You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

August 10, 2026

Thailand’s Draft Compliance Guidelines Position ROPA as Core Accountability Tool

Subscribe to Updates

Thailand’s Office of the Personal Data Protection Committee (PDPC) recently released draft guidance on records of processing activities (ROPA) for personal data controllers and processors under the Personal Data Protection Act B.E. 2562 (2019) (PDPA). The draft guidance, which was presented to the public on July 7, 2026, addresses both controller records of collection, use, and disclosure of personal data and processor records of processing activities carried out on behalf of controllers. If implemented, the guidance will significantly expand organizational expectations for ROPA preparation, maintenance, and use across all sectors.

Key Takeaways

The draft guidance contains several important implications for organizations subject to the PDPA:

  • ROPA reframed as a core accountability tool. The guidance elevates ROPA from an administrative record to a central accountability mechanism, connecting controller duties with recordkeeping obligations.
  • ROPA as a source for privacy notices and governance documents. ROPA should serve as the primary source for privacy notices and align with consent management, retention schedules, DPIAs, incident response plans, and vendor contracts.
  • Expanded scope across all activities. ROPA must cover all processing activities across the organization—including security, finance, HR, and external contractors—with correct controller or processor classification for each.
  • Ongoing maintenance and auditability. ROPA must be updated for any change to systems, purposes, or processors, reviewed at least annually, and maintained with version control and a designated owner.
  • Enhanced vendor, processor, and cross-border transfer requirements. Organizations must document all processors, external recipients, and cross-border transfers, specifying purposes, access scope, and destination countries.
  • Linkage with risk assessment, DPIAs, and LIAs. ROPA should assign risk levels to each activity and identify when data protection impact assessments (DPIAs) or legitimate interests assessments (LIAs) are required, functioning as a risk-management tool.
  • ROPA and data breach readiness. Incomplete ROPA can delay breach response and notification. Organizations should map data flows, vendors, and security measures in advance.

Potential Impact

The draft guidance will require operational and governance changes for most organizations:

  • Operational overhaul. Organizations will need to expand ROPA beyond IT to cover all departments and activities, including HR, marketing, security, and finance.
  • Governance alignment. ROPA must align with privacy notices, consent management, retention schedules, DPIAs, incident response plans, and vendor contracts, requiring cross-functional coordination.
  • Vendor management. Organizations must identify all processors, subprocessors, external recipients, and cross-border transfers; document access scope and destination countries; and execute data processing agreements.
  • Ongoing maintenance costs. Annual reviews, version control, change logs, and mandatory pre-launch updates will create recurring compliance workloads.
  • Marketing and AI activities. Higher-risk processing activities, including certain targeted marketing, customer behavior analysis, and AI-based tools may require DPIAs before launch.
  • Breach response preparedness. Organizations with incomplete ROPA may face delayed breach notifications and regulatory scrutiny.

The highest-risk areas include incomplete activity inventories, incorrect controller/processor classification, failure to identify lawful bases or retention periods, missing vendor or cross-border records, and lack of auditability.

Strategic Outlook

As the draft guidance continues to move toward formal adoption, organizations can use it as a prompt to refresh their data maps, ROPA templates, privacy notices, consent management, retention schedules, DPIA and LIA triggers, vendor contracts, and breach response documentation before the guidance is finalized. Specific actions organizations can take based on the current draft include:

  • Preparing ROPA as an organization-wide register covering all processing activities, not just IT systems.
  • Mapping whether each party is a controller or processor for each activity.
  • Assigning a ROPA owner, implementing version control, and maintaining a change history.
  • Requiring ROPA updates before launching new systems, adding new purposes, changing processors, or introducing new technologies.
  • Identifying all processors, subprocessors, external recipients, and cross-border transfers with documented purposes, access scope, and destination countries.
  • Using ROPA to identify high-risk activities and trigger DPIAs or LIAs where appropriate.

With this indication that the PDPC expects ROPA to assume a more central role in organizational privacy compliance programs, organizations that adjust their ROPA practices to match these new expectations will be better placed to demonstrate accountability and respond quickly in PDPC-related matters.

Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

July 11, 2025
On June 10, 2025, Thailand’s Supreme Administrative Court accepted for consideration a pivotal lawsuit concerning the regulatory obligations of administrative agencies over internet-based television broadcasting services, commonly referred to as over-the-top (OTT) services. This court’s decision in the case may set important precedents for how OTT platforms are regulated, especially regarding consumer protections and advertising practices. Background A user of an OTT television application initiated legal action against the National Broadcasting and Telecommunications Commission (NBTC) and related officials, alleging that the lack of clear regulatory criteria and oversight allowed OTT operators to broadcast general television content while compelling users to view advertisements before and during programming. The plaintiff argued this constituted consumer exploitation and claimed that the responsible authorities neglected or delayed their statutory duties under the Act on the Organization to Assign Radio Frequencies and Regulate Broadcasting, Television, and Telecommunications Services B.E. 2553 (2010). Initially, the Central Administrative Court declined to accept the lawsuit. However, on appeal, the Supreme Administrative Court determined that the claim fell within its jurisdiction, noting that OTT television services—defined under section 4 of the governing act—are subject to the same regulatory framework as traditional television services, regardless of the transmission method (frequency, cable, internet, or other system). Implications for OTT Services The key implications for OTT services concern the following issues: Regulatory oversight: The court recognized that OTT television services are explicitly covered under Thailand’s broadcast regulatory regime. Regulatory agencies may be compelled to establish clear operational rules and oversight mechanisms for OTT providers. Consumer protections: The plaintiff’s claim that excessive or unavoidable in-program advertising constitutes consumer exploitation was acknowledged as a matter of public interest. This may prompt stricter advertising standards for OTT platforms. Licensing requirements: The case raises the prospect that OTT operators may be required to obtain licenses from the
Read More
July 10, 2025
For companies and individuals doing business in Vietnam, a common question is whether electronic signatures (e-signatures) are legally recognized under Vietnamese law. This matter is governed by Law No. 20/2023/QH15 on Electronic Transactions issued on June 22, 2023 (ETL 2023) and its guiding legal documents such as Decree No. 23/2025/ND-CP dated February 21, 2025, and Circular 06/2024/TT-BTTTT dated July 1, 2024 (Circular 06). Recognition of Validity of E-signatures in Vietnam As a general principle, the ETL 2023 confirms that an e-signature cannot be denied legal validity solely due to its electronic form. The law categorizes e-signatures into three types: Type 1: Specialized e-signatures for organizations Type 2: Public digital signatures for individuals and organizations Type 3: Specialized digital signatures for government agencies Among these types, only secure specialized e-signatures (a secure e-signature of type 1) and digital signatures (type 2) are explicitly granted the same legal validity as handwritten (wet) signatures. This distinction is particularly important in legal disputes and for transactions with government agencies. (For more details, please refer to our previous article.) Domestic e-signatures A domestic organization can choose to use secure specialized e-signatures (type 1) and/or digital signatures (type 2) while a Vietnam-based individual can choose digital signatures (type 2) for their transactions—particularly for those involving government agencies and transactions of high value and complexity which require stronger legal protection. Specialized e-signatures (type 1) can be created by the organizations themselves, and additionally must be “secure” to be explicitly recognized as having the same legal validity as handwritten signatures. For clarity, “secure” specialized e-signatures are those certified (granted a safety certificate) by the Ministry of Science and Technology (MST). (This was formerly the responsibility of the Ministry of Information and Communications, which was merged with MST under Vietnam’s 2025 administrative restructuring.) Digital signatures (type 2) are
Read More
July 9, 2025
On June 16, 2025, the National Assembly of Vietnam adopted Law No. 75/2025/QH15 amending and supplementing a number of articles of the 2012 Advertising Law, with an effective date of January 1, 2026. The amended Advertising Law was enacted to further refine the legal framework for advertising activities in the modern era. Online Advertising Under the amended Advertising Law, “online advertising” is defined to encompass not only advertising on electronic newspapers and electronic information pages (as provided under the 2012 Advertising Law) but also advertising on other electronic venues, including social media, online applications, and digital platforms with internet connection. The amended Advertising Law also imposes new requirements for online advertising, including: Identification signs: Advertisements must have clear identifiable signs in numbers, letters, symbols, images, or sounds to distinguish them from non-advertising content. Control features: For advertisements not in fixed areas, there must be easily recognizable features and icons that allow recipients to turn off the advertisement, notify the service provider of violating advertising content, and refuse to view inappropriate advertising content. Linked content: Content in the links embedded in advertisements must comply with the law. Advertising service providers and publishers must have measures to check and monitor the linked content. Advertising on social media: Organizations and enterprises providing social media services must offer users features to distinguish advertising content from other content. Signage for sponsored content: When advertising, users of social media services must use signs to differentiate advertising or sponsored content from other content they provide. In response to the above requirements for online advertising, the amended Advertising Law sets out obligations of advertisers, advertising service providers, advertising publishers, and advertising conveyors in relation to online advertising. Among these, it is notably the responsibility of individuals and organizations engaging in online advertising to prevent and remove violating
Read More
July 1, 2025
Now halfway through 2025, Thailand continues to advance in the realm of data privacy, with the ambitious goal of achieving zero data breaches. The Personal Data Protection Committee (PDPC), an independent government body established by the Personal Data Protection Act (PDPA), is taking a more proactive approach, having published several rulings and orders to enhance data protection measures and clarify compliance expectations for businesses. Here is a look back at Thailand’s data privacy developments in the first half of the year. Strengthening Law Enforcement and New Guidance for Compliance Enforcement of existing data protection laws and regulations has taken a step forward this year. Some of the specific initiatives include: Increased enforcement by the PDPC. A key trend to watch from the first half of 2025 is the PDPC’s active enforcement of the PDPA as it intensifies oversight through compliance orders and public warnings against noncompliant organizations while ramping up efforts to prevent and halt the illegal trading of personal data by actively monitoring emerging societal issues. Call center scams and cyber fraud control. Thailand published an amendment to the Emergency Decree on Measures for the Prevention and Suppression of Technological Crimes to strengthen measures against technological crimes, particularly targeting call center scams and cyber fraud. Orders from the Expert Committee. Several orders issued by the Expert Committee under the PDPA were announced in the first half of this year. These include directives for data controllers to take corrective actions to comply with the PDPA, as well as initiatives to raise awareness of data privacy within organizations, reflecting the regulator’s focus on promoting organizational awareness and compliance. A guideline report summarizing the Expert Committee’s decisions and orders was also published to serve as a reference for compliance. Public issue monitoring. The PDPC has been taking a more proactive approach
Read More