The Office of the Personal Data Protection Commission (PDPC) issued this notification to develop and promote data protection standards, aiming to foster trust and sustainability in both the public and private sectors. The notification comes into effect starting from its publication date in the Royal Gazette on June 18, 2026.
A primary mechanism for driving this initiative is the establishment of the “Working Group on Screening the Assessment of Personal Data Protection Standards”. This group is chaired by the Deputy Secretary-General (Promotion and Regulatory Affairs) and includes five experts from key national organizations: the National Cyber Security Agency, the Thai Industrial Standards Institute, the Electronic Transactions Development Agency, the Federation of Thai Industries, and the Thai Chamber of Commerce.
Organizations seeking to apply for the standard certification and mark must meet specific qualifications and not possess any prohibited characteristics:
- Entity Type: It mustbe a government agency or a private entity that the PDPC requires to have a Data Protection Officer (DPO).
- Establishment and Location: Private entities must be established under Thai law with an office located in the Kingdom. Foreign entities must either have a branch office in Thailand or appoint an authorized representative.
- Initial Assessment: It must have successfully passed the Privacy Maturity Model assessment with a score at Level 5.
- Application History: It must not have been rejected for standard certification within 45 days prior to the application date.
- Revocation History: It must not have had a standard certification revoked within 1 year prior to the application date.
- Legal Record: If previously penalized under the Personal Data Protection Act, the entity must have fully complied with the judgment, and a period of at least 2 years must have elapsed since full compliance.
The certification process is designed to be systematic, transparent, and verifiable. The main steps are as follows:
- The applicant must prepare the certification request form and attach relevant supporting evidence (e.g., entity establishment documents, power of attorney) to verify preliminary qualifications via designated channels or an electronic system.
- An assessor will review the submitted documents. If the documents are correct and complete, the applicant must pay the service fee within 7 days of being notified. If the documents are incomplete, the applicant has 7 days to submit the required additions (failure to comply will result in automatic cancellation of the request). Payments must be made via the e-Banking system of Krungthai Bank or other specified channels.
- Upon payment of the fee, the assessor will conduct the evaluation, which may involve a document review or an on-site inspection at the applicant’s premises. If the applicant fails to meet the criteria, they are given a 15-day window to make necessary corrections.
- Once the applicant meets the criteria, the Working Group reviews the results and forwards them to the Secretary-General for final certification approval. Following this approval, the applicant must pay the fee for issuing the standard certificate or mark within 15 days.