Compliance & Document Control Manager – ISO / PDPA (HealthTech)

About the role

Invitrace is a Thai HealthTech company whose digital health platforms are used by leading hospital groups in Thailand and the UK. We hold ISO/IEC 27001:2022 and ISO 9001 certifications, and we handle sensitive health data under Thailand's PDPA and UK GDPR. As Compliance & Document Control Manager, you become the owner of our ISO management systems and our personal data protection program — keeping certifications valid, running audits, controlling every policy and record, and making sure compliance is part of how teams actually work, not a paper exercise before the auditor arrives.

Key responsibilities

• Own the company's ISMS and QMS end to end: scope, policies, procedures, Statement of Applicability, risk register and objectives
• Plan and run the annual compliance calendar: internal audits, management reviews, risk assessments and control reviews
• Lead surveillance and recertification audits with the certification body — preparation, audit-day coordination and closure of every finding
• Manage non-conformities and corrective actions to closure, with evidence
• Prepare the company for scope changes, such as adding new sites or services to the certificates
• Own the document control system: numbering, versioning, approval, distribution, review cycles and retirement of every controlled document and form
• Keep a single, current master list of policies, procedures, forms and records — nothing outdated in use, nothing missing on audit day
• Make sure required records (access reviews, training, incidents, supplier assessments) are actually produced, not only templated
• Own the PDPA program: record of processing activities, privacy notices, consent, data subject requests, data processing agreements and breach response
• Act as, or directly support, the Data Protection Officer function, including UK GDPR obligations for our UK operation

About you

• Bachelor's degree in any field; Information Management, IT, Law, Business or a related field is a plus
• 5+ years in ISO management systems, compliance, document control or internal audit — including hands-on ownership of at least one certification cycle
• Solid knowledge of ISO/IEC 27001:2022; ISO 9001 experience is a strong plus
• Working knowledge of Thailand's PDPA; UK/EU GDPR experience is a plus
• ISO 27001 Lead Auditor / Lead Implementer, ISO 9001 Internal Auditor or data protection certification (e.g. PDPA, CIPP/E) is a plus
• Experience in technology, SaaS or healthcare organisations is preferred
• Organised and persistent: you chase evidence until it exists and keep deadlines without being reminded
• Able to explain requirements in plain language to engineers and executives alike
• Good written and spoken Thai and English — documents and audits are in both languages

About us

Invitrace is a Thai HealthTech company whose digital health platforms are used by leading hospital groups in Thailand and the UK. We hold ISO/IEC 27001:2022 and ISO 9001 certifications, and we handle sensitive health data under Thailand's PDPA and UK GDPR.