A PDPA checklist for company websites
What an ordinary corporate site needs in order to sit right with Thailand's Personal Data Protection Act.
Most company websites collect more personal data than their owners realise. At minimum there is the contact form, and frequently analytics on top of that.
The first requirement is a privacy notice that states what is collected, why, for how long, and how someone asks for deletion. Generic text copied from another site rarely matches what the system actually does.
The overlooked part is third-party fonts and maps. Embedding Google Fonts by direct request sends every visitor’s IP address to an overseas server on each page load. Self-hosting the fonts removes that and makes the page faster as a side effect.
Embedded maps are the same. Load them lazily, or only after the visitor asks, so nothing leaves before they have expressed any intent.
For forms, include an explicit consent control with a link to the policy, and record when consent was given — not merely that it was.
Finally, retention. Contact form messages do not need to be kept forever. A deletion schedule is both a compliance measure and a way to limit the damage if there is ever a breach.