Haliviq

PDPA Compliance
Built In, Not Bolted On

A privacy policy on the website is the easy part. The hard part is what happens when a customer emails to say: please delete my data. Haliviq is a founding partner of PDPA.org, and we help Thai companies close that gap. We map where personal data really sits in your systems, fix the consent and cookie flow, build the request process your team will follow, and add the encryption and access control that PDPA expects. You end up with compliance your team can run every day, not a folder on a shelf.

Get Started

As a founding partner of PDPA.org, we help organizations move from a policy document to compliance that actually runs. That starts with an audit and gap analysis built on your real data flows, not a generic checklist. From there we build consent and cookie management into your website and apps, set up data subject access request (DSAR) workflows so a request for access, correction or deletion has an owner and a process, and add privacy and security engineering such as encryption, access control and audit logging inside your systems. We work with your legal or DPO team where you have one, and with your developers where you do not, so the controls stay in place after we leave.

Capabilities

Key Capabilities

Concrete capabilities we bring to this engagement — not buzzwords.

PDPA Audit & Gap Analysis

We trace how personal data enters, moves through and leaves your business, and compare it with PDPA requirements. You receive a ranked list of gaps, each with the reason it matters and a practical fix. It suits companies with a policy on paper who want to know whether it holds up in practice.

Consent & Cookie Management

A cookie banner and consent flow built into your website and apps, with a preference centre where visitors can change their choices. Every choice is saved with a timestamp, and analytics and ad tags only run once consent is given.

Data Subject Request Workflows

A defined process for access, correction and deletion requests: where they arrive, who verifies identity, which systems are searched, and how the reply and the record are kept. Your team gets a clear checklist and deadlines instead of improvising each time.

Privacy & Security Engineering

Encryption at rest and in transit, role-based access, and audit logs that show who viewed or changed personal data. We build these into your systems alongside your developers, so protection exists in the product and not only in a document.

Data Mapping

A clear map of where personal data lives across apps, databases, SaaS tools and shared files: what is collected, the purpose, how long it is kept and who receives it. It is the foundation for the audit and for your records of processing.

Training & Governance

Practical training for staff who handle personal data every day, and a light governance routine covering owners, privacy checks for new projects and scheduled reviews, so compliance keeps working after the engagement ends.

Areas We Cover

Frameworks & Controls

The compliance frameworks and technical controls we implement, chosen to match your actual risk profile.

PDPA (Thailand)GDPRConsent ManagementCookie ComplianceData MappingDSAR WorkflowsEncryptionAccess Control & IAMAudit LoggingISO 27001

How We Work

Our Approach

A clear path from audit to real, sustained compliance — adjusted per organization, never one-size-fits-all.

01

Audit

Interviews and a review of your systems, forms and data flows

02

Gap Analysis

Each gap written down with its severity and the effort to close it

03

Roadmap

Fixes ranked by risk and effort, with quick wins first

04

Implementation

Consent flow, request workflow and security controls built with your team

05

Training

Hands-on sessions and short guides for the people who handle data

06

Monitoring

Scheduled reviews as your systems and the rules change

FAQ

Straight answers about how we handle PDPA compliance.

It is a structured review of your actual data flows, consent points and existing controls, compared against PDPA requirements. You get a prioritised, actionable list of gaps to close, each with a plain explanation and a suggested fix. It is based on how your business really handles data, not on a generic checklist.

Yes. We design and build the workflow so your team can handle access, correction and deletion requests reliably and inside the required timeframe, across whichever internal systems hold the data. That includes who verifies identity, how the data is found and how each request is logged.

We are a founding partner of PDPA.org and bring hands-on implementation experience across audits, consent systems and request workflows, not just policy templates.

Yes. Many controls overlap between the two frameworks, and we build with both in mind wherever your business has customers or operations outside Thailand.

A focused audit and gap analysis typically takes 2-3 weeks. A full remediation program that includes consent management, request workflows and security controls usually runs 8-12 weeks, depending on how many systems are involved.

A standalone audit and gap analysis typically starts in the low five figures (THB). A full implementation program is quoted after the audit, based on the number of systems and gaps that need work. We give you the range before you commit to the larger phase.

That is one of the most common situations we see. The gap analysis checks whether what the policy promises can actually be done. We then build the missing workflows and controls instead of only editing the document.

Yes, as an option. Data flows and systems change over time, so we offer periodic re-reviews to keep your setup current, rather than accurate only on the day of the first audit.

A list of the systems and tools that hold customer or employee data, your current privacy policy and consent wording, and a few people who can explain how data is handled day to day, such as marketing, HR, IT and customer service. We take it from there.

Have a project in mind?

We'd love to hear what you're building.

Start a Conversationinfo@haliviq.com