Why Your Data Map Comes Before Your Firewall

Key Takeaway

• Know what personal data you hold before spending on tools to protect it.

• The PDPA expects a controller to keep records of processing; the data map is how you produce them.

• Most complaints concern over-collection and missing lawful bases, not hacking.

• Check shadow data: chat groups, old forms, ID-card copies and vendor servers.

• For each flow ask why you have it, who sees it and when it goes.

Before buying more security tools, know what personal data you hold. A practical guide to data mapping and the PDPA record of processing.

Every October, companies are reminded to update passwords, train staff to spot phishing and review their security tools. Those are good habits. But one question tends to go unasked in the rush to buy protection: protect what, exactly?

A firewall guards a door. It cannot tell you how many rooms are behind it, what is stored in each one, or who still holds a spare key. In privacy work, that missing picture has a name: the data map. It is the plain, unglamorous document that records what personal data an organization holds, where it came from, why it is kept, who can reach it and where it travels next. Without it, security spending is guesswork and PDPA compliance becomes a set of policies describing a company that does not quite exist.

Why the regulator keeps returning to basics

By early 2026, Thailand's Office of the Personal Data Protection Committee had logged more than 2,600 PDPA-related complaints. The most common problems were not sophisticated cyberattacks. They were organizations collecting more data than they needed, collecting it without a lawful basis, or using and disclosing it without one. These are mapping failures. A company that does not know what it collects cannot explain why it collects it, and a company that cannot explain why will struggle to defend itself when a complaint arrives.

What the law expects

The PDPA, which took full effect in June 2022, requires a data controller to keep records of its processing activities so that individuals and the regulator can inspect them. In substance, those records describe the categories of personal data, the purposes, the retention period, who receives the data, whether it is transferred abroad, and what security measures protect it. Some smaller organizations benefit from an exemption from this duty, but the exemption does not hold up well where processing is risky or involves sensitive data, so it is worth confirming rather than assuming. In practice, the data map is the working tool from which that formal record is produced.

Where data actually hides

The official systems are rarely the problem. The trouble sits in the corners: spreadsheets on personal laptops, customer details pasted into LINE groups, forms from past events, CCTV footage, marketing tools that quietly accumulated contact lists, and servers that a former agency still controls. HR files deserve special attention. Photocopies of national ID cards, still widely collected in Thailand, can reveal religion, which is treated as sensitive personal data, and the copies often sit in folders that nobody has reviewed in years.

Three questions for every data flow

The most useful mapping exercises are built on three plain questions. Why do we have this data? Who can see it? When does it go?

The first forces a link to a lawful basis and a specific purpose. The second exposes access that has grown too wide, including vendors and former staff. The third turns a vague intention to "keep it for a while" into an actual retention rule, which is where many organizations fail, because deleting data feels risky while keeping it feels free. It is not free. Every stored record is a liability waiting for a breach.

A realistic way to start

The first version does not need special software. In the first week, interview each department about what personal data they use. In the second, list the systems, tools and vendors involved. In the third, match each flow to a lawful basis and a retention period. In the fourth, rank the gaps and fix the riskiest first. The result will be imperfect, and that is acceptable. A rough map reviewed every quarter is far more valuable than a perfect one that never gets built.

When October ends and the awareness posters come down, the data map is what remains. It is the foundation under every other privacy decision, from breach response to vendor contracts to customer consent.

This article is for general information and is not legal advice. Need help mapping your data or preparing PDPA records? Contact Aktivist Group's privacy team.