PDPA and AI in Thailand: a practical checklist

Key takeaways

• The PDPA applies when an AI system handles personal data, including LINE chats, order records and CVs.
• Know what data the system sees, why, where it goes and how long it stays.
• Sensitive data, such as health information, needs particular care and usually explicit consent.
• Your vendor is a processor: contracts, access limits, logs and a breach process are part of the answer.

Thailand's Personal Data Protection Act B.E. 2562 (2019), usually called the PDPA, came fully into force in June 2022. It governs how personal data is collected, used, disclosed and transferred, and it is overseen by the Personal Data Protection Committee. Any time an AI system reads a customer message on LINE, an order record, an invoice with a name on it or a CV, it is handling personal data. This checklist walks through the questions that follow.

1. Map what the AI will see

Before choosing a tool, list the data it would touch. Typical examples are chat messages, names and phone numbers, delivery addresses, order history, payment references, ID documents, employee records and CVs. Note which items are personal data and which are sensitive. Many problems begin with a system that can read far more than its task requires.

• Which systems will the AI read from, and which will it write to?
• Which fields does it actually need? Remove or mask the rest.
• Does the data include children's data or anything about health, religion, biometrics or similar categories?

2. Decide your lawful basis and your purpose

The PDPA requires a lawful basis for collecting and using personal data, such as consent, performance of a contract, a legal obligation or legitimate interests. For routine customer service, the basis is often the contract or the customer's own request, but this depends on the facts. Whatever the basis, the purpose should be specific, and the data should not be reused for unrelated purposes without a fresh basis.

• Write down the purpose of the AI feature in one sentence.
• Confirm that the lawful basis covers using the data this way.
• Do not reuse customer data to train models unless you have a clear basis and have told people.

3. Handle sensitive data with extra care

The PDPA treats certain categories as sensitive, including health data and biometric data. These generally require explicit consent or another specific ground. If you run a clinic, a pharmacy or a wellness business, this affects what an AI system may read and store. Many organizations keep clinical questions out of the AI's scope and route them to staff. Our healthcare page describes that approach.

4. Tell people what is happening

• Update your privacy notice to say that AI is used, for what, and who processes the data.
• Make it clear in the conversation that the customer is talking to an AI system, and how to reach a person.
• Do not ask customers to send passwords, card numbers or other secrets in chat.

5. Treat your AI vendor as a processor

When a vendor processes personal data on your behalf, it is generally acting as a data processor and you remain the controller. That puts obligations on both sides and calls for a written agreement. Questions to ask:

• Is there a data processing agreement that limits use to your instructions?
• Is customer data used to train models? The answer should be no, in writing.
• Which sub-processors, such as model providers and hosting, handle the data, and where?
• How is access scoped and logged? Can you see who or what accessed which record?
• Is data masked before it reaches a model provider?
• How are staff access, confidentiality and security incidents handled?

Our own approach is described on the security page: least-privilege access, workspace isolation, human approval for sensitive actions, audit trails and no training on customer data.

6. Check cross-border transfers

Many AI services process data outside Thailand. The PDPA places conditions on sending personal data abroad, generally requiring that the destination has adequate protection or that another permitted mechanism applies. Ask your vendor where each step runs, and record the answer. If a model provider is in another country, that is a transfer to account for.

7. Set retention and deletion

• How long are conversations and documents kept, and why?
• Can the vendor delete a customer's data on request, including from logs?
• What happens to your data when the contract ends?

8. Prepare for people's rights

People have rights over their personal data, including access, correction, objection, erasure and portability, in the circumstances the law describes. Your systems should let you find the data you hold about a person, including what an AI system recorded, and act on a request in good time.

9. Plan for incidents

The PDPA expects organizations to have security measures and to notify the regulator of certain breaches promptly, generally within 72 hours of becoming aware, and to tell affected people where there is a high risk. Agree with your vendor how an incident is detected, who tells whom and how quickly.

10. Keep a person in the loop where it matters

Decisions with significant consequences for individuals, such as hiring, credit or health, should not be left to an automated system alone. We keep people deciding in these areas by design: see autonomy is a dial, not a switch and our recruitment screening page.

A short vendor checklist

• A written processing agreement and a clear list of sub-processors.
• No training on your customers' data.
• Masking and least-privilege access.
• A complete, searchable audit trail.
• Clear answers on where data is processed and stored.
• A defined incident process and deletion on request.
• A way to switch AI features off, for the workspace or for individuals.

Where to go from here

If you are planning AI for customer messages or documents, start by mapping the data, then choose a vendor that can answer the questions above plainly. For how we design for Thailand, read designing AI for Thailand and our page on AI automation in Thailand, or speak with Primues.

Sources

• Personal Data Protection Committee, Thailand