Yes, but check what you paste in. Customer names, phone numbers or purchase history in a personal account means personal data is processed on servers abroad, which must meet the cross-border transfer rules (s.28).
Not live AI and not advice for your specific case. The interactive demo with 12 pre-written answers runs in Thai at /tools/ask/; other questions go to the Kooru legal team on LINE.
PDPA is not only about fines. It sets deadlines and criminal penalties that owners need to know before an incident, not after. Every number below comes from the Act itself.
Administrative fines under the s.90 group, e.g. processing without a legal basis or without security measures. Counted per case, not per year.
s.90From the moment you become aware of a breach, you must notify the Personal Data Protection Committee office (PDPC). Without a prepared procedure you will rarely make it.
s.37(4)Up to 1 year in prison for unlawfully using or disclosing sensitive data (health, religion, biometrics and others under s.26).
s.79 · s.26Kooru delivers a Gap Analysis with grades per area and a quote within 3 business days of receiving complete information.
Kooru Data ShieldBelow is a sample report for "Sample Café", a fictional shop we created to show the format. It is not a real client and every number is an example, but the structure is exactly what you receive.
A–F grades per area, findings ranked by risk and a fix plan you can actually execute. You decide whether to fix it yourself, buy templates or have our team do it.
Sample Café (fictional) · 2 branches + LINE OA + website
The shop collects member data through LINE OA and footage from cameras at 2 branches, but has no RoPA, no 72-hour breach procedure1 and no CCTV signs. These three can be fixed within 10 business days and would lift the overall grade to B.
No record of processing activities in any department
On the website, but no retention period and nothing in store
Marketing consent bundled into the membership terms
No purpose sign, no footage request form
No owner, no PDPC notification form
Ad agency and POS provider have no DPA
Requests accepted on LINE but deadlines not tracked
Good backups, but staff share one POS password
Likelihood → (1 very unlikely … 5 almost certain)
| Code | Checkpoint | Result | Ref. | Auditor note |
|---|---|---|---|---|
| C-01 | Record of processing (RoPA) for every department | ✕ | s.39 | None yet |
| C-02 | Privacy notice given before or at collection | ! | s.23 | Online only, not in store |
| C-03 | Marketing consent separate from membership terms | ✕ | s.19 | One tick covers everything |
| C-04 | CCTV sign with purpose and contact channel | ✕ | s.23 | Both branches |
| C-05 | PDPC notification within 72 hours, with an owner | ✕ | s.37(4) | Highest risk |
| C-06 | DPA with external processors | ! | s.40 | Cloud yes, agency no |
| C-07 | Rights request channel and tracking log | ! | s.30–35 | No log |
| C-08 | No sensitive data beyond what is needed | ✓ | s.26 | None found |
| C-09 | Cross-border transfers (cloud / AI tools) have a legal basis | ! | s.28 | AI summarises customer feedback, not assessed |
| C-10 | DPO duty assessed | ✓ | s.41 | Assessed, not mandatory |
| C-11 | Separate POS user accounts and access rights | ✕ | s.37(1) | Shared password |
| C-12 | Member database backed up and encrypted | ✓ | s.37(1) | Good |
Showing 12 of 42 checkpoints · ✓ pass · ! partial · ✕ fail
Closes F-01 · use the 12-form breach response kit
Closes F-03 · easiest fix, big score impact
Closes F-02 · the base for every other document
Closes F-06 · update the privacy notice at the same time (F-05)
Closes F-04 · separate POS user accounts (F-08)
Real reports are written for your business only and delivered as a PDF with a quote for every fix. You choose: fix it yourself, buy templates, or have our team do it.
Five services for the five questions owners ask most. Every engagement has a Kooru legal expert directly responsible, and starts with a free 15-minute chat.
A PDPA system for SMEs: it starts with a Gap Analysis in 3 business days, then puts the documents and procedures in place.
A monthly outsourced Data Protection Officer for organisations covered by s.41.
A corporate AI-use policy based on ISO/IEC 42001, the EU AI Act and NIST AI RMF, adapted to Thai businesses.
AI SEO / AEO / GEO so ChatGPT and Google recommend your business, with content that stays within the law.
Trademarks, copyright, and structuring intellectual property and digital tax.
Three steps, no contract before you see the report, and you always know the price before you decide.
Tell us what data the business collects and through which channels. You get a first risk level straight away.
Grades per area, findings, a risk map and a fix plan ranked by priority.
Documents and procedures built from the report, then staff training so they work in daily operations.
Kooru was founded on 1 October 2024. We are a new practice, so judge us on what you can verify: licence, qualifications, prices and a report format you can inspect first.
An advisor with a Thai lawyer's licence, so someone is genuinely accountable for the legal work. Our job is to set things up right from the start, so matters never need to reach court.
"Every chat answer and every report is written so an owner can act on it immediately. If your situation is more complex, message me and we will talk it through."
| Licence | Lawyer no. 477/2558 · Lawyers Council of Thailand |
|---|---|
| Bar | Thai Barrister-at-Law, 69th class |
| Master's | LL.M. Intellectual Property and Information Technology Law (gold medal) |
| Role | Data Protection Officer (DPO) |
| Before law | 20+ years in IT and digital marketing: POS, CRM, LINE OA and online ads, from the front line |
| Company | THE KOORU DATA TECH & LAW (THAILAND) Co., Ltd. · Bang Kapi, Bangkok 10240 |
Auditor's statement: every Gap Analysis is read and signed personally by a licensed lawyer. It is not an automated report, and not a template with your shop name swapped in. Full profile
Two routes inside the Kooru network: the Kooru legal team audits and sets things up for you, or AiPDPA generates the documents from your own company details. Pick by time and budget.
Starts with a Gap Analysis in 3 business days: grades per area and a fix plan. The Kooru legal team then puts RoPA, privacy notices, consent and DPIA in place for your business.
An AI SaaS platform in the Kooru network: answer questions about your business, it works out which PDPA documents you need and generates them automatically from your company details.
THE KOORU NETWORK · 5 PLATFORMS
Plain-language articles with a named author and an updated date. Each takes 5–10 minutes to read.
Yes. Start free with the Cookie Policy template, or pick from 18 Thai-language templates written by the Kooru legal team. Pay by card or PromptPay and download straight away.
See all templates →No. It is a scripted demo: all 12 answers were written in advance from guidance Kooru publishes, to show how the Kooru legal team answers. Questions outside the script are passed to an expert on LINE and are not advice for your specific case.
We have no client list to show and we will not invent one. What we offer is verifiable: lawyer licence no. 477/2558, which you can check with the Lawyers Council of Thailand, published prices, a report format you can inspect on this page, and a first conversation that costs nothing.
Yes, the first 15 minutes are free, so an expert can understand your business and tell you what is urgent. If you continue, you receive a Gap Analysis report and a quote within 3 business days, before you decide.
If you keep names, phone numbers, camera footage or staff data, PDPA applies. Size is not an exemption. The good news: a small shop does not need what a large company needs. Start with documents that match your real risks.
s.90fines up to ฿5 millionFor some items, such as CCTV signs or a privacy notice, if you know exactly what data you collect. For organisation-wide work such as RoPA or DPIA, start with an audit so you do not buy more than you need. Templates are in Thai; pay by card (Stripe) or PromptPay. See the PDPA template shop.
Kooru is the legal advisory service: our legal team audits, sets up and advises. AiPDPA is the AI SaaS platform in the same network: it works out which PDPA documents a business needs and generates them automatically from your company details.
Message LINE @kooru with a short description of your business. The Kooru legal team replies during business hours; the first 15 minutes are free, or ask for a free PDPA readiness check.
นโยบายการใช้คุกกี้สำเร็จรูป ฉบับองค์กร | Cookie Policy
ประกาศความเป็นส่วนตัว CCTV
[PDPA] ชุดรับมือเหตุละเมิดข้อมูลครบวงจร 12 แบบฟอร์ม + คู่มือ (Data Breach Response Kit)