Skip to content
+66 93 004 4098 Get a quote
Get a quote Call +66 93 004 4098

Services

PDPA compliance built into your website, from cookie consent to consented forms

We build the parts of your website the PDPA touches: a consent banner that blocks trackers, a clear privacy notice and forms that ask properly.

Get a quote

What does PDPA compliance mean for a website?

For a website, PDPA compliance means three duties: if your site collects anything that identifies a person, you need a lawful reason to collect it, you must tell people what you do with it, and where consent is the basis, you must ask before you collect, not after.

Thailand's Personal Data Protection Act B.E. 2562 (2019) has been fully enforced since 1 June 2022, and the Personal Data Protection Committee (PDPC) is the regulator. We build these duties into your website: cookie consent that blocks trackers, privacy notices and consented forms. PDPA cookie consent is part of the Starter package from THB 10,000; on other builds the PDPA scope is set in your quote.

So yes, PDPA compliance applies to an ordinary business website. The question is where your site touches personal data, and on most Bangkok business sites it is more places than owners expect:

  • Cookies and trackers: Google Analytics, the Meta pixel, TikTok and Google Ads tags, heatmap tools, embedded YouTube videos and maps.
  • Forms: contact, booking, quote and newsletter forms that capture names, phone numbers, email addresses or LINE IDs.
  • Onward sharing: form entries that are forwarded to a WhatsApp number, a shared Gmail inbox or a CRM, sometimes outside Thailand.
  • Stores: customer accounts, delivery addresses passed to couriers, and payment data handled by the gateway.

Our job as developers is to build these parts so they behave the way your notice says they do. We are web developers, not lawyers: we do not issue legal opinions or compliance certificates, and your business remains the party responsible under the Act. For the law itself explained for owners, read the PDPA guide for website owners. For the wider build these features sit inside, see our custom website development service.

Many Thai websites show a cookie banner that changes nothing. The visitor clicks "Accept" or ignores it, and the analytics and ad pixels have already fired on page load. That banner is decoration, not consent.

A banner we build works in the order the law expects:

  1. Strictly necessary cookies load. Session, security, language choice and cart cookies, which the site cannot run without.
  2. Everything else waits. Analytics, marketing pixels and third-party embeds are held back until the visitor chooses.
  3. The visitor chooses by category. Accept all, reject all, or pick analytics and marketing separately. Rejecting is as easy as accepting.
  4. The choice is stored and can be changed. A link in the footer reopens the settings at any time.

On WordPress we usually wire this through Google Consent Mode and a consent tool, so Google tags respect the visitor's choice. Which tool fits depends on your traffic, your tag setup and whether you need consent logs; we compare the options in our round-up of consent management platforms for Thai sites. If you want the reasoning behind categories, wording and banner design, our article on getting PDPA cookie consent right goes into detail.

Bilingual banners

If your visitors read Thai and English, the banner and the settings panel should switch with the site language. A Thai visitor who meets an English-only consent box has not really been informed, so on bilingual builds we translate both.

Privacy notices and consented forms

The banner handles cookies. The privacy notice and your forms handle everything a visitor types in. These are the components we build into a PDPA-ready site, with the exact scope written into your quote.

The privacy notice

The notice has to say what you collect, why, the legal basis, how long you keep it, who you share it with (couriers, payment gateways, your email provider) and how people can ask to see or delete their data. We build the page, link it from every form and the footer, and publish it in both languages on bilingual sites. You supply or approve the wording, ideally with your own legal adviser, because only you know how your business actually uses the data.

Forms that ask properly

A consented form states its purpose next to the fields, collects only what that purpose needs, and keeps marketing consent separate from the enquiry itself. A booking form does not need a date of birth. A quote request does not need a home address. An unticked checkbox for "send me offers" is separate from the submit button, and the form records when consent was given.

  • Consent bannerBlocks non-essential scripts until the visitor chooses, with reject as easy as accept.
  • Privacy notice pageLinked from the footer and every form, in Thai and English on bilingual sites.
  • Purpose statementsA short line on each form saying why the data is collected.
  • Minimum fieldsOnly the fields the purpose needs; optional fields marked clearly.
  • Separate marketing consentAn unticked checkbox, never bundled with the enquiry.
  • Consent recordsTime and choice stored with the submission or in the consent tool.
  • Data routing reviewWhere entries go: email, WhatsApp, CRM, and who can see them.

Is your current website PDPA compliant?

People search for a "PDPA audit" when they suspect their existing site has gaps. You can find most of the technical ones yourself in half an hour with a private browser window and your phone:

  1. Open the site in a fresh private window and do nothing. Is there a consent banner? Does it offer a real reject option?
  2. Check what loads before you choose. In the browser's developer tools, look at the Network tab for requests to Google Analytics, Facebook or TikTok before you click anything. If they fire, the banner is not blocking.
  3. Find the privacy notice. Is it linked from the footer and from each form? Is it in Thai if your customers read Thai? Does it name the tools you actually use?
  4. Read every form. Does each one say why it asks? Are there fields you never use? Is marketing consent a separate, unticked box?
  5. Follow the data. Submit a test enquiry and see where it lands: whose inbox, whose phone, which spreadsheet.
  6. Look at old plugins. Abandoned form or chat plugins sometimes keep storing entries in the database long after you stopped reading them.

This is a technical check, not a legal audit. It shows where the website does not match good practice; it cannot tell you whether your business meets the Act as a whole. For a fuller do-it-yourself version, see our website PDPA audit checklist. If the check turns up problems, we can fix them as part of a redesign or a scoped repair.

Clinics and sensitive data

The PDPA treats some personal data as sensitive, including health information, and holds it to a stricter standard, generally needing explicit consent. That makes clinic websites the case where form design matters most.

A dental or aesthetic clinic's booking form often asks, almost by habit, "What treatment are you interested in?" or "Describe your symptoms". Once a patient types a condition into that box, the website is collecting health data. The practical steps we take on clinic builds:

  • Keep the online form to booking details: name, contact, preferred date and branch, and a general service category.
  • Leave symptoms and medical history for the consultation, not the web form, unless there is a clear need and explicit consent wording approved by the clinic.
  • Avoid sending form contents in full to personal WhatsApp numbers or shared inboxes; send a notification and keep the detail in one controlled place.
  • Keep before-and-after photos and patient stories off the site unless the clinic holds written consent for that use.

We cover the rest of what a clinic site needs, from treatment pages to bilingual booking, on our page about websites for dental and medical clinics.

PDPA and GDPR

The PDPA was modelled closely on the EU's GDPR, so a website built to GDPR standards usually covers most of the same technical ground: consent before tracking, a clear notice, data minimisation and rights requests. The differences sit in the details, such as the regulator, the Thai-language expectations and the enforcement regime, which we set out in our side-by-side comparison of PDPA and GDPR. If you serve European guests or clients as well as Thai ones, tell us early and we will plan the consent setup for both audiences.

PDPA features in our packages

The Starter package, from THB 10,000, lists PDPA cookie consent alongside up to five custom pages, a mobile-first WordPress build and contact, WhatsApp and LINE buttons. The Business package, from THB 30,000, adds English and Thai, forms and booking or enquiry flows, which is where a privacy notice and consented forms matter most. On any build, the PDPA scope (banner, notice pages in each language, form consent, consent records) is agreed and written into your quote, so you know exactly what is included before work starts.

All prices are indicative starting points, and the written quote sets the final figure. Compare the tiers on our pricing page, or send us your current site and get a written quote for a new build or a PDPA repair.

  • Starter

    from THB 10,000indicative, one-time

    For a new business that needs a credible 5-page site quickly.

    • Up to 5 pages, custom design
    • WordPress, mobile-first
    • Contact, WhatsApp and LINE buttons
    • On-page SEO and PDPA cookie consent
    Starter details
  • Business

    from THB 30,000indicative, one-time

    For established companies with more pages, two languages and lead capture.

    • Up to 15 pages, English and Thai, two revision rounds
    • Custom WordPress theme, no page builder
    • Blog, forms, booking or enquiry flows
    • Keyword mapping and schema markup
    Business details
See full pricing

Indicative starting prices, one-time. The final price is set in the written quote for each project, and payment terms are set out in your quote.

PDPA guides

If you want to understand the rules before talking to anyone, start with the articles below, or browse everything we have written under PDPA and compliance. When you are ready, WhatsApp or call us on +66 93 004 4098, or email service@websitedevelopmentbangkok.com with your site address and what worries you most.

Sources

Common questions

Does my small business website need to follow the PDPA?

If the site collects personal data from people in Thailand, even a name and phone number through a contact form, or runs analytics and ad pixels, the Act applies to that processing. Size alone does not exempt a business. For a small site the work is usually modest: a consent banner that blocks trackers, a privacy notice, and forms that ask only for what they need.

Is a cookie banner enough for PDPA compliance?

No. A banner covers cookies and trackers, and only if it actually blocks them until the visitor chooses. The PDPA also expects you to explain what you collect in a privacy notice, have a lawful basis for each form, keep marketing consent separate, and handle requests to access or delete data. The banner is one visible part of a wider set of obligations that sit with your business.

Do you write the privacy policy for my website?

We build the privacy notice page, structure it around what the site really collects, and list the tools and processors we set up, such as analytics, the form handler and the payment gateway. The final wording is yours to approve, and we recommend a legal adviser reviews it, because we are web developers and do not give legal opinions. On bilingual sites we publish it in Thai and English.

Can you check my existing website for PDPA gaps?

Yes, as a technical review: we look at what loads before consent, how the banner behaves, whether the notice matches the tools in use, what each form collects and where submissions go. You get a list of fixes and a quote for them. It is not a legal audit and we do not issue certificates, but it tells you where the website itself falls short.

Is PDPA consent included in your packages?

PDPA cookie consent is listed in the Starter package, from THB 10,000. On Business and E-commerce builds it is set in your written quote, and the rest of the PDPA work (privacy notice pages, consent wording on forms and consent records) is scoped and written into your quote, so it is clear before work begins. Prices are indicative starting points and the quote sets the final figure.

Tell us about your website

Send a few lines on WhatsApp or through the quote form. You get a written quote with the scope, timeline and price for your project.

Get a quote

Or WhatsApp or call +66 93 004 4098, every day, 10:00 to 19:00 ICT. service@websitedevelopmentbangkok.com

WhatsApp Call