Thailand PDPA Toolkit for International Schools
A seven-step operational guide for international schools in Thailand, from DPO appointment and data mapping to audit-ready PDPA compliance.
Written for the DPO, bursar, admissions registrar, IT manager and head of school. Each step includes a template, checklist or decision aid you can add straight to your compliance file.
Schools hold some of the most sensitive data in Thailand, on behalf of children.
Medical and allergy plans, safeguarding notes, background checks, biometric gate access and passport records for families from many nationalities sit in one organisation.
A privacy notice on the website is not compliance. Boards now ask whether the school can evidence what it does with student data. This guide builds that evidence pack step by step.
What's inside the 26-page toolkit?
PDPA foundations for schools
Scope, sensitive data categories and controller versus processor accountability.
2026 regulatory update
Active enforcement and the developments schools need to track.
DPO and data mapping
Appointing a DPO, mapping student data flows and a sample retention schedule.
Notices, consent and transfers
Parental consent forms and cross-border transfer mechanisms for international families.
DSARs and safeguards
DSAR response flowchart and technical controls for sensitive student records.
Vendors and annual calendar
Vendor due-diligence checklist and an annual PDPA compliance calendar.
Who is this toolkit for?
- School DPOs
- Heads of school and governors
- Bursars and admissions teams
- IT managers
- Group compliance leads
Frequently asked questions
- Does the PDPA apply to international schools?
- Yes. It applies to organisations processing personal data of individuals in Thailand, and international status usually increases exposure because more processing crosses borders.
- What counts as sensitive data in a school?
- Health, religious, biometric, criminal record, racial or ethnic and disability data — typically held in clinic records, admissions forms, gate systems and staff checks.
- Is the guide specific to 2026?
- Yes. The 2026 edition covers active enforcement and the regulatory developments schools should be tracking now.
- Does it cover EdTech suppliers?
- Yes. Step 6 covers vendor due diligence, including whether tools use pupil data to train AI models.
- Who produced it?
- Formiti Consulting and Privacy360. Formiti provides advisory and implementation support; Privacy360 is the platform that turns each step into audit-ready evidence.
Get the Toolkit
Complete the download form to receive the Thailand PDPA Toolkit for International Schools.