1. Introduction

Silk Legal Co., Ltd. (“Silk Legal”, “we”, “us” or “our”) is a law firm that provides legal services to clients. Our firm is registered in, and governed by the laws of, the Kingdom of Thailand.

We collect and process Personal Data in order to provide legal services to clients, comply with requirements set by the Thai government, and fulfil any other obligations we may be subject to. These include procedures relating to recruitment and employment.

This policy explains how we collect, use, disclose and protect Personal Data. It also explains the rights of Data Subjects. We carry out these activities in accordance with Thailand’s Personal Data Protection Act B.E. 2562 (2019) (“PDPA”) and its subordinate regulations. Silk Legal is committed to applying best practices in data protection. We promote a culture of safeguarding Personal Data among our staff.

For the purposes of the PDPA, Silk Legal is the Data Controller of the Personal Data described in this policy.

2. Definitions

“Personal Data” means any information relating to a person that enables that person to be identified, whether directly or indirectly. It does not include information relating to a deceased person.[1]

“Sensitive Personal Data” means Personal Data relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, sexual behaviour, criminal records, health data, disability, trade union information, genetic data, biometric data, or any other data that affects a Data Subject in a similar manner.[2]

“Data Subject” means a natural person whose Personal Data is collected, used or disclosed.

“Data Controller” means a person or juristic person who has the power and duty to make decisions regarding the collection, use or disclosure of Personal Data.[3]

“Data Processor” means a person or juristic person who collects, uses or discloses Personal Data under the instructions of, or on behalf of, a Data Controller. A Data Processor is not itself the Data Controller.[4]

“Processing” means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, transfer and deletion.

“PDPC” means the Personal Data Protection Committee established under the PDPA.

3. Scope

This policy applies to all Personal Data that Silk Legal collects from clients, prospective clients, their representatives and other third parties in the course of our work. It covers:

the provision of legal services and related client engagements;
digital communications, our website and other online services;
marketing activities, surveys and newsletters;
events and seminars hosted by Silk Legal;
recruitment and employment procedures;
dealings with suppliers, service providers and business partners; and
compliance with requests from government agencies, courts, tribunals and law enforcement agencies.

4. Personal Data We Collect

4.1 Sources of Personal Data

We generally collect Personal Data directly from our clients or their authorised representatives. We may also collect Personal Data, directly or indirectly, from the following sources:

Silk Legal’s website and online platforms;
government agencies, regulators, courts, tribunals and other law enforcement agencies;
public records and publicly available sources, such as company registration databases;
auditors, banks and other financial institutions;
counterparties, opposing parties and their legal advisers in a matter;
employment and recruitment agencies, and referees named by job applicants;
hospitals and insurance companies, where relevant to a matter or to employment; and
CCTV systems installed at our office.

We may collect Personal Data in person or through communication channels such as telephone, post, email, our website and online applications.

4.2 Categories of Personal Data

Depending on our relationship with you, the Personal Data we collect may include:

Identity data: name, title, date of birth, nationality and photographs.
Identification documents: national ID card, passport, work permit, visa, tax identification number and social security number.
Contact data: telephone number, email address, and home or office address.
Financial data: billing address, bank account details, payment information, bank statements and credit bureau information.
Education and employment data: qualifications, employment history, job title and employer. This applies to job applicants, current employees and former employees.
Property data: land title deeds, property registration documents and vehicle registration details.
Matter data: information contained in documents and correspondence that clients provide to us in connection with a legal matter.
Technical data: IP address, device and browser information, cookie identifiers, log files and approximate location.
Images and recordings: CCTV footage and photographs or video taken at our events.
Sensitive Personal Data: see section 4.4 below.

4.3 Personal Data Received Through Specific Channels

The table below sets out the Personal Data we receive through our online channels and on-site systems, and why we collect it.

Channel	Personal Data we receive	Purpose
Online job applications	• Name, contact details and date of birth • CV, cover letter, education and employment history • Current and expected salary • Referee details • Any other information the applicant chooses to provide	To assess the applicant’s suitability for the role, contact the applicant, and manage the recruitment process.
Online subscriptions and event registrations	• Name and email address • Company name and job title • Areas of legal interest • Dietary or access requirements for events, where provided	To send newsletters and legal updates, and to organise events and seminars.
Online inquiries (contact form, email, chat and social media messages)	• Name, email address and telephone number • Company name • Details of the inquiry and any documents attached	To respond to the inquiry, run conflict checks, and assess whether we can act for the person making the inquiry.
CCTV	• Images and video of individuals at our office premises • Date and time of recording	To protect the safety and security of our premises, staff, clients and visitors. CCTV does not record audio.
Website cookies	• IP address, browser and device information • Pages visited and time spent on the site	To operate the website and, with consent, to analyse website use and deliver advertising. See section 11.

4.4 Sensitive Personal Data

We only collect Sensitive Personal Data where it is necessary for a specific matter or purpose. Examples include health information needed for an insurance or employment claim, or criminal record information needed for a work permit or visa application.

We collect Sensitive Personal Data with the explicit consent of the Data Subject, unless another legal basis under Section 26 of the PDPA applies. These bases include where the data is necessary to establish, comply with, exercise or defend legal claims, or to comply with the law. We apply stricter access controls to Sensitive Personal Data.

4.5 Personal Data of Minors

Our services are not directed at minors. Where we need to process the Personal Data of a minor in connection with a matter, we will obtain the consent of the person with parental authority where the PDPA requires it.

5. Legal Basis and Purposes of Use

5.1 Legal Basis

We only collect, use and disclose Personal Data where we have a legal basis to do so under Section 24 of the PDPA. The legal bases we rely on are:

Contract: the processing is necessary to perform a contract with the Data Subject, or to take steps at the Data Subject’s request before entering into a contract.
Legal obligation: the processing is necessary to comply with a legal or regulatory obligation.
Legitimate interest: the processing is necessary for our legitimate interests or those of a third party. We only rely on this basis where those interests are not overridden by the Data Subject’s rights and freedoms.
Vital interest: the processing is necessary to prevent or suppress a danger to a person’s life, body or health.
Public task: the processing is necessary to carry out a task in the public interest or to exercise official authority.
Consent: where none of the above bases applies, we ask for the Data Subject’s consent. We ask for consent separately from other terms, in clear language, and before or at the time of collection.

5.2 Purposes of Use

We use Personal Data for the following purposes:

to perform our contractual obligations to clients;
to carry out conflict checks and client due diligence (know-your-client) procedures;
to process and respond to requests and inquiries;
to research, prepare and review legal advice and opinions;
to represent clients before government agencies, courts and tribunals;
to comply with our legal and regulatory obligations;
to manage billing, accounting and payroll;
to manage recruitment and employment;
to operate, monitor and improve our business and services;
to maintain good relationships with our clients;
to send legal updates, newsletters and marketing materials (see section 10); and
to protect the security of our premises, staff, clients and visitors, including through CCTV.

If the Personal Data we need is not provided, we may not be able to perform our current or future engagements with our clients.

5.3 Our Data Handling Principles

We will ensure that we use Personal Data in compliance with the law by:

only collecting and processing the Personal Data needed for the purposes identified to the Data Subject;
keeping the Personal Data we hold accurate and up to date;
only keeping Personal Data for as long as necessary, in line with section 8 of this policy;
ensuring that Personal Data can only be accessed by those who need it, and that it is held and transferred securely; and
notifying Data Subjects before we use their Personal Data for a new purpose.

We ensure that staff who handle Personal Data on our behalf are aware of their responsibilities under this policy and under our other data protection and information security policies.

6. Disclosure of Personal Data

We may share, disclose or transfer Personal Data to the third parties listed below. We only disclose the Personal Data that is necessary for the relevant purpose.

6.1 Third-Party Data Controllers

Government authorities, such as the Ministry of Commerce, the Revenue Department, the Social Security Office, the Immigration Bureau, the Board of Investment, Royal Thai Embassies, the Department of Lands, the Department of Industrial Works and the Department of Employment.
Courts, tribunals and arbitral institutions.
Counterparties, opposing parties and their legal advisers, where this is necessary for the matter.
Foreign law firms, notaries, translators, expert witnesses and other professional advisers engaged in a client’s matter.
Banks and financial institutions, for payments and client due diligence.
Our affiliated office and companies, including Silk Legal’s office in Dubai, United Arab Emirates. We share Personal Data with our affiliates to coordinate cross-border matters, refer clients, and support shared administration and IT systems. Our affiliates must protect Personal Data to the standard set out in this policy.
Any other third party, where the Data Subject requests or consents to the disclosure.

6.2 Third-Party Data Processors

Cloud storage, email and IT service providers.
Practice management, document management and accounting software providers.
Outsourced payroll and human resources service providers.
Outsourced marketing, website and email newsletter service providers.
Outsourced auditors and accountants.
Recruitment agencies.
Courier, document storage and secure shredding service providers.
Building management and security service providers.

We enter into written agreements with our Data Processors. These agreements require them to process Personal Data only on our instructions, to keep it confidential and secure, and to notify us of any data breach.

6.3 International Transfers

Some of the parties listed above are located outside Thailand, including our affiliated office in the United Arab Emirates and some cloud service providers. When we transfer Personal Data outside Thailand, we comply with Sections 28 and 29 of the PDPA and the related PDPC notifications. This means we will do at least one of the following:

transfer the data to a country with adequate data protection standards;
put in place appropriate safeguards, such as binding corporate rules or standard contractual clauses;
rely on an exception under the PDPA, such as where the transfer is necessary to perform a contract with the Data Subject; or
obtain the Data Subject’s consent after informing them of the data protection standards in the destination country.

7. Data Security Measures

We use administrative, technical and physical measures to protect Personal Data against loss, unauthorised access, use, alteration and disclosure. These measures meet at least the minimum standards set by the PDPC. They include:

Access control: staff can only access the Personal Data they need for their role. Access rights are reviewed regularly and removed promptly when a person leaves the firm.
Authentication: our systems are protected by passwords and multi-factor authentication.
Encryption: we use encryption for data transmitted over the internet and for devices and storage where appropriate.
Network security: we use firewalls, anti-malware software and regular security updates.
Physical security: our office has controlled entry, and hard-copy files are kept in locked cabinets or secure storage rooms.
Confidentiality: all staff are bound by confidentiality obligations and professional duties of confidentiality to clients.
Training: staff receive data protection and information security training.
Backup: we back up electronic data regularly so that it can be restored after an incident.
Supplier management: we assess the security of our Data Processors before engaging them.

7.1 Personal Data Breaches

If a Personal Data breach occurs, we will act promptly to contain it and assess the risk. Where the breach is likely to result in a risk to the rights and freedoms of individuals, we will notify the PDPC within 72 hours of becoming aware of it. Where the risk is high, we will also notify the affected Data Subjects and tell them what steps we are taking.

8. Data Retention

8.1 How We Store Personal Data

Electronic (soft) copies: we store electronic records on secure cloud-based systems and firm-managed devices, protected by the measures described in section 7.
Physical (hard) copies: we store paper documents in locked cabinets at our office or with a secure document storage provider. Original documents belonging to clients are returned to them at the end of a matter where appropriate.

8.2 Retention Periods

We keep Personal Data only for as long as necessary for the purposes for which it was collected, or as required by law. Our standard retention periods are set out below.

Type of record	Retention period	Reason
Client matter files and engagement records	10 years after the matter is closed	General limitation period under the Civil and Commercial Code
Accounting, billing and tax records	At least 5 years from the end of the relevant accounting period, or longer if required by the authorities	Accounting Act B.E. 2543 and the Revenue Code
Employee records	During employment and for 10 years after employment ends	Labour law requirements and potential legal claims
Unsuccessful job applications	1 year after the recruitment process ends, unless the applicant agrees to a longer period	To consider the applicant for future vacancies
Inquiries that do not lead to an engagement	2 years from the last contact	Conflict checks and follow-up
Marketing and newsletter lists	Until the Data Subject unsubscribes or withdraws consent	Consent
CCTV footage	30 days, unless needed for an investigation or legal claim	Security of premises
Website cookie data	As set out in section 11	Consent or legitimate interest

We may keep Personal Data for longer where it is needed to establish, exercise or defend legal claims, or where the law requires it.

8.3 Disposal

At the end of the retention period, we will delete, destroy or anonymise the Personal Data. Electronic records are permanently deleted from our systems, including backups, in line with our backup cycle. Paper records are shredded on site or destroyed by a secure shredding provider that issues a certificate of destruction.

9. Rights of Data Subjects

While we hold your Personal Data, you have the following rights under the PDPA:

Right to withdraw consent. Where we process your Personal Data based on consent, you may withdraw that consent at any time. Withdrawal does not affect processing carried out before the withdrawal, or processing we carry out under another legal basis, such as the engagement contract.
Right of access. You may request a copy of your Personal Data. You may also ask how we obtained it if it was not collected directly from you.
Right to data portability. Where it is technically feasible, you may request to receive your Personal Data in a commonly used electronic format, or ask us to transfer it to another Data Controller.
Right to object. You may object to the processing of your Personal Data where we rely on legitimate interests or public task, or where we use it for direct marketing. We will stop processing unless we can show compelling legitimate grounds, or the processing is needed to establish, exercise or defend legal claims.
Right to erasure. You may ask us to delete, destroy or anonymise your Personal Data where:
- it is no longer necessary for the purposes for which it was collected;
- you withdraw your consent and we have no other legal basis for the processing;
- you object to the processing and we have no overriding grounds to continue; or
- the processing is unlawful.
Right to restrict processing. You may ask us to restrict the use of your Personal Data where:
- we are checking the accuracy of the data at your request;
- the processing is unlawful but you prefer restriction to erasure;
- we no longer need the data, but you need it to establish, exercise or defend legal claims; or
- we are considering your objection to the processing.
Right to rectification. You may ask us to correct your Personal Data so that it is accurate, up to date and complete.
Right to lodge a complaint. If you believe we have not complied with the PDPA, you may file a complaint with the Office of the Personal Data Protection Committee.

9.1 How to Exercise Your Rights

You may exercise your rights free of charge by contacting us using the details in section 12. We may need to verify your identity before we act on your request. We will respond within 30 days of receiving your request.

In some cases, we may refuse or limit a request where the law allows it. This includes where fulfilling the request would breach a legal obligation, a court order, or our duty of confidentiality to other clients. If we refuse a request, we will tell you why.

10. Marketing and Promotion

We may use Personal Data of clients and other contacts to send updates about the firm, legal developments in Thailand, new services, events and other promotional materials. This includes a monthly email newsletter, which uses the recipient’s name, company, location and contact details.

We will obtain consent before sending marketing communications where the PDPA requires it. You can opt out of these communications at any time.

10.1 Choices and Opt-Outs

You can unsubscribe from our marketing emails at any time by clicking the “unsubscribe” link at the bottom of any marketing email. You can also opt out by contacting us using the details in section 12.

11. Cookies

11.1 What Are Cookies?

Cookies are small text files that a website stores on your device or browser when you visit it. Cookies tell us how visitors use our website, such as the number of visitors, the pages they view and the time they spend on the site.

We use strictly necessary cookies to make our website work. We only use analytics and advertising cookies if you accept them through our cookie banner. You can change your choice at any time.

11.2 How to Manage Cookies

You can accept or reject non-essential cookies through the cookie banner on our website. You can also change your browser settings to block or delete cookies. If you block all cookies, some parts of our website may not work properly.

Browser-specific cookie settings:

11.3 Cookies Used on Our Website

Cookie name	Provider	Purpose	Type	Expiry
PHPSESSID	Silk Legal	Keeps the user’s session active, for example to display a message after the contact form is submitted	Strictly necessary	When the browser is closed
_ga	Google Analytics	Distinguishes unique visitors	Analytics	2 years
_ga_<container ID>	Google Analytics	Maintains session state and tracks how the user found and used the site	Analytics	2 years

Google Analytics helps us understand how visitors use our website. It shows us which pages have technical problems, which content needs updating, and which countries our visitors come from. We have configured Google Analytics so that it does not share identifying information with us.

11.4 Retargeting

With your consent, we may use retargeting (also called remarketing) for some of our advertisements. This allows us to show advertisements on platforms such as Google, Facebook, LinkedIn and X (formerly Twitter) to people who have previously visited our website. These platforms do not share the identity of our website visitors with us. If you interact with one of our advertisements, for example by commenting on it, your public profile on that platform will be visible to us.

11.5 Third-Party Sites

Our website may contain links to third-party websites. We are not responsible for the cookies or privacy practices of those websites.

11.6 Updates to Our Cookie Settings

We review our use of cookies regularly and update this section when we add or remove cookies. If we introduce new non-essential cookies, we will ask for your consent again.

12. Contact Details

If you have any questions about this policy, or wish to exercise any of your rights under the PDPA, please contact our data protection team:

Name: Silk Legal Co., Ltd.

Address: 571 RSU Tower, 8th Floor, Suite 805, Sukhumvit Road,

Khlong Tan Nuea Sub-district, Watthana District, Bangkok 10110, Thailand

Email: [email protected] (please use the subject line “PDPA Request”)

Telephone: +66 (0) 2 107 2007

Website: www.silklegal.com

Facebook: facebook.com/silklegalthailand

LinkedIn: linkedin.com/company/silk-legal

13. Changes to This Policy

We review this policy at least once a year, and whenever there is a significant change in the law or in how we process Personal Data. When we make a material change, we will publish the updated policy on our website and notify affected Data Subjects where appropriate.

This policy was last reviewed and updated in September 2026.

[1]Section 6 of the Personal Data Protection Act B.E. 2562 (2019).

[2]Section 26 of the Personal Data Protection Act B.E. 2562 (2019).

[3]Section 6 of the Personal Data Protection Act B.E. 2562 (2019).

[4]Section 6 of the Personal Data Protection Act B.E. 2562 (2019).

Silk Legal - Thailand's Law Firm for Business

Data Protection Policy