Concerned About PDPA Fines
of Up to THB 5 Million?

The ฿5,900 Starter Package comprises two core deliverables: (1) a Gap Analysis Report, which systematically identifies your organisation's current data protection risk exposures and areas of non-compliance with Thailand's Personal Data Protection Act B.E. 2562 (PDPA); and (2) a PDPA Roadmap, providing a structured, prioritised action plan tailored to your business context. Upon receipt of all required organisational information, the preliminary report is delivered within three (3) business days. This package is designed to give business owners and executives a clear, actionable picture of where they stand — and precisely what must be done to achieve and maintain compliance.

Yes. Kooru Data Shield includes a dedicated Healthcare Package specifically engineered for operators who process special categories of personal data — including health records, medical histories, and clinical information — as defined under Section 26 of Thailand's PDPA. This package places particular emphasis on Data Protection Impact Assessments (DPIAs), a mandatory requirement under the PDPA where processing activities are likely to result in high risk to data subjects. System configurations are aligned with applicable health data security standards and are structured to support regulatory inspection and audit readiness, including review by the Office of the Personal Data Protection Committee (PDPC).

All organisational data processed through Kooru Data Shield is stored on Supabase — an enterprise-grade, globally recognised database infrastructure that applies end-to-end encryption both at rest and in transit. Critically, the platform is configured such that your organisation retains 100% ownership of its data account. Kooru's role is limited to that of a system implementer and service provider; Kooru does not access, use, or commercialise your data in any form. This architecture is designed to satisfy the data controller obligations imposed on your organisation under Sections 37 and 40 of the PDPA.

Absolutely. Kooru Data Shield has been designed from the ground up with non-technical end users in mind. The user interface mirrors the intuitive experience of a standard website — navigation is straightforward, and data entry is structured around simple, guided form inputs. No specialist IT knowledge or legal training is required for day-to-day operation. To further support your team, the platform provides a comprehensive Thai-language video tutorial library, accessible on-demand, allowing staff to revisit guidance at any time without dependency on external support.

Under Section 39 of Thailand's PDPA, data controllers are legally required to maintain an accurate and current Record of Processing Activities (ROPA). The conventional approach — maintaining a static Excel spreadsheet — is both labour-intensive and inherently prone to gaps, omissions, and version-control errors. Kooru Data Shield's automated ROPA module directly integrates with your actual operational workflows. When a new processing activity occurs, the system records it automatically, eliminating the administrative burden of manual updates. This significantly reduces the risk of incomplete records — a common source of regulatory exposure during an audit or inspection by the PDPC.

The ฿14,900 annual maintenance fee provides comprehensive ongoing coverage across four key areas: (1) AI-powered system updates — the platform is automatically updated to reflect new regulations, notifications, and enforcement guidelines issued by the Office of the Personal Data Protection Committee (PDPC / สคส.); (2) SaaS platform licensing — full access to all platform modules and features; (3) automated data backup — your compliance records and audit trails are continuously backed up to ensure data integrity and business continuity; and (4) dedicated support — access to the Kooru support team for operational queries, technical issues, and compliance guidance throughout the subscription period.

Under Thailand's PDPA, administrative fines of up to ฿5,000,000 may be imposed for serious violations, while criminal penalties can include imprisonment. However, regulatory authorities and courts consistently take into account the degree of intent and the steps taken by an organisation to achieve compliance when determining sanctions. A robust, documented compliance programme — including a verifiable Audit Trail — constitutes compelling evidence of good faith and reasonable effort. Kooru Data Shield automatically generates and preserves this Audit Trail across all processing activities, consent records, and DSAR responses. While no system can guarantee immunity from enforcement action, the presence of a structured, demonstrable compliance framework is widely recognised as a material factor in mitigating penalty exposure.

Yes. Kooru Data Shield supports integration with your existing business systems, including CRM platforms and point-of-sale (POS) solutions, via Next.js-based connectors. This integration enables consent collection and processing activity logging to operate seamlessly within your current workflows — eliminating data silos and ensuring that consent records captured across different touchpoints are consolidated within a single, auditable compliance system. The result is a unified data governance infrastructure that reflects your actual operational reality, rather than a parallel compliance layer that exists in isolation.

Reactive PDPA compliance — implemented only after a data breach or regulatory complaint — is invariably more costly than proactive compliance. The financial exposure of a post-incident response encompasses regulatory fines of up to ฿5,000,000, legal and litigation costs, potential civil liability to affected data subjects, and — critically — reputational damage that may be irreversible. Commencing with the ฿5,900 Starter Package today represents the most cost-efficient means of assessing and managing your compliance risk. Every day without a functioning PDPA compliance framework is a period of unmitigated legal and financial exposure. The question is not whether compliance is necessary — under Thai law, it is mandatory for any organisation that collects, uses, or discloses personal data — but rather how much the absence of it will ultimately cost.