing software implies integrity assurance of its components (PDPA B.E. 2562 s.37(1))	Scan
`TH-PDPA-39` Records of Processing	Controllers must maintain records of processing activities for inspection, which extends to knowing the software components performing that processing (PDPA B.E. 2562 s.39)	Scan
`TH-PDPA-40` Processor Obligations	Data processors act under controller instructions and must implement security measures, so third-party software suppliers involved in processing must be identifiable (PDPA B.E. 2562 s.40)	Scan
`TH-PDPA-37-4` Breach Notification Readiness	Controllers must notify the PDPC of breaches within 72 hours of becoming aware; assessing whether a disclosed vulnerability affects processing systems requires versioned, identifiable components (PDPA B.E. 2562 s.37(4))	Scan
`TH-PDPA-37-ID` Vulnerability Exposure Assessment	Maintaining appropriate security over time requires matching processing software against known vulnerabilities, which needs standard identifiers on components (PDPA B.E. 2562 s.37 security duty, ongoing review)	Scan
`TH-PDPA-39-DOC` Inspectable Documentation	Records kept for PDPC inspection should be dated and identifiable documents; a timestamped SBOM with a document ID evidences the software-inventory portion of those records (PDPA B.E. 2562 s.39 record-keeping duty)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`PDPA-S19`	Collect Personal Data Under a Lawful Basis
`PDPA-S20`	Provide Data Subjects with Comprehensive Notice
`PDPA-S22`	Obtain Explicit Consent in Clear and Plain Language
`PDPA-S23`	Provide Parental Consent Mechanism for Minors
`PDPA-S26`	Restrict Processing of Sensitive Personal Data
`PDPA-S27`	Implement Security Measures Appropriate to Risk
`PDPA-S28`	Govern Data Processors by Written Agreement
`PDPA-S30`	Retain Personal Data Only as Long as Necessary
`PDPA-S37`	Notify PDPC and Data Subjects of Personal Data Breaches
`PDPA-S39`	Process Cross-Border Transfers Lawfully
`PDPA-S40`	Appoint a Data Protection Officer Where Required
`PDPA-S41`	Maintain Records of Processing Activities
`PDPA-RIGHTS`	Fulfil Data Subject Rights Requests

Policy templates

Written for PDPA:

Consent Management and Data Subject Rights Policy (PDPA Thailand)
Data Breach Notification and Cross-Border Transfer Policy (PDPA Thailand)

And 22 from the standard set, adapted to PDPA.