The 12 questions SMEs ask experts most. Pick the ones that match you
The 12 questions SMEs ask experts most are a set of PDPA and AI questions Kooru has answered with statute references, so you can pick the ones that match your business. Every answer was written in advance from guidance Kooru has published. As you ask, the page collects the relevant statute sections, documents and services into a summary for the expert that you can send on LINE in one click.
Not live AI. Questions outside the script are pointed to the Kooru legal team · tap a bubble to skip the animation
Pick a question from the list, or start with the three business owners ask most.
What do the 12 questions in this demo answer?
Short answers to every question, referring to the Personal Data Protection Act B.E. 2562 (2019). Read the full versions, with tappable statute sections, in the chat above, or send your question to the Kooru legal team on LINE.
As you ask, the summary for the expert collects:
- your questions
- the relevant statute sections
- recommended documents
- related services
We have CCTV in our shop. What do we need to do?
Camera footage that clearly shows people’s faces is personal data, so the shop has PDPA duties even if the cameras are only for security. The minimum to have in place is as follows. If this is neglected, the risk is an administrative fine of up to 1 million baht for having no privacy notice, and up to 3 million baht for using or disclosing the footage unlawfully. The good news is that this needs only 2 documents, ฿1,380 in total. See full answer
Can we use ChatGPT to summarise customer data?
Yes, but it depends on what you send in. Pasting customer names, phone numbers or purchase history into a personal account means sending personal data to be processed on servers abroad, which must meet the conditions for cross-border transfers (s.28). Most problems come not from the tool but from having no rules in the team. A one-page policy everyone understands works better than a ban. See full answer
If data leaks, what must we do and within how many hours?
72 hours from the time you become aware. You must notify the Office of the Personal Data Protection Committee under s.37(4), unless the incident poses no risk to data subjects’ rights, and if the risk is high you must notify the data subjects too. The clock starts when you become aware, not when the investigation ends. An organisation that has its forms ready before an incident spends the 72 hours fixing the problem, not drafting letters. See full answer
What is the maximum PDPA fine? Does it really happen?
Administrative fines have three ceilings depending on the breach: up to 1, 3 or 5 million baht, with the 5 million baht ceiling reserved for sensitive personal data. Unlawful use of sensitive data also carries imprisonment of up to 1 year under s.79. And it does happen. In 2025 a private hospital was fined 1.21 million baht after patient medical records ended up as snack bags. The cause was not a hacker but a document destruction process that did not exist. See full answer
We want PDPA across the whole business. Where do we start and what is the budget?
Start by finding out what is missing. You do not need to buy every document. The sequence Kooru uses with every business has 3 steps. If you want the Kooru legal team to set up the whole system for you (RoPA, Privacy Notice, Consent and DPIA), the Data Shield Starter package is ฿5,900 (normally ฿9,900, 40% off). More complex organisations use the PRO tier at ฿41,300. See full answer
Is it a PDPA breach to let AI take notes in Zoom meetings?
The tool itself is not the problem, but there are 4 risks that SMEs often overlook. The fix: announce before every recording, use a company account that does not train on your data, and sign a DPA with the provider. Read the full version in the article below. See full answer
Our clinic holds patients’ health data. Do we need a DPO?
Health data is sensitive data under s.26, and if the clinic’s core activity is processing sensitive data, s.41 requires you to appoint a Data Protection Officer (DPO). A real lesson: in 2025 a private hospital was fined 1.21 million baht because medical records became snack bags. A clinic without a dedicated DPO can use a monthly DPO service. See full answer
Does our website need a Cookie Policy?
If your website uses cookies that track behaviour, such as Google Analytics or the Facebook Pixel, you should have both a Cookie Policy and a Privacy Policy, and let visitors choose whether to accept non-essential cookies. These documents are used together. After purchase you can download them immediately, add your shop name and contact details, and start using them. See full answer
We are hiring a new employee. Which PDPA documents do we need?
HR handles personal data from the day an application arrives until after the employee leaves. The documents you need depend on the stage. The three together cost ฿2,870. If you want an expert to review the whole HR process, use Data Shield. See full answer
We are sending customer data to an agency for a campaign. What should we sign?
When an agency processes data on your behalf, it is a data processor, and you should have a Data Processing Agreement (DPA) setting out what it is used for, how long it is kept, when it is deleted and how breaches are reported. If two companies are exchanging data and each uses it for its own purposes, use a Data Sharing Agreement (DSA). And if the agency uses systems located abroad, check the s.28 conditions too. See full answer
Can we get ChatGPT to recommend our shop?
Yes, and it is a different kind of work from traditional SEO. It is called AEO / GEO: making it possible for AI to pick up your shop’s information, answer questions correctly and be confident enough to recommend you. And when you collect customer data for marketing, the PDPA still applies as before. See full answer
When should we register our shop name as a trademark?
Register before you invest seriously in the brand, not after it sells well. The Thai system gives weight to registration, so if someone registers a similar name first, your shop may be at a disadvantage and even have to change its name. Kooru IP Wealth looks after everything from the search and filing through to setting up the IP structure and digital tax. See full answer