# PDPA — Thai Personal Data Protection Act (B.E. 2562)

How LOMA-PORTAL satisfies Thailand's PDPA. Map of articles → control. Always read alongside the latest PDPC guidance.

## Lawful basis

| PDPA section               | Our basis                                                    | Where it shows up                                                              |
| -------------------------- | ------------------------------------------------------------ | ------------------------------------------------------------------------------ |
| §19 (consent)              | Explicit consent at account creation + per sensitive feature | Consent records in `consent` table (added when needed); UI shows clear purpose |
| §24 (contract performance) | Default for employee/portal accounts                         | Documented in the employment contract                                          |
| §26 (legitimate interest)  | Security, fraud prevention                                   | `audit_logs` retention                                                         |

## Data subject rights

| Right            | PDPA § | Implementation                                                                                                                            |
| ---------------- | ------ | ----------------------------------------------------------------------------------------------------------------------------------------- |
| Access           | §30    | `/admin/data-export` (DSAR) — see [`dsar-runbook.md`](dsar-runbook.md)                                                                    |
| Rectification    | §35    | Self-service profile edit + admin user edit                                                                                               |
| Erasure          | §33    | Anonymize-in-place via `database/scripts/anonymize/anonymize_user.sql` — see [`right-to-erasure-runbook.md`](right-to-erasure-runbook.md) |
| Restriction      | §34    | `User.isActive = false` keeps data, denies access                                                                                         |
| Portability      | §31    | DSAR export in JSON                                                                                                                       |
| Objection        | §32    | Withdraw consent in account settings; logged                                                                                              |
| Withdraw consent | §19    | `consent.withdrawn_at` set; audit emitted                                                                                                 |

## Data classification

See [`data-classification.md`](data-classification.md).

## Retention

See [`data-retention.md`](data-retention.md). Audit logs retained 2 years (legal requirement).

## DPO + responsibilities

- **DPO** — assigned per tenant (placeholder: `dpo@loma-portal.example`).
- **Data Controller** — Loma Group.
- **Data Processor(s)** — hosting provider, email provider, S3 provider.

## Cross-border transfer

Default region: Thailand (Bangkok). If data leaves Thailand, document the §28 mechanism (adequacy or appropriate safeguards) and tell the data subject.

## Breach response

See [`breach-response-playbook.md`](breach-response-playbook.md). 72-hour notification window to PDPC + affected data subjects.

## Where compliance lives in code

- `audit_logs` table — every auth event, role change, sensitive read/write
- `database/scripts/anonymize/anonymize_user.sql` — right-to-erasure
- `consent` table (added when the first PDPA flag flips a UI surface)
- `.claude/skills/pdpa-data-export/SKILL.md` + `pdpa-data-deletion/SKILL.md`

## Annual review

PDPC publishes new guidance. DPO reviews this doc + the runbooks every January.
