If you ask where the problem started
The starting point was not dramatic at all. One day, this department-level government agency received a formal inquiry from a regulatory authority asking about its PDPA practices for the citizen data under its care. The team began gathering information to respond and discovered that they could not. Not because they did not want to answer, but because they did not even know where citizens' data was being stored.
The agency consisted of multiple departments, divisions, and offices. Each unit had its own information systems, developed at different times and using different data standards. A single citizen's data could exist across ten separate systems that had never communicated with one another.
And what about consent? How complex was it?
This is precisely where the public sector differs significantly from the private sector. In some cases, the agency had a lawful basis to process data without consent, such as legal compliance or the performance of a public task. In other cases, explicit consent was required. Determining which legal basis applied to which activity required specialized expertise that most personnel did not yet have.
Many officials still did not understand PDPA deeply enough to apply it in day-to-day operations. Traditional training could teach broad principles, but when faced with case-specific questions such as, "Do we need consent to collect a copy of a national ID card for this purpose?" the answers were often unclear.
And what if a data breach occurred? There was no clear procedure defining what had to be done first, who needed to notify whom, and within what timeframe.
What they decided to do
The agency chose to deploy PrivacyHub together with the Genesis AI Platform. This was not simply about using a standard compliance tool. It was about applying AI to make privacy operations genuinely smarter.
PrivacyHub became the foundation, with all six modules fully implemented: Consent Management to manage consent across every channel while classifying lawful bases; DSR to receive and process citizen requests; Data Inventory to create a data map using Pointer-Based Mapping with Zero PII Storage; RoPA to automatically generate records of processing activities; Breach Management to establish a structured incident response process; and Vendor Management to manage external Data Processors.
