Get Ready for the PDPC Certification Mark

Since the Personal Data Protection Act B.E. 2562 (2019) (“PDPA”) came into effect, many organizations have become increasingly aware of the importance of personal data protection and have taken steps to comply with the PDPA. These include establishing personal data protection policies, preparing Privacy Notices to inform data subjects, maintaining Records of Processing Activities (ROPA), as well as implementing various processes to support personal data protection within the organization. Today, however, the key question may no longer simply be “Has the organization complied with the PDPA?” Instead, the question is increasingly becoming “Can the organization demonstrate that the measures it has established are actually implemented in practice and meet an adequate standard?”

Personal Data Protection Certification Mark

The Personal Data Protection Certification Mark, or the certification and certification mark for personal data protection standards, is a certification process established by the Office of the Personal Data Protection Committee (PDPC Office) to provide a framework for certifying personal data protection standards for both public- and private-sector organizations. The personal data protection standard assessment criteria consist of 4 categories, 10 areas, and 128 requirements, covering the following areas:

- Policy and Governance

- Human Resource Development (HRD)

- Process and Procedure

- Technology Security and Breach Response

The assessment criteria are based on internationally recognized standards and practices, including ISO standards, NIST, concepts derived from the GDPR, and guidance issued by the UK Information Commissioner’s Office (ICO). The certification is intended to strengthen credibility and confidence among the public and international stakeholders by demonstrating that an organization acts responsibly and maintains an adequate level of personal data protection comparable to internationally recognized standards. Entering the certification process therefore represents another important step in strengthening an organization’s personal data protection practices. It serves as a mark of the organization’s commitment and dedication to personal data protection, moving beyond having policies and procedures in place toward demonstrating their actual implementation in practice, supported by verifiable evidence.

The Difference Between the Personal Data Protection Certification Mark and the Privacy Maturity Model

One question that many organizations may have is If an organization has already undergone a Privacy Maturity Model (PMM) assessment, how is the Personal Data Protection Certification Mark different from what has already been undertaken? Is any additional action required? The answer is that, although the two are related, they have clearly different objectives and processes.

6 Steps for Participating in the Personal Data Protection Certification Mark Process

- Step 1: Conduct a Self-Assessment against the Personal Data Protection Standard Assessment Criteria (PMM)

The organization conducts an initial self-assessment of its readiness and must achieve Level 5 under the assessment criteria.

- Step 2: Prepare the Application, Assessment Form, and Policy Documents

The organization prepares and submits its policy documents and supporting evidence through the electronic system designated by the PDPC Office.

- Step 3: Document Review by the PDPC Office

The PDPC Office conducts a preliminary review to determine whether the submitted documents are complete and meet the applicable criteria.

- Step 4: Assessment by the PDPC Office

The PDPC Office conducts a detailed assessment through document review and/or an on-site assessment.

- Step 5: Review of the Assessment Results

The designated review committee reviews and endorses the assessment results to confirm that organizations meeting the criteria are capable of effectively protecting personal data in accordance with the law.

- Step 6: Formal Certification of the Results

The Secretary-General of the Personal Data Protection Committee formally certifies the results, after which the PDPC Office issues the Personal Data Protection Standard Certificate and Certification Mark to the organization.

Benefits of Obtaining the Personal Data Protection Certification Mark

Both public- and private-sector operations require the collection, use, and disclosure of personal data in order to carry out their activities. The certification process is therefore intended to strengthen credibility and trust among organizations in Thailand, across both the public and private sectors, by systematically raising personal data protection standards, reducing cybersecurity risks and the risk of violating or failing to comply with personal data protection laws, and enhancing data management standards to a level comparable with international standards. When an organization successfully passes the assessment and obtains the Personal Data Protection Standard Certificate and Certification Mark, this not only demonstrates that the organization is prepared to take responsibility for personal data under its control and has fully complied with personal data protection laws, but also shows that the organization places importance on personal data protection and has appropriate processes in place for effective data management. This includes processes for managing and responding to personal data breaches, which may contribute to reducing the occurrence of personal data breaches in Thailand. It also demonstrates that the organization is prepared to conduct business and communicate with other organizations internationally under personal data protection standards comparable to those recognized at the international level. In addition, participation in the assessment process contributes to strengthening Thailand’s personal data protection ecosystem as a whole. This benefits both the organization’s reputation and Thailand’s overall image, while increasing public confidence that individuals’ personal data will receive a high level of protection. Preparing for the PDPC Certification Mark

If your organization aims to prepare for an assessment under the personal data protection standard assessment criteria in order to apply for the Personal Data Protection Certification Mark (PDPC Certification Mark), having experienced professionals assist in assessing organizational readiness, analyzing gaps, and preparing an implementation approach aligned with the relevant criteria can help the organization prepare for the assessment in a systematic and efficient manner.