← All guides
Compliance Tools5 min read23 July 2026

ComplyKit Now Has 122 Free Compliance Generators: Thailand PDPA + Japan APPI 2022 Amendments

ComplyKit adds Thailand PDPA Compliance Checker (121st) and Japan APPI 2022 Amendments Compliance Checker (122nd) — 42-item APAC privacy law assessments covering Thai PDPC enforcement, 72-hour breach notification, THB 5M penalties, Japan's mandatory 5-day breach notification, pseudonymous processing rules, and cross-border transfer consent with country disclosure.

ComplyKit now offers 122 free compliance generators — no account, no login required. Today we're adding two new tools covering Southeast Asia's leading privacy law and Japan's landmark 2022 APPI amendments, completing our APAC privacy law coverage.

Thailand PDPA Compliance Checker (121st generator)

Thailand's Personal Data Protection Act B.E. 2562 (2019) — the first comprehensive privacy law in Southeast Asia — came into full force on June 1, 2022. Enforced by the PDPC (Personal Data Protection Committee), the law applies to any organisation processing personal data of individuals in Thailand, with extraterritorial reach covering foreign SaaS platforms, e-commerce sites, and app developers serving Thai users. Criminal penalties reach THB 5 million per violation. The Thailand PDPA Compliance Checker covers 42 key obligations across six categories:

  • Lawful Basis & Consent (PDPA Sections 19–26): Valid consent (freely given, specific, informed, unambiguous, separate from other matters, withdrawable without detriment); consent records with date/purpose/withdrawal history; purpose limitation; sensitive personal data explicit consent (9 categories: health, biometric, race, religion, sexual orientation, criminal history, disability, trade union, genetic); legitimate interest basis documented; children's consent (under 10: guardian only; 10–19: minor + guardian); consent withdrawal mechanism
  • Data Subject Rights (PDPA Sections 30–43): Right to access (30-day response with data categories, sources, recipients, retention); data portability in machine-readable format; erasure (purpose complete, consent withdrawn, unlawfully collected); restriction pending challenge; right to object (legitimate interest/direct marketing); rights request intake with 30-day tracking; automated decision-making safeguards with human review right
  • Data Controller Obligations (PDPA Sections 22–29): Privacy notice at collection point; data minimisation; purpose limitation; data accuracy; retention limitation with deletion/anonymisation; technical and organisational security measures; data processor contracts (binding instructions, security, sub-processor controls)
  • Personal Data Breach Notification (PDPA Sections 37–40): PDPC notification within 72 hours of awareness; individual notification for high-risk breaches; breach notifiability assessment; breach incident log; processor notification chain; containment procedures; post-breach review
  • Cross-Border Transfer & Third-Party Sharing (PDPA Sections 28–29): PDPC whitelist/adequacy verification; SCCs or BCRs for non-adequate countries; data sharing agreements; transfer inventory; explicit consent for non-whitelist transfers; additional safeguards for processors in non-adequate countries
  • DPO, Governance & PDPC Enforcement (PDPA Sections 41–48): DPO appointment (large-scale processing, sensitive data, systematic monitoring); DPO contact published; Thai-language privacy policy; DPIA for high-risk activities; RoPA maintained; staff training programme; PDPC complaint handling process

Who it's for: Thai companies and startups; MNCs with Thailand operations; foreign platforms serving Thai users (especially e-commerce, fintech, healthtech, and edtech); legal/compliance teams preparing for PDPC enforcement; organisations processing health, biometric, or financial data of Thai individuals.

Japan APPI 2022 Amendments Compliance Checker (122nd generator)

Japan's APPI 2022 amendments — effective April 1, 2022 — introduced Japan's first mandatory breach notification requirement, a new pseudonymously processed information (仮名加工情報) category, significantly strengthened data subject rights, and enhanced cross-border transfer consent with country name disclosure obligations. The Personal Information Protection Commission (PPC) now has stronger enforcement powers and regularly publishes enforcement cases. Corporate penalties reach JPY 100 million under dual liability provisions. The Japan APPI 2022 Amendments Compliance Checker covers 42 key obligations across six categories:

  • Acquisition & Purpose Specification (Articles 17–21): Purpose specified concretely before/at acquisition; publicly announced or notified immediately; purpose limitation (no secondary use without re-notification); prohibited acquisition methods controls; sensitive PI explicit consent (9 categories); acquisition records; purpose change notifications
  • Third-Party Provision & Opt-Out (Articles 27–30): Opt-in consent for third-party provision; opt-out procedure filed with PPC and publicly announced; provision records 3-year retention; acquisition records 3-year retention; consignment contracts; provision exceptions documented (business succession, statutory); joint use (共同利用) publicly announced
  • Data Subject Rights (Articles 33–39): Right to disclosure within 2 weeks; right to correction/deletion; right to suspension of use or third-party provision; 2022 new suspension grounds (harm to rights/interests, no longer necessary, consent withdrawn); rights request intake with identity verification; statutory timeframe responses; appeal process
  • Pseudonymously & Anonymously Processed Information (Articles 41–46): Pseudonymous processing standard (identifying elements deleted/replaced, reference table destroyed/isolated); no combination with identifying information; purpose limitation; anonymously processed information irreversibility standard; public announcement of information items; re-identification prohibition; security management measures
  • Personal Information Leakage Report (Article 26): PPC speed report (速報) within 5 business days; individual notification without undue delay; notifiable criteria assessment (sensitive PI/1,000+ persons/systematic/criminal purpose); leakage incident register; consignee notification chain; 30-day supplementary report; post-incident improvement process
  • Cross-Border Transfer (Articles 24–28): Foreign third-party provision consent with country name and APPI-equivalent disclosure; PPC adequate country assessment (EU/EEA/UK); contractual measures for non-adequate countries; transfer records 3-year retention; PPC guidance monitoring; data subject on-demand transfer information; annual cross-border compliance review

Who it's for: Japanese companies and startups; MNCs with Japan operations; foreign companies processing personal data of Japanese residents; SaaS companies with Japanese enterprise customers; organisations processing sensitive PI; legal/compliance teams preparing for PPC scrutiny; organisations that transfer personal data outside Japan.

APAC Privacy Law Coverage — Now Complete

With these two additions, ComplyKit now covers all the major APAC privacy laws in a single platform:

Browse all 122 generators

All 122 free compliance generators are at /generate. No account required. Covers GDPR, CCPA, SOC 2, HIPAA, ISO 27001/27701, EU AI Act (GPAI + High-Risk), NIS2, DORA, PSD2/PSD3, FCA Consumer Duty, CSRD, CRA, NIST CSF 2.0, NIST AI RMF, NIST SP 800-53 Rev 5, CMMC 2.0, Digital Markets Act, EU Data Governance Act, EU Data Act, ePrivacy, AI Fairness, SOC 2 Trust Services Criteria, US State Privacy Laws, APRA CPS 230, APRA CPS 234, Singapore PDPA, India DPDP Act, Saudi Arabia PDPL, Australia Privacy Act 2024, Thailand PDPA, Japan APPI 2022, and more.

More guides