Your website has a contact form. Someone types their name, email and a message, and presses Send. You have just collected personal data, and under Thailand's Personal Data Protection Act (PDPA) that comes with responsibilities, even if you are a five-person company.
This is a practical checklist for a Thai SME website that collects enquiries. It is written for owners, not lawyers. It is general information and not legal advice. The PDPA has detail, exceptions and regulator guidance that depend on your business, so have a Thai lawyer review your specific case before you rely on any of it.
Start by knowing what you collect
You cannot write a notice for data you have not listed. Open your website and follow each place where a visitor can give you information. For most SME sites that means:
- A contact or quote form. Typically name, email, phone, LINE ID, company, message.
- Direct email and phone. What people tell you when they contact you outside the form.
- Technical logs. Your hosting provider may record IP addresses and browser details for security and operation.
- Cookies and analytics. Anything that tracks visitors across pages or sites.
- Chat widgets, booking tools and newsletter sign-ups. Each is a separate collection point, often run by a third party.
Then go one step further and ask where the data goes after the form. A form that emails you has already copied the data into a mailbox. If you forward it to a colleague, paste it into a spreadsheet or log it in a CRM, each of those is another copy. Draw this as a simple list: where the data enters, where it is stored, who can see it. This map is the basis of every other step.
Collect less
The most reliable way to reduce PDPA risk is to ask for less. Go through each form field and ask: do we need this to answer the enquiry?
- Name and email: usually yes.
- Message: yes.
- Phone or LINE ID: useful, but make it optional if email works.
- Company name: optional.
- ID numbers, date of birth, home address, photos: almost never needed to answer a first enquiry.
Also tell people not to put sensitive details in free-text boxes, such as health information, ID numbers or passwords. A short line under the message box does this well. Some categories of data are treated more strictly under the PDPA, and a lawyer can tell you which ones matter to your sector.
Tell people what you do: the privacy notice
People should be able to find out, at or before the point of collection, what you collect and why. A privacy notice linked right beside the Send button, and again in the footer, is the usual way to do it. A good one is plain, specific and matches reality. It covers:
- Who you are: the legal name of the company, its registered office and how to contact you.
- What you collect: each field, plus what the system adds automatically, such as date, time and IP address.
- Why you use it: replying to the enquiry, keeping business records, protecting the site, and marketing only if the person agrees.
- Who else sees it: your hosting provider, email provider and any tool that touches the data.
- Whether it goes abroad: many email and cloud tools run servers outside Thailand. Say so in general terms and make sure any transfer is done in a way the law allows.
- How long you keep it.
- The person's rights and how to use them.
- How to complain. The PDPA is overseen by the Personal Data Protection Committee (PDPC).
You can see a worked example on our own privacy notice. It describes exactly what our own contact form and mailboxes do, which is the point: yours should describe what yours does. Treat it as an illustration of the structure and the plain tone, not a template to copy. A notice that claims you do not use a database, or have no cookies, when you do, is worse than none.
Consent, contract and legitimate interest in plain language
The PDPA requires a lawful basis for using personal data. People often assume everything needs a consent tick-box. It does not. Here are three of the bases a typical enquiry form relies on, in plain terms. There are others, and a lawyer can tell you which apply to you.
Steps requested by the person
If someone writes to ask for a quote, you need their details to reply. They started the contact. Using the data to answer, arrange a call and prepare a proposal fits naturally here, and you should not hide it behind a consent box.
Legitimate interests
Some uses are reasonable for running a business, such as keeping a record of enquiries or filtering spam, as long as they do not override the person's own interests. This is a balancing test, not a free pass. It is also why you keep the use narrow and tell people about it.
Consent
Consent is for things the person could reasonably say no to, with marketing the main example. For consent to mean anything, it has to be a real choice:
- Separate from the enquiry. Sending a question must not depend on agreeing to marketing.
- Unticked by default. A pre-ticked box is not a choice.
- Specific. Say what they will receive and from whom. Consent to updates from your company is not consent to share their details with partners.
- Withdrawable. Make unsubscribing as easy as subscribing, and honour it.
- Recorded. Keep a note of who agreed, when and to what wording.
If you are unsure which basis fits which use, that is exactly the question to put to a lawyer.
Keep marketing apart from the enquiry
This deserves its own section, because it is where small businesses most often slip. A customer who asked for a quote on a smart-home install did not ask for your monthly newsletter, your LINE broadcasts or a call about a promotion.
A clean setup looks like this:
| Item | Enquiry | Marketing updates |
|---|---|---|
| Triggered by | Pressing Send | Ticking a separate, optional box |
| Box ticked by default | n/a | No, never |
| Purpose | Reply, call, proposal | Updates you describe |
| If declined | Enquiry still goes through | No updates |
| Stored with | The enquiry record | A flag with date and wording |
If you import enquiry emails into a newsletter tool, you are doing the opposite of this. Only import people who ticked the box.
Decide how long you keep data
"We keep it forever" is rarely a considered decision. Personal data should be kept only as long as you need it for the purpose you stated, plus any period the law requires you to keep certain records. Accounting records, for instance, may have their own rules, so ask your accountant what applies to invoices and contracts.
For enquiries that never became customers, choose a period you can defend, write it in your notice and put a reminder in the calendar to clear them out. A simple routine is enough: once or twice a year, search the mailbox and any spreadsheet for old enquiries and delete them. Remember backups, shared drives and exported lists.
Be ready for people's rights
Under the PDPA, people can ask you, in general terms, to let them see their data, correct it, delete it, restrict or object to a use, move it in a usable format in some cases, and they can withdraw consent. Your notice should say how to ask. In practice you need three things:
- A named place to send requests. A monitored email address is fine for a small company.
- A way to confirm identity before you hand over or delete anything.
- The ability to find the data. This is where the data map from the start earns its keep. If one enquiry lives in a mailbox, a backup mailbox, a spreadsheet and a LINE chat, you must be able to find all four.
Pick a target reply time that you can actually meet, and state it as an aim. Our own notice, for example, states an aim for replying rather than a promise; whatever you choose, make sure the people handling requests know it. Ask your lawyer whether any particular timeframe applies to you, because we have not set one out here.
Cookies and analytics
If your site sets no analytics, advertising or tracking cookies and loads no third-party trackers, your cookie position is simple, and you can say so in the notice. If you add Google Analytics, a Facebook pixel or a chat widget that sets cookies, the position changes: generally you will need to tell people and, for non-essential tracking, ask for consent before it runs. Check what your site actually sets, using your browser's developer tools or a cookie scanner, instead of trusting memory. And update the notice before you add a new tool, not after.
Security basics that people forget
A notice is only part of it. You are also expected to protect the data. For an SME that means ordinary hygiene:
- Strong, unique passwords and two-factor authentication on email, hosting and any CRM.
- Access limited to the people who need it, and removed when staff leave.
- An encrypted connection (HTTPS) on the whole site, and on the form in particular.
- No customer data in group chats, personal Gmail or USB sticks if you can avoid it.
- A plan for what you do if something goes wrong, such as a lost laptop or a hacked mailbox. The PDPA includes duties around data breaches, and the details are a lawyer's job, so ask before an incident, not during one.
The checklist in one place
- Map every place the website collects data and where it goes.
- Remove fields you do not need.
- Publish a privacy notice that matches reality, linked beside the form and in the footer.
- Rely on the right basis for each use; do not hide everything behind consent.
- Make marketing a separate, unticked, optional box, and keep a record.
- Choose a retention period and schedule the clear-out.
- Name where requests go and practise finding one person's data.
- Check cookies and trackers; update the notice before adding tools.
- Secure the mailboxes and tools that hold the data.
- Have a Thai lawyer review the notice and the data flows.
Where we can help, and where we cannot
We build the plumbing: forms that collect less, consent boxes that stay separate, enquiry flows that put data in one place instead of five, and deletion routines that can actually find a record. See our workflow automation work and pricing. We do not give legal advice, and nothing here replaces a lawyer reading your case.
If your enquiry flow has grown messy, talk to us about tidying the technical side before you send it to your lawyer.