Personal Data Protection (PDPA) Policy

1. Scope

This policy applies to all employees, contractors and partners who handle personal data on behalf of the company.

2. Lawful basis

We process personal data only under a lawful basis: contract, legal obligation, legitimate interest, vital interest, public task or consent.

3. Data subject requests

Forward any access, correction or deletion request to dpo@example.org on the same day. We respond within 30 days.

4. Breach reporting

Report suspected breaches to the DPO immediately. The company notifies the PDPC within 72 hours where required.

Attachments

Acknowledgement required

Confirm that you have read this version (v3.2). Your acknowledgement is recorded in your training transcript.

Version history

• v3.208 Oct 2026Clarified breach reporting contact and 72-hour rule.Napat Chaiyaporn
• v3.015 Jan 2026Added CCTV and HR data sections.Napat Chaiyaporn