--- title: "PDPA Compliance | OOZOU" description: "Practical PDPA compliance for Thailand: audits, consent flows, and privacy engineering from a founding partner of PDPA.org." canonical: https://oozou.com/services/pdpa-compliance locale: en --- # PDPA Compliance > Practical PDPA compliance for Thailand: audits, consent flows, and privacy engineering from a founding partner of PDPA.org. Thailand's PDPA applies to any organization handling the personal data of people in Thailand. Falling short means fines, criminal liability, and lost customer trust, and a privacy policy page alone does not fix that: compliance lives in how your products capture consent, where data is stored, and how fast you answer data subject requests. OOZOU is a founding partner of PDPA.org, the PDPA Alliance uniting legal, process, and technical specialists in one engagement. We handle the technical side: audits, consent and request workflows built into your products, and security controls that keep you compliant as you ship. ## Founding partner of PDPA.org PDPA.org is the PDPA Alliance: legal, process, and technology specialists who make organizations in Thailand PDPA compliant in a single engagement. OOZOU co-founded the alliance and leads its technical side, from audits to consent systems and secure data handling. Partner site: https://pdpa.org ## Key Capabilities - **PDPA Audit & Gap Analysis**: We map how personal data enters, moves through, and leaves your systems, then rank the gaps between current practice and what the PDPA requires. - **Consent & Cookie Management**: Purpose-specific consent flows, cookie banners, and preference centers, with consent records you can actually produce when a regulator or customer asks. - **Data Subject Request Workflows**: Access, correction, deletion, and objection requests handled through workflows your team can run within statutory deadlines, not a scramble across databases. - **Privacy & Security Engineering**: Data minimization, encryption, access controls, retention rules, and audit logging built into your systems, so compliance is a property of the product. ## Technologies We Use PDPA (Thailand), GDPR, Consent Management, Cookie Compliance, Data Mapping, DSAR Workflows, Encryption, Access Control & IAM, Audit Logging, ISO 27001 ## Our Approach 1. **Audit**: We inventory personal data across systems, vendors, and teams, and document how it is collected, used, shared, and retained. 2. **Gap Analysis**: We map findings against PDPA requirements and rank every gap by risk, so effort goes where the exposure is highest. 3. **Roadmap**: A prioritized remediation plan across legal, process, and technical work, with owners and timelines your team can commit to. 4. **Implementation**: We build the fixes: consent capture, data subject request handling, retention automation, and security controls inside your products. 5. **Training**: We train the people who touch personal data, from engineers to support staff, so good practice outlives the project. 6. **Monitoring**: Ongoing reviews, audit trails, and compliance checks that keep you covered as products, vendors, and regulation evolve. ## Budgets of All Sizes We work with budgets across the full range. The team adapts scope, size, and engagement model to what you can spend, without lowering the bar on how we build. - **Enterprise**: Full delivery teams for complex platforms, with the security, compliance, and process rigor large organizations expect. - **Growing Teams**: Flexible engagements that scale with you. Add capacity when you need it, scale back when you don't, without renegotiating from scratch. - **Small Business & Startups**: Lean, focused builds that get the essentials right. We help you trim scope, not quality, so a modest budget still ships a solid product. ## Why This Matters - **Lower Regulatory Risk**: Documented compliance and evidence you can produce on demand reduce exposure to fines and keep due diligence from stalling deals. - **Customer Trust**: Visible care with personal data is a selling point for customers, and for enterprise partners who audit their vendors. - **Privacy Built In**: Compliance implemented inside the product rather than as paperwork on the side, so new features ship without reopening old risks. - **Founding Partner of PDPA.org**: Through PDPA.org we work alongside legal and process specialists, so one engagement can cover the law, the process, and the technology. ## Frequently Asked Questions ### What does OOZOU's PDPA compliance service include? PDPA audits, consent management, data subject request workflows, data mapping, and the security controls that keep you compliant as you ship: encryption, access control, and audit logging. ### What is PDPA.org and how is OOZOU involved? PDPA.org is the PDPA Alliance, uniting legal, process, and technical specialists so organizations in Thailand can become compliant in a single engagement. OOZOU co-founded the alliance and leads its technical side. ### Who needs to comply with Thailand's PDPA? Any organization handling the personal data of people in Thailand, wherever the organization is based. Non-compliance carries fines and criminal liability, and a privacy policy page alone does not make you compliant. ### How is PDPA different from GDPR? They share core principles, consent, purpose limitation, and data subject rights, but PDPA has Thai-specific requirements and enforcement. We build controls that satisfy PDPA and align with GDPR where you operate in both jurisdictions. ## Related All services: [Services](https://oozou.com/services) ([markdown](https://oozou.com/services.md)). Case studies: [Case Studies](https://oozou.com/case-studies) ([markdown](https://oozou.com/case-studies.md)). --- Contact OOZOU: hello@oozou.com · +66 2544 0000 · https://oozou.com/contact More for AI agents: https://oozou.com/llms.txt · every page has a markdown twin at its URL plus ".md"