Kooru is a PDPA and AI legal advisory for Thai SMEs, so you can ask about PDPA now with no appointment needed. Business owners' questions are answered with the actual section of the law, real prices and a next step you can take today. Then see what a 3-business-day audit report looks like.
Yes, but check what you paste in. Customer names, phone numbers or purchase history in a personal account means personal data is processed on servers abroad, which must meet the cross-border transfer rules (s.28).
Not live AI and not advice for your specific case. The interactive demo with 12 pre-written answers is at /en/tools-en/ask-en/; other questions go to the Kooru legal team on LINE.
Enter your website and get a 0–100 score in about 15 seconds: how well ChatGPT, Gemini and Google AI can read your site, plus what to fix first. No sign-up.
Want it done for you? AEO & GEO services from ฿4,900 · What is AEO?
If customer data leaked today, your business could face administrative fines of up to millions of baht per case, a 72-hour deadline to notify the PDPC office, and up to 1 year in prison where sensitive data is misused. PDPA is not only about fines. It sets deadlines and criminal penalties that owners need to know before an incident, not after. Every number below comes from the Act itself.
The s.90 ceiling applies to unlawfully processing sensitive data; for general data processed without a legal basis or without security measures, the ceiling is ฿3,000,000. Counted per case, not per year.
s.90From the moment you become aware of a breach, you must notify the Personal Data Protection Committee office (PDPC). Without a prepared procedure you will rarely make it.
s.37(4)Up to 1 year in prison for unlawfully using or disclosing sensitive data (health, religion, biometrics and others under s.26).
s.79 · s.26Kooru delivers a Gap Analysis with grades per area and a quote within 3 business days of receiving complete information.
Kooru Data ShieldA 3-day Gap Analysis gives you a signed report with A–F grades across 8 areas and 42 checkpoints, findings ranked by risk, and a fix plan with a quote, from Data Shield Starter at ฿5,900. Below is a sample report for "Sample Café", a fictional shop we created to show the format. It is not a real client and every number is an example, but the structure is exactly what you receive.
A–F grades per area, findings ranked by risk and a fix plan you can actually execute. You decide whether to fix it yourself, buy templates or have our team do it.
Sample Café (fictional) · 2 branches + LINE OA + website
The shop collects member data through LINE OA and footage from cameras at 2 branches, but has no RoPA, no 72-hour breach procedure1 and no CCTV signs. These three can be fixed within 10 business days and would lift the overall grade to B.
No record of processing activities in any department
On the website, but no retention period and nothing in store
Marketing consent bundled into the membership terms
No purpose sign, no footage request form
No owner, no PDPC notification form
Ad agency and POS provider have no DPA
Requests accepted on LINE but deadlines not tracked
Good backups, but staff share one POS password
Likelihood → (1 very unlikely … 5 almost certain)
| Code | Checkpoint | Result | Ref. | Auditor note |
|---|---|---|---|---|
| C-01 | Record of processing (RoPA) for every department | ✕ | s.39 | None yet |
| C-02 | Privacy notice given before or at collection | ! | s.23 | Online only, not in store |
| C-03 | Marketing consent separate from membership terms | ✕ | s.19 | One tick covers everything |
| C-04 | CCTV sign with purpose and contact channel | ✕ | s.23 | Both branches |
| C-05 | PDPC notification within 72 hours, with an owner | ✕ | s.37(4) | Highest risk |
| C-06 | DPA with external processors | ! | s.40 | Cloud yes, agency no |
| C-07 | Rights request channel and tracking log | ! | s.30–35 | No log |
| C-08 | No sensitive data beyond what is needed | ✓ | s.26 | None found |
| C-09 | Cross-border transfers (cloud / AI tools) have a legal basis | ! | s.28 | AI summarises customer feedback, not assessed |
| C-10 | DPO duty assessed | ✓ | s.41 | Assessed, not mandatory |
| C-11 | Separate POS user accounts and access rights | ✕ | s.37(1) | Shared password |
| C-12 | Member database backed up and encrypted | ✓ | s.37(1) | Good |
Showing 12 of 42 checkpoints · ✓ pass · ! partial · ✕ fail
Closes F-01 · use the 12-form breach response kit
Closes F-03 · easiest fix, big score impact
Closes F-02 · the base for every other document
Closes F-06 · update the privacy notice at the same time (F-05)
Closes F-04 · separate POS user accounts (F-08)
Real reports are written for your business only and delivered as a PDF with a quote for every fix. You choose: fix it yourself, buy templates, or have our team do it.
Kooru can help in five ways: a complete PDPA system with Data Shield (from ฿5,900), a monthly outsourced DPO appointment with DPO as a Service, an AI-use policy with TrustAI, AI SEO with Ranking+, and trademarks with IP Wealth. Five services for the five questions owners ask most. Every engagement has a Kooru legal expert directly responsible, and starts with a free 15-minute chat.
A PDPA system for SMEs: it starts with a Gap Analysis in 3 business days, then puts the documents and procedures in place.
A monthly outsourced Data Protection Officer for organisations covered by s.41.
A corporate AI-use policy based on ISO/IEC 42001, the EU AI Act and NIST AI RMF, adapted to Thai businesses.
AEO / GEO so ChatGPT and Google AI recommend your business. Retrofit your current site or build a new one that is hard to hack, from ฿4,900.
Trademarks, copyright, and structuring intellectual property and digital tax.
It takes three steps: on day one, a free 15-minute chat on LINE gives you a first risk level; within 3 business days you receive a Gap Analysis signed by the auditor, with a quote; then the Kooru legal team builds the documents and trains your staff to the plan. There is no contract before you see the report, and you always know the price before you decide.
Tell us what data the business collects and through which channels. You get a first risk level straight away.
Grades per area, findings, a risk map and a fix plan ranked by priority.
Documents and procedures built from the report, then staff training so they work in daily operations.
Every answer and report is written and signed by Phuwara Krobtaku, founder of Kooru: a lawyer (licence no. 477/2558), Thai Barrister-at-Law and Data Protection Officer with 20+ years in IT and digital marketing. Kooru was founded on 1 October 2024. We are a new practice, so judge us on what you can verify: licence, qualifications, prices and a report format you can inspect first.
An advisor with a Thai lawyer's licence, so someone is genuinely accountable for the legal work. Our job is to set things up right from the start, so matters never need to reach court.
"Every chat answer and every report is written so an owner can act on it immediately. If your situation is more complex, message me and we will talk it through."
| Licence | Lawyer no. 477/2558 · Lawyers Council of Thailand |
|---|---|
| Bar | Thai Barrister-at-Law, 69th class |
| Master's | LL.M. Intellectual Property and Information Technology Law (gold medal) |
| Role | Data Protection Officer (DPO) |
| Before law | 20+ years in IT and digital marketing: POS, CRM, LINE OA and online ads, from the front line |
| Company | THE KOORU DATA TECH & LAW (THAILAND) Co., Ltd. · Bang Kapi, Bangkok 10240 |
Auditor's statement: every Gap Analysis is read and signed personally by a licensed lawyer. It is not an automated report, and not a template with your shop name swapped in. Full profile
It depends on your time and budget: choose Kooru Data Shield, from ฿5,900, if you want a signed report and a legal team to set up RoPA, privacy notices, consent and DPIA for you, or AiPDPA if you would rather generate the full document set yourself. Two routes inside the Kooru network: the Kooru legal team audits and sets things up for you, or AiPDPA generates the documents from your own company details. Pick by time and budget.
Starts with a Gap Analysis in 3 business days: grades per area and a fix plan. The Kooru legal team then puts RoPA, privacy notices, consent and DPIA in place for your business.
An AI SaaS platform in the Kooru network: answer questions about your business, it works out which PDPA documents you need and generates them automatically from your company details.
THE KOORU NETWORK · 5 PLATFORMS
Yes: read the articles below first. They are plain-language articles, each with a named author and an updated date, and each takes 5–10 minutes to read. If your situation is still unclear afterwards, the Kooru legal team offers a free 15-minute chat on LINE.
PDPA & Data Privacy
Founder’s Playbook & Case Studies
PDPA & Data PrivacyYes. Start free with the Cookie Policy template, or pick from 18 Thai-language templates written by the Kooru legal team. Pay by card or PromptPay and download straight away.
See all templates →No. It is a scripted demo: all 12 answers were written in advance from guidance Kooru publishes, to show how the Kooru legal team answers. Questions outside the script are passed to an expert on LINE and are not advice for your specific case.
We have no client list to show and we will not invent one. What we offer is verifiable: lawyer licence no. 477/2558, which you can check with the Lawyers Council of Thailand, published prices, a report format you can inspect on this page, and a first conversation that costs nothing.
Yes, the first 15 minutes are free, so an expert can understand your business and tell you what is urgent. If you continue, you receive a Gap Analysis report and a quote within 3 business days, before you decide.
If you keep names, phone numbers, camera footage or staff data, PDPA applies. Size is not an exemption. The good news: a small shop does not need what a large company needs. Start with documents that match your real risks.
s.90fines of ฿1–5 million by offenceFor some items, such as CCTV signs or a privacy notice, if you know exactly what data you collect. For organisation-wide work such as RoPA or DPIA, start with an audit so you do not buy more than you need. Templates are in Thai; pay by card (Stripe) or PromptPay. See the PDPA template shop.
Kooru is the legal advisory service: our legal team audits, sets up and advises. AiPDPA is the AI SaaS platform in the same network: it works out which PDPA documents a business needs and generates them automatically from your company details.
Message LINE @kooru with a short description of your business. The Kooru legal team replies during business hours; the first 15 minutes are free, or ask for a free PDPA readiness check.
Ready-to-Use Cookie Policy (Enterprise)
CCTV Privacy Notice (PDPA)
Data Breach Response Kit: 12 Forms + Guide