Cybersecurity · CYC-01

PDPA for IT Teams and Data Custodians

6 hours 1 days

Last updated 25 Sep 2026

PDPA for IT Teams and Data Custodians is a 6-hour training course by IT Genius Institute. Thailand's Personal Data Protection Act B.E. 2562 (PDPA) is now fully in force, and most of the day-to-day workload falls on IT teams and data custodians:…

Training schedule

No public rounds are open right now — register your interest and we will contact you when the next round opens, or request an in-house session for your team.

Corporate training quote

Thailand's Personal Data Protection Act B.E. 2562 (PDPA) is now fully in force, and most of the day-to-day workload falls on IT teams and data custodians: knowing what personal data the organization holds and where, maintaining records of processing activities (RoPA), handling data subject requests, implementing technical safeguards, and responding to a data breach within the legally required timeframe. This course translates legal requirements into work IT teams can actually do. The content is practical for people without a legal background, using

templates and checklists that can be applied immediately. It covers data classification and inventory, choosing a lawful basis and designing consent, answering data subject requests on time, technical measures such as access control, encryption, anonymization, logging and secure deletion at end of retention, plus a breach response drill. Note: this course provides practical guidance for IT teams and is not case-specific legal advice; verify with your organization's legal counsel before enforcement. (1 day, 6 hours, Beginner to Intermediate level, no legal background required.)

Objectives

Understand the core of PDPA and its scope in an IT context
Distinguish data controller, data processor and DPO responsibilities correctly
Choose a lawful basis for processing and design consent that works in practice
Build a data inventory and records of processing activities (RoPA)
Design a data subject request (DSR) process that meets statutory deadlines
Implement technical safeguards in line with what the law expects
Manage the data lifecycle from collection and use to retention and secure deletion
Respond to a personal data breach and prepare notification within the required timeframe
Produce an actionable PDPA work plan for the IT team

Who this course is for

IT teams, system administrators and database custodians handling personal data
Data protection officers (DPO) and teams supporting the DPO function
Software developers and teams designing systems that store customer or employee data
HR, marketing and customer service teams working with large volumes of personal data
Executives and team leads accountable for organizational data risk

Prerequisites

Some involvement with organizational systems or data
No legal background required
Knowing which systems hold personal data helps make the workshops more relevant
Suitable for those responsible for PDPA in practice, not only the legal department

Curriculum

Course Details

A 1-day course (6 hours), delivered as a hands-on workshop. Beginner to Intermediate level, no legal background required. Learners take home a RoPA template, consent and data subject request forms, a technical security checklist, and a breach response plan. Note: this course provides practical guidance for IT teams and is not case-specific legal advice.

Section 1: PDPA Essentials and Roles

An overview of the Personal Data Protection Act B.E. 2562, its scope and the penalties organizations must know
Definitions of personal data and sensitive data with examples from IT systems
The roles of data controller, data processor and the DPO
Responsibilities that in practice land on the IT team, and working with legal and HR

Section 2: Lawful Basis and Consent

Lawful bases for processing and choosing the right basis for each activity
Valid consent: clear, granular, withdrawable, and keeping evidence of consent
Designing complete forms and privacy notices for websites and apps
Workshop: review where your systems collect data and identify the lawful basis used

Section 3: Data Inventory and RoPA

Mapping what personal data the organization holds, where, who can access it and how long it is kept
Producing records of processing activities (RoPA) that meet legal requirements
Classifying data sensitivity and labelling it in systems
Workshop: complete a RoPA template for one of your own systems

Section 4: Data Subject Rights and Responding to Requests

Data subject rights: access, copy, rectification, erasure, objection, restriction and portability
Designing a data subject request process that answers within the statutory timeframe
Verifying the requester's identity and the exceptions where a request may be refused
Workshop: design an erasure request workflow from intake to case closure

Section 5: Security Measures and the Data Lifecycle

Technical measures: role-based access control, encryption and access logging
Anonymization and pseudonymization for testing and analytics
Setting retention periods and securely deleting or destroying data at end of retention
Workshop: audit a system against the security checklist and identify gaps to fix

Section 6: Breach Response and the Team Action Plan

Preparing for a personal data breach and assessing the risk to data subjects
Notifying the Personal Data Protection Committee office and data subjects within the required timeframe
Managing external processors (vendors) and data processing agreements, including AI and cloud services
Workshop: run a breach simulation and build the IT team's PDPA action plan

Frequently asked questions

Who is PDPA for IT Teams and Data Custodians for, and what background is needed?

Built for IT teams, system administrators and database custodians handling personal data · Data protection officers (DPO) and teams supporting the DPO function · Software developers and teams designing systems that store customer or employee data Background you should have: Some involvement with organizational systems or data · No legal background required Not sure the fit is right? Talk to our team on LINE @itgenius or call 02-570-8449.

How much does PDPA for IT Teams and Data Custodians cost and how long does it run?

THB 5,900 (currently THB 5,310 on promotion). The course runs 6 hours. The fee covers course materials, lunch and refreshments throughout. Pay by bank transfer to the company account, confirm it on our payment page, and we can issue the receipt or tax invoice in your company's name.

Do I get a certificate?

Yes. Everyone who completes the course receives a Certificate of Completion from IT Genius Institute. Each certificate carries its own number, and anyone holding that number can verify it online on our certificate page, so you can add it to your portfolio or pass it to HR as evidence of training.

Where does the training take place, and is there an online option?

You can attend onsite at IT Genius Institute or arrange to join online, and we also run it as a private in-house session for your team. Ask about dates and venues on LINE @itgenius or call 02-570-8449.

What if I fall behind or miss a session — can I retake it?

Yes. You may retake the same course free of charge in a later round, under the institute's conditions. Tell our team which course and round you attended, and we will check it and offer you the rounds that still have seats. Ask us on LINE @itgenius or call 02-570-8449.

How do I enrol, or request a quotation for my company?

Enrol online with the registration form on this page. You can register several attendees at once and enter your tax ID and billing address for the tax invoice. Or request a company quotation straight from the quote button. For anything else call 02-570-8449 or reach us on LINE @itgenius.