Tel. 02-570-8449 Mobile 088-807-9770 Payment
Mon–Fri 9:00–17:00 @itgenius
IT Genius Institute
IT Genius Institute
CoursesWorkshopSchedule
For business
In-house trainingAI Transformation (TH)Government training (TH)Development servicesTraining room rental
Articles
About us
About IT GeniusInstructorsPortfolioOur clientsPayment methods
Contact usOnline
Theme
Language
THENLA
Ask about a coursePick whichever channel suits you
LINE @itgeniusFastest reply · Mon–Fri 9:00–17:00
Call us
02-570-8449Office088-807-9770Mobile
Email & social
contact@itgenius.co.thFor quotations and documentsFacebookitgeniusonlineYouTubeitgeniusengPlan training for your team
Home / Courses / Cybersecurity / Detail
Cybersecurity · CYC-01

PDPA for IT Teams and Data Custodians

PDPA for IT Teams and Data Custodians is a course that turns Thailand's data protection law into practical tasks, from data inventories and RoPA to consent design, data subject requests, technical safeguards and breach response. It suits IT teams, DPOs and developers who design systems holding personal data, and you leave with templates you can put to use straight away.

Updated
PDPA สำหรับทีมไอทีและผู้ดูแลข้อมูล
From 5,310 THB / person 5,900 −10% excl. VAT 7% · group rates available
Corporate training quote Join the waiting list
PDFDownload the course outline
  • Duration6 hours · 1 days
  • FormatOnsite / live online
  • Next roundOn request
  • CertificateIncluded

Course overview

Thailand's Personal Data Protection Act B.E. 2562 (PDPA) is now fully in force, and most of the day-to-day workload falls on IT teams and data custodians: knowing what personal data the organization holds and where, maintaining records of processing activities (RoPA), handling data subject requests, implementing technical safeguards, and responding to a data breach within the legally required timeframe. This course translates legal requirements into work IT teams can actually do. The content is practical for people without a legal background, using

templates and checklists that can be applied immediately. It covers data classification and inventory, choosing a lawful basis and designing consent, answering data subject requests on time, technical measures such as access control, encryption, anonymization, logging and secure deletion at end of retention, plus a breach response drill. Note: this course provides practical guidance for IT teams and is not case-specific legal advice; verify with your organization's legal counsel before enforcement. (1 day, 6 hours, Beginner to Intermediate level, no legal background required.)

What you’ll gain

  • Understand the core of PDPA and its scope in an IT context
  • Distinguish data controller, data processor and DPO responsibilities correctly
  • Choose a lawful basis for processing and design consent that works in practice
  • Build a data inventory and records of processing activities (RoPA)
  • Design a data subject request (DSR) process that meets statutory deadlines
  • Implement technical safeguards in line with what the law expects
  • Manage the data lifecycle from collection and use to retention and secure deletion
  • Respond to a personal data breach and prepare notification within the required timeframe
  • Produce an actionable PDPA work plan for the IT team

Who this course is for

  • IT teams, system administrators and database custodians handling personal data
  • Data protection officers (DPO) and teams supporting the DPO function
  • Software developers and teams designing systems that store customer or employee data
  • HR, marketing and customer service teams working with large volumes of personal data
  • Executives and team leads accountable for organizational data risk

Prerequisites

  • Some involvement with organizational systems or data
  • No legal background required
  • Knowing which systems hold personal data helps make the workshops more relevant
  • Suitable for those responsible for PDPA in practice, not only the legal department

Curriculum

Course Details

A 1-day course (6 hours), delivered as a hands-on workshop. Beginner to Intermediate level, no legal background required. Learners take home a RoPA template, consent and data subject request forms, a technical security checklist, and a breach response plan. Note: this course provides practical guidance for IT teams and is not case-specific legal advice.

Section 1 PDPA Essentials and Roles
  • An overview of the Personal Data Protection Act B.E. 2562, its scope and the penalties organizations must know
  • Definitions of personal data and sensitive data with examples from IT systems
  • The roles of data controller, data processor and the DPO
  • Responsibilities that in practice land on the IT team, and working with legal and HR
Section 2 Lawful Basis and Consent
  • Lawful bases for processing and choosing the right basis for each activity
  • Valid consent: clear, granular, withdrawable, and keeping evidence of consent
  • Designing complete forms and privacy notices for websites and apps
  • Workshop: review where your systems collect data and identify the lawful basis used
Section 3 Data Inventory and RoPA
  • Mapping what personal data the organization holds, where, who can access it and how long it is kept
  • Producing records of processing activities (RoPA) that meet legal requirements
  • Classifying data sensitivity and labelling it in systems
  • Workshop: complete a RoPA template for one of your own systems
Section 4 Data Subject Rights and Responding to Requests
  • Data subject rights: access, copy, rectification, erasure, objection, restriction and portability
  • Designing a data subject request process that answers within the statutory timeframe
  • Verifying the requester's identity and the exceptions where a request may be refused
  • Workshop: design an erasure request workflow from intake to case closure
Section 5 Security Measures and the Data Lifecycle
  • Technical measures: role-based access control, encryption and access logging
  • Anonymization and pseudonymization for testing and analytics
  • Setting retention periods and securely deleting or destroying data at end of retention
  • Workshop: audit a system against the security checklist and identify gaps to fix
Section 6 Breach Response and the Team Action Plan
  • Preparing for a personal data breach and assessing the risk to data subjects
  • Notifying the Personal Data Protection Committee office and data subjects within the required timeframe
  • Managing external processors (vendors) and data processing agreements, including AI and cloud services
  • Workshop: run a breach simulation and build the IT team's PDPA action plan

Schedule & training options

For individuals — public rounds

No public rounds are open right now. Join the waiting list and we will contact you first when the next round opens, or ask us on LINE. Or call 02-570-8449 or 088-807-9770

Join the waiting list Ask about rounds

For organisations — in-house / private

  • Tailor the content to your team’s tools and projects
  • Your dates, at your office or live online
  • Quotation with tax ID for procurement
Corporate training quote

Instructors

Frequently asked questions

What is the difference between personal data and sensitive data under the PDPA?

Personal data is any information that identifies a person directly or indirectly, such as a name, ID card number, email address, phone number or IP address. Sensitive data, defined in Section 26, receives stronger protection and includes race, religion, health data, biometric data such as fingerprints or facial images, and criminal records. It generally requires explicit consent before collection and tighter safeguards.

What is a RoPA, and what does it need to record?

A RoPA (Record of Processing Activities) is a record of the activities in which an organisation processes personal data, which data controllers must keep under the PDPA. At minimum it should state what data is held, for what purpose, on which lawful basis, for how long, who can access or receive it, and what security measures apply. A practical start is a data inventory, system by system, summarised into a template.

What should you do when personal data is breached?

First contain the incident, for example by closing the leak or resetting passwords. Then assess what kind of data and how much was affected, and the risk to the people concerned. If there is a risk, notify the Personal Data Protection Committee office within seventy-two hours of becoming aware; if the risk is high, also inform the data subjects and the remedies without delay. Finally, record the incident and strengthen your safeguards.

Who is the PDPA for IT Teams and Data Custodians course for, and what should I know beforehand?

It suits IT teams, system and database administrators who handle personal data, DPOs and their support teams, developers designing systems that hold customer or employee data, and HR, marketing or customer service teams working with large amounts of it. No legal knowledge is needed, but you should work with organisational systems or data, and knowing which systems hold personal data makes the workshops more relevant.

What will I be able to do after the PDPA for IT Teams and Data Custodians course?

You will be able to map personal data across your systems and produce a RoPA, choose lawful bases and design consent forms and privacy notices, set up a process for data subject requests, apply technical safeguards such as access control, encryption, anonymisation and timely deletion, and prepare a breach response plan, with templates you can use straight away. Participants who complete the training receive a Certificate of Completion with its own number, which can be verified online.

Can the PDPA for IT Teams and Data Custodians course be run in-house for our team?

Yes. It can be run in-house for your team, with examples adapted to your own work, such as using the systems that hold your customer or employee data for the RoPA exercise and breach drill. You can request a quotation from this page, or contact us on LINE @itgenius or by phone on 02-570-8449.

Related articles

Articles are published in Thai.