ISO Certification in Thailand: Accredited Audits for Auto Parts, Electronics, Food, and Service Firms
ISO certification in Thailand keeps Eastern Seaboard suppliers on carmaker and electronics vendor lists, helps food exporters pass retailer checks, and gives banks and hotels audited controls. Accredify Global audits Thai organizations against ISO 9001, ISO 14001, ISO 45001, ISO 27001, and the other standards in our scope. Each engagement opens with a free scoping review.
What ISO Certification in Thailand Proves to Customers
ISO certification in Thailand means an accredited certification body has checked your management system against a published standard and found it working. The audit team reads your records, talks to staff on each shift, and walks the production line, kitchen, or server room. A conforming system receives a certificate valid for three years. A surveillance audit every year keeps it live.
The Eastern Economic Corridor drives a large share of requests. Chachoengsao, Chonburi, and Rayong host car assembly plants, parts makers, and petrochemical complexes around Laem Chabang port and Map Ta Phut. Japanese, European, and Chinese buyers there treat ISO 9001 as the entry ticket and ask for ISO 14001 and ISO 45001 soon after.
Electronics follows close behind. Industrial estates in Ayutthaya and Pathum Thani assemble hard disk drives, circuit boards, and components for global brands. Their customers audit suppliers often, and an accredited certificate shortens each visit.
Food is the third pillar. Seafood processors in Samut Sakhon, rice mills in the central plains, and fruit packers ship to Japan, Europe, and the Middle East. Importers want food safety systems they can verify, so ISO 22000 sits beside the buyer schemes they already use.
Services complete the picture. Hotels in Phuket, Pattaya, and Chiang Mai, private hospitals in Bangkok, and banks and payment firms all answer to international partners. Those partners increasingly ask for ISO 27001 and evidence of PDPA compliance before they sign.
Accredify Global is accredited by UAF, and our scope is published in its directory. If a buyer, tender, or regulator names a specific accreditation body, send us the wording before you book and we will confirm the fit.
Thai Rules in 2026 That Shape Certification Requests
The PDPA is now actively enforced. Thailand's Personal Data Protection Act became law on 28 May 2019 and came into full force on 1 June 2022. Controllers must tell the Personal Data Protection Committee about a breach within 72 hours where feasible. Administrative fines reach THB 5 million, and courts may award punitive damages up to twice the actual loss. In August 2025 the PDPC announced eight fines worth THB 14.5 million, citing weak security, missing DPOs, and late breach reports.
Critical infrastructure has yearly cyber duties. Under the Cybersecurity Act B.E. 2562 (2019), critical information infrastructure organizations report to the National Cyber Security Agency. A notification in force since 20 June 2024 requires a risk assessment and a cybersecurity audit at least once a year. Incidents must be reported to NCSA and the sector regulator within 24 hours.
Annual reports have a fixed date. CII organizations file their assessment and audit reports within 30 days of completion and no later than 31 January of the following year. The first reports were due by 31 January 2025. Suppliers to banks, telecoms, energy, and hospitals now see these duties in their contracts.
Sources: Thailand breach notification (DLA Piper) · PDPC fines, August 2025 (Nagashima Ohno & Tsunematsu) · CII cybersecurity duties (Tilleke & Gibbins)
Standards Thai Buyers Request Most
Vendor portals and tender forms differ, but these pairings appear again and again.
| Sector | What the buyer worries about | Usual standards |
|---|---|---|
| Auto parts makers in Chonburi and Rayong | Process control and carmaker supplier audits | ISO 9001, ISO 14001, and ISO 45001 |
| Electronics and HDD plants in Ayutthaya | Yield, traceability, and chemical handling | ISO 9001 and ISO 14001 |
| Seafood, rice, and fruit exporters | Food safety for importers and retailers | ISO 22000 and HACCP |
| Petrochemical and energy sites at Map Ta Phut | Process safety and energy cost | ISO 45001 and ISO 50001 |
| Hotels and resorts in Phuket, Pattaya, and Bangkok | Guest service, energy, and staff safety | ISO 9001, ISO 14001, and ISO 50001 |
| Banks, insurers, and payment firms | Cyber risk and continuity | ISO 27001 and ISO 22301 |
| Data centres, cloud, and software firms | Client security clauses and service levels | ISO 27001, ISO 27701, and ISO 20000-1 |
Automotive customer schemes such as IATF 16949 and Thai industrial product standards (TIS marks) are separate programs. ISO 9001 supports them but does not replace them.
Suppliers on the Eastern Seaboard usually feel the pressure through the purchasing team. A carmaker or tier-1 buyer sends a supplier questionnaire, then visits the plant and raises findings with a close-out date. A certified quality, environment, and safety system answers most of that questionnaire before the visit. It also gives the plant manager one set of procedures for Thai operators, expatriate engineers, and agency staff on the night shift. Hotel groups take a different route, often starting with ISO 14001 and ISO 50001 because energy, water, and waste costs show up in every guest review and owner report.
How ISO Supports Thai Requirements
A certificate does not replace a licence or a factory permit. It is the system that keeps controls working between buyer, insurer, and regulator reviews.
| Rule or system | Who it reaches | How ISO supports it |
|---|---|---|
| Personal Data Protection Act B.E. 2562 (2019) | Any business handling personal data in Thailand | ISO 27701 runs privacy duties; ISO 27001 secures the data |
| Cybersecurity Act B.E. 2562 (2019) | CII organizations and their IT suppliers | ISO 27001 supplies the yearly risk assessment and audit cycle |
| Occupational Safety, Health and Environment Act B.E. 2554 (2011) | Employers, especially factories and construction | ISO 45001 structures hazard control and worker consultation |
| Public Procurement and Supplies Administration Act B.E. 2560 (2017) | Firms bidding through the e-GP system | Certificates strengthen the technical evaluation |
| Carmaker and electronics supplier codes | Tier-1 and tier-2 suppliers | ISO 9001, ISO 14001, and ISO 45001 cut repeat findings |
Some duties need testing rather than certification. Our VAPT services and cyber security risk assessment report against recognized frameworks, and the National Cyber Security Agency has also published website and cloud security standards under the Act. Payment firms can add PCI DSS readiness. Exporters serving European customers should read our GDPR and CE marking guides. Hospitals and clinics serving foreign patients face the same privacy questions, because health data is sensitive data under the PDPA.
Planning a Certification Audit in Thailand
Local details that keep a Thai audit on its dates.
Have ready before Stage 1
- DBD company registration and 13-digit tax ID for each entity
- Factory licences and sites by province or industrial estate
- The buyer, tender, or regulator clause
- Subcontracted and agency workers in scope
Scheduling notes
- Offices work Monday to Friday; many plants run Saturday shifts
- Songkran in mid-April closes most sites for several days
- The rainy season can slow travel to upcountry sites
- Tell us early if records are in Thai so interpreters are planned
How ISO Certification in Thailand Works With Us
Six steps from the first call to a certificate your customer can check. Our certification process guide explains every stage.
Has a carmaker, importer, or tender set a deadline? Tell us the date and we will schedule the audit to meet it.
Book a free scoping reviewWhat ISO Certification Costs in Thailand
The fee comes from audit man-days, listed per site and standard in your proposal before anything is signed. Sites that share one system are sampled rather than all visited every year.
What adds days
- Plants in several provinces or estates
- Large shift workforces
- Chemical, press, or hot work processes
- Each standard audited on its own
What saves days
- One integrated system for quality, environment, and safety
- The same procedures used at every plant
- Records complete before Stage 1
- Internal audit and management review done
What Thai Organizations Ask Us First
Short answers for quality, EHS, IT security, and purchasing teams.
| Question | Our answer |
|---|---|
| Who accredits Accredify Global? | UAF, for twelve standards listed in its directory. |
| Can one certificate cover plants in two estates? | Yes, as a multi-site certificate. |
| How do customers check it? | On our verification page. |
| Do you write our manuals? | No. We audit only, to stay impartial. |
| How is the fee calculated? | From audit man-days, set out in writing. |
FAQ: ISO Certification in Thailand
Answers on the PDPA, the Cybersecurity Act, Eastern Seaboard suppliers, cost, and timing.
How do I get ISO certification in Thailand?
Pick the standard your customer or tender names, run the system long enough to produce records, and book the audit. An accredited body completes Stage 1 and Stage 2. If you conform, it issues a three-year certificate.
How long does ISO certification take in Thailand?
A business with a working system usually certifies 6 to 12 weeks after Stage 1. Extra plants, extra standards, or a brand-new system take longer.
How much does ISO certification cost in Thailand?
There is no list price. The fee follows the audit man-days your scope needs, which depend on headcount, sites, risk, and standards.
Is Accredify Global accredited?
Yes. UAF accredits Accredify Global for twelve standards, including ISO 9001, ISO 14001, ISO 45001, ISO 22000, and ISO 27001.
Will Thai customers accept a UAF-accredited certificate?
Most accept certificates from bodies within the international recognition arrangement. If a customer names a particular accreditation body, show us the clause before booking.
A tender mentions TISI. What should we do?
TISI is Thailand's national standards body and runs the TIS product marks. Send us the tender wording and we will confirm whether a management system certificate meets it.
How fast must a data breach be reported under the PDPA?
Controllers notify the PDPC within 72 hours of becoming aware, where feasible. High-risk breaches must also be reported to the people affected.
What are the PDPA penalties?
Administrative fines reach THB 5 million. Criminal penalties apply to some offenses, and courts may award punitive damages up to twice the actual loss.
Does ISO 27701 help with the Thai PDPA?
Yes. It adds privacy roles, records of processing, consent and rights handling, and breach response to an ISO 27001 system.
What does the Cybersecurity Act require of CII organizations?
A risk assessment and a cybersecurity audit at least once a year, reports to NCSA by 31 January, and incident reports within 24 hours.
Is ISO 9001 enough for an Eastern Seaboard auto supplier?
It is the usual starting point. Many carmakers also expect IATF 16949, which is a separate automotive scheme, plus ISO 14001 and ISO 45001.
Can you audit plants in Amata City and Ayutthaya under one certificate?
Yes, if both run one management system under the same organization. Each site is listed on the certificate, and audits sample them over the cycle.
Can audits avoid Songkran?
Yes. We plan dates around mid-April and other long holidays, so key staff are on site.
Can parts of the audit be remote?
Document review and some interviews can be remote where the rules allow. Production lines, kitchens, and warehouses are audited in person.
Will Accredify Global write our documents?
No. A certification body must stay impartial, so we audit and certify only. Your team or an independent consultant builds the system.
Put an Audited Thai Operation on Your Buyer's Vendor List
Tell us your entities, sites, and the customer or tender requirement. We will confirm the right ISO certification in Thailand and send a tailored proposal.
Book your free scoping review →Last reviewed by the Accredify Global certification team.