What is PDPA and why should every Thai SME care?

PDPA (Personal Data Protection Act B.E. 2562) is Thailand's national data privacy law that mandates every organization — regardless of size — to collect, use, process, and store personal data lawfully, with a valid legal basis and explicit consent where required. The law is enforced by the Personal Data Protection Committee (PDPC) under the Ministry of Digital Economy and Society. Non-compliance carries civil penalties of up to 5,000,000 THB per violation, criminal liability of up to 1 year imprisonment, and additional punitive damages of up to twice the actual damage amount under Section 77 and Section 78 of the Act. Any Thai SME — including e-commerce stores, clinics, restaurants, hotels, and professional service firms — that collects any customer data (name, phone, email, purchase history, health records, etc.) is legally subject to PDPA. There are no exemptions based on company size or revenue.

How is DPO as a Service different from hiring an in-house DPO?

Under Section 41 of Thailand's PDPA, certain organizations are required to appoint a Data Protection Officer (DPO) — including those processing sensitive personal data at large scale, public authorities, or entities whose core activities involve systematic monitoring of individuals. DPO as a Service (DPOaaS) provides a fully qualified external DPO team on a monthly retainer, giving you access to multi-industry legal expertise without the fixed costs of a full-time hire. Key differences: (1) Cost — DPOaaS typically costs 60–80% less than a full-time senior DPO salary including benefits, training, and overheads; (2) Expertise — you get a team with cross-sector experience rather than a single generalist; (3) Scalability — service scope adjusts immediately as your business grows or regulatory requirements change; (4) Currency — the team tracks every PDPC regulatory update, circular, and enforcement action so your compliance posture is always current without internal effort.

How does AI SEO rank businesses faster and more sustainably than traditional SEO?

Traditional SEO relies on manual keyword research cycles and periodic content audits — typically updated monthly or quarterly — leaving significant lag between market shifts and your response. AI SEO uses Machine Learning models to continuously analyze user search intent, real-time SERP behavior, competitor content gaps, and Core Web Vitals signals, enabling dynamic content and technical optimization at a speed no human team can replicate. The practical outcome: AI SEO can identify high-conversion long-tail keyword opportunities 3–5x faster, improve E-E-A-T signals through structured data and topical authority mapping, and adapt to Google algorithm updates within days rather than weeks. In 2025–2026, AI SEO also incorporates Answer Engine Optimization (AEO) and Generative Engine Optimization (GEO) — optimizing content to appear in AI-generated answers from ChatGPT, Gemini, Perplexity, and Google's AI Overviews. This creates compounding organic traffic that does not collapse when ad budgets are paused.

What size business is monthly Content and Digital Marketing right for?

Kooru's monthly Content Marketing and Digital Marketing service is designed for Thai SMEs and startups at every stage — from businesses with zero online presence building their first content strategy, to established brands scaling into new domestic or international markets. The service covers content strategy, SEO-aligned blog and social media content production, LinkedIn and Facebook campaign management, email marketing, and performance reporting. Strategy is built around three variables specific to each client: (1) industry vertical and competitive landscape, (2) available monthly budget (packages start from entry-level and scale to full-service), and (3) defined growth KPIs — whether that's lead generation, brand awareness, e-commerce conversion, or export market entry. There are no one-size-fits-all templates. Every plan is custom-built for the client's specific business context.

Why do AI Governance and AI Security matter for organizations using AI?

AI Governance is the policy and procedural framework that ensures an organization's use of AI systems is ethical, transparent, explainable, and legally compliant with applicable regulations including Thailand's PDPA, the forthcoming Thai AI Regulation framework, and — for businesses with EU exposure — the EU AI Act (Regulation 2024/1689), which classifies certain AI uses as high-risk requiring mandatory conformity assessments. AI Security specifically defends AI infrastructure against technical attacks: Data Poisoning (corrupting training data to manipulate model outputs), Model Inversion (extracting sensitive training data from models), Adversarial Attacks (manipulating inputs to cause incorrect predictions), and Model Theft (stealing proprietary AI IP). A critical risk for Thai SMEs in 2025–2026 is Shadow AI — employees using unauthorized AI tools like public ChatGPT with company data, creating undocumented PDPA violations and IP leakage. Together, AI Governance and AI Security reduce legal liability, protect proprietary data, and build the institutional trust necessary for long-term responsible AI deployment.

Which types of intellectual property must digital businesses protect?

Digital businesses in Thailand should actively protect four categories of intellectual property: (1) Trademarks — brand names, logos, and domain names registered with Thailand's Department of Intellectual Property (DIP) under the Trademark Act B.E. 2534; protection lasts 10 years renewable. (2) Copyright — website content, software source code, graphic design, databases, and video content; automatically protected under the Copyright Act B.E. 2537 for the creator's lifetime plus 50 years, though registration strengthens enforcement. (3) Patents — software-implemented inventions, unique algorithms, and novel business processes; registered with DIP under the Patent Act B.E. 2522, valid for 20 years from filing date. (4) Trade Secrets — proprietary algorithms, customer databases, pricing models, and operational processes; protected under the Trade Secrets Act B.E. 2545 without registration requirement but requiring documented confidentiality measures. Registered IP assets also generate direct revenue through licensing agreements — converting intangible assets into recurring income streams on your balance sheet.

What is ESG and do Thai SMEs actually need an ESG report?

ESG stands for Environmental (carbon emissions, resource use, waste), Social (labor practices, community impact, supply chain ethics), and Governance (board structure, anti-corruption, data transparency). While ESG reporting is not currently mandatory for Thai SMEs under Thai law, two major forces are making it effectively non-optional for growth-oriented businesses: (1) EU Corporate Sustainability Reporting Directive (CSRD, effective 2025–2026) — EU companies with more than 250 employees must report their entire supply chain's ESG performance, meaning Thai SME suppliers to EU buyers must now provide ESG data or lose the contract. (2) Capital access — Thai and international financial institutions including the Stock Exchange of Thailand (SET) and major commercial banks increasingly price sustainability performance into lending terms and investment decisions. An independently verified ESG report directly enables: access to green finance and sustainability-linked loans, qualification for EU and Japanese supply chains, competitive differentiation in public procurement, and measurably higher brand trust scores with B2B and B2C customers.

What is a Digital Product Passport (DPP) and how does it affect Thai SMEs that export?

A Digital Product Passport (DPP) is a structured digital record — accessible via QR code, RFID, or data carrier — that documents a product's complete lifecycle data: raw material origin and sourcing practices, manufacturing process and energy consumption, product composition and recyclability, carbon footprint, and end-of-life disposal instructions. DPPs are mandated by EU Regulation 2024/1781 (Ecodesign for Sustainable Products Regulation — ESPR), which requires DPPs for multiple product categories starting from 2027, beginning with textiles, batteries, electronics, furniture, and construction materials. For Thai SMEs exporting to the EU: products without a compliant DPP will be refused entry at EU customs borders from the applicable enforcement date. Implementation requires building data collection systems across your supply chain, partnering with accredited verification bodies, and integrating with the EU's central DPP registry. Businesses that begin implementation in 2026 will have adequate lead time; those who wait until 2027 risk supply chain disruption and lost contracts.

Who is Kooru One Suit for and what does it include?

Kooru One Suit is Kooru's all-inclusive service bundle designed for Thai SMEs and startups that need comprehensive coverage across legal compliance, technology governance, and digital growth — without managing multiple vendors. The package bundles seven service lines into a single monthly engagement: (1) PDPA Compliance — full documentation, consent management, and data mapping; (2) DPO as a Service — qualified Data Protection Officer on retainer; (3) AI Governance — policy framework and Shadow AI risk management; (4) SEO and Ranking — AI-powered search optimization; (5) Digital Marketing — content strategy and campaign management; (6) IP Strategy — trademark, copyright, and trade secret protection; and (7) ESG Reporting — sustainability data collection and verified reporting. Clients who bundle all seven services under One Suit save more than 30% compared to purchasing each service independently. Each client is assigned a dedicated Account Manager as a single point of contact — eliminating the coordination overhead of managing separate agency relationships. Most suitable for: growth-stage SMEs with 10–200 employees, startups seeking investor-ready compliance posture, and export-oriented businesses requiring multi-standard certification.

What do online businesses in Thailand need to know about digital taxes?

Online businesses operating in Thailand face obligations across three critical tax areas: (1) e-Service VAT — under the Revenue Code Amendment Act B.E. 2564 (effective September 2021), foreign digital service providers (Netflix, Google, Meta, SaaS platforms) with annual Thai revenue exceeding 1,800,000 THB must register for and remit 7% VAT. Thai businesses reselling or arbitraging these services must account for input VAT correctly. (2) Income Tax on Online Sales — revenue from selling goods and services online through LINE, Facebook, Shopee, Lazada, or direct websites is fully taxable personal income or corporate income. The Revenue Department's cross-platform data-sharing agreements with major platforms mean under-reporting carries increasing audit risk from 2025 onward. (3) IP and Licensing Income Tax — royalty income, software license fees, and franchise fees received by Thai entities are subject to withholding tax at 3% (domestic) or treaty-reduced rates for cross-border payments, and must be properly characterized to qualify for tax incentives under BOI or IEAT promotion schemes where applicable. Establishing the correct legal and tax structure from incorporation — rather than retrofitting it after growth — is the single highest-leverage tax decision an online business makes.