An AI system is a new way of processing personal data, and Thailand's Personal Data Protection Act B.E. 2562 (PDPA) applies to it as it applies to any other. There is no product category called PDPA compliant AI. There are AI systems built and operated in a way that meets the Act, and systems that are not. For AI compliance in Thailand, most of the work is familiar data protection work, applied to systems that read more, infer more and keep more than the software they replace.
What follows is a general checklist of what to settle before a deployment. The obligations that apply to you depend on your organisation, your data and your use case.
Who the Act applies to
The PDPA applies to organisations in Thailand that collect, use or disclose personal data. It also applies to many organisations outside Thailand that offer goods or services to people in Thailand or monitor their behaviour there.
In most AI projects, your organisation is the data controller: it decides why and how personal data is processed. The vendor that builds or runs the system is usually a data processor, acting on your instructions. That split shapes every other answer.
A lawful basis for each purpose
Every purpose for which personal data is processed needs a lawful basis. The Act provides several, including consent, performance of a contract, compliance with a legal obligation, legitimate interests, protection of a person's vital interests, and tasks carried out in the public interest.
AI deployments tend to add purposes nobody listed before: summarising customer messages, transcribing and classifying calls, scoring suppliers, reading identity documents, or training and evaluating a model on historical records. List each purpose separately and record the basis for it. Reusing data collected for one purpose to train a model for another is an easy gap to miss.
Consent where it is needed
Consent is one basis, not the default. Where you rely on it, ask for it before collection, make it specific to the purpose, keep it clear and separate from other terms, and make it as easy to withdraw as it was to give.
The Act treats some personal data as sensitive, including health, biometric, genetic and criminal records data among other categories. Processing it generally requires explicit consent unless a specific exception applies. Face matching at a check-in kiosk, voice analysis and anything that touches patient records fall into this group. Store each consent with the record it covers, so the system can show which consent applied to which processing.
Data subject rights the system must support
People have the right to be informed, to access and obtain a copy of their data, to data portability, to object, to erasure, to restriction of processing and to rectification. Access requests generally have to be acted on within 30 days.
Design for these rights inside the AI system rather than around it. Can you find every place a person's data was used, including prompts, conversation logs, search indexes, evaluation sets and any training data? Can you correct or delete it without breaking the system? Does your privacy notice describe the AI purposes in plain language?
Cross-border transfer
Many AI services process data outside Thailand. Under the PDPA, personal data may be transferred abroad where the destination has adequate data protection standards, or under the exceptions and safeguards that the Act and the Personal Data Protection Committee's notifications set out. These include, for example, consent given after the person is informed of the destination's standards, transfers necessary to perform a contract, and appropriate safeguards such as binding corporate rules or standard contractual terms.
Know every location your data reaches: the model, the storage, the backups, the logs and each subprocessor. If the answer depends on a vendor setting, get the setting and the location in writing.
Retention and deletion
Personal data should be kept only as long as its purpose requires. AI systems quietly create new copies: transcripts, conversation logs, cached documents, derived indexes and test sets. Give each a retention period, and let the system delete on schedule. Deletion you can demonstrate is worth more than a policy that says it happens.
Security, breach notification and records
The Act requires appropriate security measures. A personal data breach must be reported to the Office of the Personal Data Protection Committee within 72 hours of becoming aware of it where feasible, unless it is unlikely to create a risk to people's rights and freedoms, and individuals must be told when the risk is high.
For an AI system, that means access by role, every access logged against a named user or agent, and sensitive values masked from anything that does not need them. Controllers also keep a record of processing activities, and organisations whose core activities involve large-scale monitoring or sensitive data must appoint a data protection officer.
A DPIA-style risk assessment
The PDPA does not set out a standalone data protection impact assessment in the same terms as Europe's GDPR. Assessing risk before deploying a system that handles sensitive data or monitors people at scale is still good practice, and it supports the Act's security and accountability duties.
A useful assessment covers the purposes and lawful bases, the data flows, the risks to individuals (a wrong decision, exposure, use beyond the original purpose), the controls, who reviews the system's outcomes and the risk that remains. Keep it and update it whenever the system changes.
Vendor contracts
The contract with an AI vendor should cover the processing instructions; where data is processed and stored; the subprocessors and how changes are notified; whether your data may be used to train or improve the vendor's own models; security measures; breach notification timelines; retention, return and deletion at the end of the contract; and your right to audit, including access to logs.
Where to start
Start with a map of where personal data enters, where it is stored, who can reach it and where it goes. Opsian's PDPA Compliance service does that mapping, then builds consent, retention, request handling and access logging into the systems themselves and supports the data protection officer. It does not replace your legal advisers, who interpret the Act.
The same principles are built into ENTRIX, which records consent before any document or face is captured and applies retention periods per property; the ENTRIX case study describes it in production. Every engagement starts with an audit; the anonymised healthcare and professional and financial services sample audits show how health-data and identity-check obligations are examined.
Sources
Questions
- Is there such a thing as PDPA compliant AI?
- Not as a product label. The PDPA applies to the processing, so an AI system is compliant when the way it is built and operated meets the Act's requirements for lawful basis, consent where needed, data subject rights, retention, security and cross-border transfer. A vendor's claim does not transfer that responsibility away from the data controller.
- Do we need consent to use customer data with AI in Thailand?
- Not always. Consent is one of several lawful bases, alongside contract, legal obligation and legitimate interests among others. Sensitive data such as health or biometric data generally requires explicit consent unless a specific exception applies. Using data collected for one purpose to train or run AI for a different purpose needs its own basis.
- Can we use an AI service hosted outside Thailand under the PDPA?
- It is possible, but the Act's cross-border transfer rules apply. The destination needs adequate data protection standards, or the transfer must rely on one of the exceptions or safeguards the Act and the Personal Data Protection Committee's notifications provide. Know every location your data reaches, including logs and backups.
- What are the penalties for breaching the PDPA?
- The Act provides for administrative fines of up to five million baht, civil liability for damages, which a court may increase, and criminal penalties for certain offences. The Personal Data Protection Committee has been issuing administrative fines.
- Who is responsible when an AI vendor processes our data?
- Usually your organisation is the data controller and the vendor is a data processor acting on your instructions. The controller remains accountable, which is why the contract with the vendor needs to set out instructions, security, locations, subprocessors, breach notice and deletion.
