Data and AI law, read from the actual text
Data and AI law, read from the actual text, is AIPDPA's series of 68 articles on situations Thai organisations really face. Each reads the PDPA, PDPC notifications, TDPG 4.0 and related laws together, for DPOs, legal and HR teams, with the legal text quoted word for word.
AI at workFace-scan cameras at work: how strong a reason do you need?
Thailand's NCSA guideline on AI-enabled CCTV says in so many words that a security camera does not automatically justify facial recognition. Once a face becomes a template, the PDPA treats it as sensitive data under Section 26.
Latest · page 1 of 6
CybersecurityViewing CCTV on your phone: fix factory passwords and P2P first
A camera you can watch from outside the building is a camera with a way in from outside. The NCSA 2026 guideline says to close the factory-password gap, govern P2P and segment the network. This article compares realistic options for homes and shops.
PDPA in practiceCCTV already installed? Secure it in seven steps this week
NCSA's guideline gives seven starter steps for owners who have cameras but have not secured them. Here they become a day-by-day plan: who does what, a rough time estimate, and which parts are advice and which are PDPA duties.
Data breachesCCTV Footage Leaked? What to Do in the First 72 Hours
When footage leaks or a camera system is broken into, the 72-hour clock runs from the moment you become aware, not from the moment it happened. The order of work, and which parts are law and which are only NCSA recommendations.
CybersecurityWho can open CCTV footage, and who opened it when?
The NCSA's 2026 guideline asks you to answer who can reach what, what they can do and what proof exists. This article also explains why the Computer Crime Act does not tell every CCTV system to keep logs.
CybersecurityRepair, compensate or replace an old CCTV system?
The NCSA's 2026 guideline says age alone should not decide it, and that images and credentials left on a recorder must be dealt with before it goes in the bin.
PDPA in practiceCCTV Signs, Privacy Notices and Footage Requests
The sign at the door says who is recording and why. A request to see footage needs a process, not just a sign. This article walks through both, following the NCSA guideline and PDPA.
PDPA in practiceHow Many Days of CCTV Footage to Keep, and How Much Disk It Takes
The NCSA guideline gives no fixed retention figure, but it does give a storage formula. This article joins the two so you can decide before you buy a recorder.
CybersecurityIs your CCTV system level B, E or H? How to rate it
The NCSA guideline has the system owner rate impact on four dimensions, not look at shop size or site type. Hypothetical examples for a coffee shop, a factory and a condominium, with a warning that the level is not a CII classification.
CybersecurityTwo NCSA CCTV guidelines: which one to read first
One runs to 163 pages, the other to 112, and neither is binding. Still, installers, buyers and auditors may start using them as benchmarks. Here is where a shop owner, an executive, an administrator or an AI user should open each one.
CybersecurityBuying CCTV for an organisation: contract and acceptance
Chapter 4 of the 2026 NCSA guideline is not binding, but it tells buyers to write testable requirements, ask for matching evidence and accept the system before going live. Here is the list, ready to use.
AI at workEIA or DPIA: Which Comes First, and Can They Share One Form?
ETDA's draft EIA Playbook asks whether an AI system should exist at all and who it affects. A DPIA under the PDPC's AI guideline asks how the use of personal data threatens people's rights. Here is when to use which, and a combined worksheet that does both in one pass.
AI at workWhat the Board Should Ask Before Approving an AI Project
Two Thai guidelines, one from ETDA and one from the PDPC, speak directly to executives: what to ask, which documents to demand, and which decisions should not be left to the machine. Here they are, turned into a one-page board checklist.
Topic index
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)