EIA or DPIA: which comes first is the first question on a high-risk AI project. A DPIA assesses risk to data subjects' rights and the PDPC's AI guideline expects one before launch, while ETDA's draft EIA Playbook is broader, covering UNESCO's ten ethical dimensions. DPOs and AI teams get a way to share one scoping exercise, using the DPIA as the EIA's privacy section.
- ETDA's EIA Playbook is still a draft and is not law. It adapts UNESCO's Ethical Impact Assessment tool for Thailand.
- The PDPC guideline expects a DPIA before high-risk AI starts, such as automated decisions, employment screening or employee appraisal.
- The EIA has three parts: scoping questions, principles-based assessment and impact mapping.
- The EIA's privacy chapter asks outright whether a DPIA has been done, so the two connect without duplicate work.
- Revisit the EIA when purpose, data, users or the model change; the PDPC advises carrying out DPIAs regularly.
A team that has just finished a DPIA for an AI system often hears the next question from management: do we also need an EIA? The short answer is that the two ask different questions but can draw on almost the same information. Put them in the right order and one round of work covers both.
This article compares two documents: the draft Ethical Impact Assessment (EIA) Playbook from the AI Governance Practice Center (AIGPC) at Thailand's Electronic Transactions Development Agency (ETDA), and the DPIA section of the PDPC's Guideline on Personal Data Protection in the Development and Use of AI, version 1.0. It then combines them into a worksheet you can use.
How does an EIA differ from a DPIA?
A DPIA focuses on risk to the rights of data subjects. An EIA looks more broadly at ethical impact, positive and negative, including fairness, sustainability and effects on society. Section 6.2 of the PDPC guideline defines the DPIA's role as follows. There is no official English text of the PDPC guideline, so the Thai is reproduced as published.
องค์กรควรประเมินผลกระทบด้านการคุ้มครองข้อมูลส่วนบุคคล (Data Protection Impact Assessment: DPIA) เพื่อให้องค์กรสามารถบริหารจัดการความเสี่ยงให้อยู่ในระดับที่ยอมรับได้ก่อนเริ่มการเก็บรวบรวม ใช้ หรือเปิดเผยข้อมูลส่วนบุคคลThe draft EIA Playbook describes itself as one tool within an AI governance system, linking ethical principles to real decisions.
Therefore, EIA serves as a mechanism linking AI ethical principles with practical decision-making
| DPIA (PDPC AI guideline) | EIA (draft ETDA Playbook) | |
|---|---|---|
| Issued by | The Personal Data Protection Committee, under Section 16(3) of the PDPA | ETDA's AIGPC working group, adapted from a UNESCO tool |
| Status | Guidance, version 1.0, no legal force | Draft, not yet final |
| Core question | Is the use of personal data necessary and proportionate, how great is the risk to rights, and how can it be reduced? | Should AI be used at all, who gains and who loses, and which ethical dimensions are affected? |
| Scope | Personal data across the AI lifecycle | UNESCO's ten dimensions, including fairness, sustainability, human oversight and transparency |
| When | Before high-risk projects start, and regularly thereafter | Ideally before deployment, then during use and whenever the context changes |
| Output | DPIA report with mitigation measures and recorded trade-offs | Positive and negative impacts, mitigation, owners and timelines |
On necessity and proportionality the two overlap. The PDPC guideline asks whether a less privacy-intrusive method exists; the draft EIA asks whether a non-AI alternative exists. The EIA goes further on some points, for instance whether the system could be used for social scoring or mass surveillance, and how it affects sustainability or employment.
When is a DPIA needed, and when is an EIA worth doing?
Screen for the DPIA first, because it is more closely tied to duties under the Personal Data Protection Act B.E. 2562 (2019). Section 6.2 of the PDPC guideline gives two sets of high-risk criteria. The first covers automated decisions with legal or significant effects on people, such as credit approval, employment screening and employee performance evaluation. The second reads:
นอกจากนี้ เกณฑ์ดังกล่าวควรครอบคลุมถึงกรณีเก็บรวบรวม ใช้ หรือเปิดเผยข้อมูลส่วนบุคคลอ่อนไหวตาม PDPA มาตรา 26 หรือข้อมูลส่วนบุคคลเกี่ยวกับผู้เยาว์เพื่อนำมาฝึกฝนโมเดล (Model Training) ในปริมาณมากหรือการใช้เทคโนโลยี AI เพื่อการเฝ้าระวังและติดตามพฤติกรรมของบุคคลในพื้นที่สาธารณะอย่างเป็นระบบ รวมถึงการใช้ Generative AI ที่อาจสร้างเนื้อหาที่บิดเบือนหรือส่งผลกระทบต่อชื่อเสียงและภาพลักษณ์ของบุคคลThe draft EIA sets no threshold for which projects must be assessed. It says the most recommended time is before deployment, during design, procurement and initial rollout, and that the assessment should be revisited when the context changes.
Organizations should consider reviewing or reassessing when there are changes that may affect the ethical impact of the AI Use Case, such as: • A change in the objective of the AI system • A change in the data source or format of data used • A change in the user group or those affected • An update to the Model or related technology • Changes in laws, regulations, or the social context
| If the AI project… | DPIA | EIA |
|---|---|---|
| Supports decisions with significant effects on people, such as credit, hiring or staff appraisal | Do it before starting (PDPC 6.2) | Do it; opportunity and fairness are at stake |
| Trains models on sensitive data or large volumes of children's data | Do it before starting (PDPC 6.2) | Do it |
| Systematically monitors people's behaviour in public spaces | Do it before starting (PDPC 6.2) | Do it, starting with whether AI should be used at all |
| Uses generative AI that could produce distorted content about individuals | Do it (PDPC 6.2) | Do it |
| Uses personal data but decides nothing for people, such as summarising internal documents | Screen first; may fall below the high-risk threshold | A short version covering scoping only is reasonable |
| Uses no personal data at all, such as stock forecasting | Not needed, if you can show no data identifies anyone | Optional, depending on risks such as employment or environmental effects |
Be careful with that last row. "No personal data" has to be demonstrable. Section 2.4 of the PDPC guideline says a model trained on personal data is not automatically anonymous, and Annex C, item 1.3 says vector embeddings can be personal data if they can be reversed or matched to identify someone.
How do you finish both assessments in one round?
Use the EIA as the frame and let the DPIA be the section that goes deep on personal data. The draft EIA invites this: in chapter 6, on privacy, one question asks whether a DPIA has been carried out.
Specify whether a privacy impact assessment, such as a Data Protection Impact Assessment (DPIA), has been conducted before deploying the system or when significant changes occur, including identifying risks to individuals' rights and freedoms and the measures used to mitigate those risks.
- Scope once. Use part 1 of the EIA: what the system is, who uses it, who is affected, who decides, and whether it is necessary and proportionate. The same material becomes the description of processing in the DPIA.
- Screen against the PDPC's high-risk criteria. If any applies, run a full DPIA next.
- Assess the seven EIA categories. For the privacy category, attach the DPIA rather than answering twice.
- Map impacts together. Carry the risks found in the DPIA into the EIA's impact mapping alongside other impacts.
- Agree measures, owners and deadlines, send them to whoever approves the project, and set a review date.
The benefit is that the DPO does not have to describe the system twice, and the people looking at ethics do not have to guess about personal data. A step-by-step DPIA method is in our DPIA guide.
One more item the PDPC guideline asks AI DPIAs to record explicitly is the trade-offs made in design.
องค์กรควรระบุ ประเมิน และบันทึกการตัดสินใจที่ต้องแลกเปลี่ยนระหว่างกัน (Trade-offs) ที่เกิดขึ้นในการออกแบบระบบ AI เช่น ระหว่างความแม่นยำเชิงสถิติ (Statistical Accuracy) กับหลักการใช้ข้อมูลเท่าที่จำเป็น หรือระหว่างความสามารถในการอธิบายผลลัพธ์กับประสิทธิภาพของโมเดล พร้อมเหตุผลประกอบไว้ในรายงาน DPIA และในกรณีที่เหมาะสม ควรรับฟังความคิดเห็นของกลุ่มบุคคลที่อาจได้รับผลกระทบหรือผู้แทนของกลุ่มดังกล่าวประกอบการประเมินด้วยWhat does a combined EIA and DPIA worksheet look like?
The author compiled this table from the questions in the draft EIA Playbook and the DPIA section of the PDPC guideline. It works as a document skeleton as it stands, and the right-hand column shows the source of each row.
| Part | Questions to answer | Evidence to attach | Source |
|---|---|---|---|
| A. Scope | What the AI system is and does, its lifecycle stage, who uses it, who is affected, and whether users can opt out | Plain-language description · data flow diagram | EIA 2.2.1 · PDPC 6.2 |
| B. Accountability | Who has final decision-making authority, and who covers technology, risk and compliance | Role map · controller or processor status | EIA 2.2.2 · PDPC ch. 3 |
| C. Necessity | Is there a non-AI or less privacy-intrusive alternative, and is only necessary data used? | Record of alternatives considered · list of data variables | EIA 2.2.3 · PDPC 6.2 |
| D. Red lines | Does the system involve social scoring, mass surveillance or hard-to-reverse impacts? | Team view with reasons | EIA 2.2.3 |
| E. Lawful basis | Which basis under Section 24 or 26, and an LIA if legitimate interest is used | RoPA · LIA | PDPC 4.5 |
| F. Risks to rights | Algorithmic bias, unexplainable outputs, data extracted back from the model | Bias test results · robustness test results | PDPC 6.1 · 6.2 |
| G. Trade-offs | What was traded for what, such as accuracy against minimisation, and why | Decision log | PDPC 6.2 |
| H. Human oversight | Level of human involvement, can reviewers really reverse outcomes, is there a channel to contest? | Review procedure · overturn statistics | EIA ch. 7 · PDPC 5.4 |
| I. Stakeholders | Have affected groups or their representatives been heard? | Consultation record | EIA 2.2.4 · PDPC 6.2 |
| J. Impact mapping | Positive and negative impacts per dimension, rated on the five criteria | Impact table | EIA ch. 10 |
| K. Measures and follow-up | Organisational and technical measures, owners, deadlines and review cycle | Action plan | EIA 1.7 · PDPC 6.2 |
Rating impacts without adding up a score
The draft EIA uses five criteria: scale, impacted parties, timescale, remediability and likelihood. It warns at the outset that these criteria are not meant to be totalled.
These criteria are not used to calculate a total score, but are used to compare impacts and systematically record the reasoning behind the decision.
In the author's view the most useful criterion is remediability, because it forces the team to look from the side of the person harmed rather than from the side of the system.
The assessment should be viewed from the perspective of those affected, not merely whether the organization can technically fix the system. For example, even if data in the system can be corrected immediately, if a person has already lost an opportunity or suffered damage, that impact may still not be considered easily remediable.
Suppose a screening system wrongly rejects an applicant because it misreads a qualification. IT can fix the record within a day, but the position has already been filled. On this criterion, remediability should not be rated high, and the DPIA for the same project should offer applicants a way to ask for human review, as section 5.4 of the PDPC guideline recommends.
Which mistakes make an assessment worthless?
The PDPC guideline expects assessment before personal data is collected, used or disclosed, and the draft EIA calls pre-deployment the most recommended time.
The draft EIA calls for a diverse team covering technical, legal, business, social science and operational expertise, with stakeholders involved.
Annex C, item 1.3 of the PDPC guideline treats vectors as potentially personal data if they can be reversed or matched to identify someone.
The draft EIA calls for reassessment when purpose, data, users, the model or the law change; the PDPC advises regular DPIAs when AI makes significant decisions about people.
The EIA's final step assigns actions, owners and timelines, with a way to monitor results over time.
Who should sit on the assessment team?
The draft EIA sets out six working steps: name a project lead, assemble the team, let each expert answer their own part first, hold a joint workshop, involve stakeholders, then conclude. The step most teams fall short on is genuine diversity in the team.
Assemble a team consisting of executives or team leaders responsible for providing support and setting the vision, including experts from various fields and relevant stakeholders, such as in technical, legal, business, social science, and operational areas, so that the assessment comprehensively reflects perspectives covering both technical issues and impacts on society.
For a mid-sized company, the minimum team the author would suggest is the owner of the process that will use AI, the DPO, the system administrator or AI vendor, a representative of the affected function (for example HR, if the system touches employees) and an executive with authority to approve. Results should reach the AI Governance Council described in what the board should ask before approving AI. For HR systems, continue with redesigning jobs around AI.
Not sure which system to assess first? Run each one through the AI risk check. For organisations doing this as routine work, AIPDPA keeps a DPIA workspace, an AI registry and AI Risk Radar in one place; see it in the demo account.
Frequently asked questions
Is an EIA legally required in Thailand?
No. ETDA's EIA Playbook is still a draft and is guidance, not law. Organisations use it to prepare and to give AI decisions a documented rationale. A DPIA under the PDPC's AI guideline is also guidance, but it is a way of showing that risk has been managed in line with PDPA duties.
We have done a DPIA. Do we still need an EIA?
It depends on the project. If the AI affects opportunity, fairness or vulnerable groups, an EIA covers ground a DPIA does not, such as sustainability and employment effects. You do not need to start again; reuse the scoping material and DPIA findings inside the EIA.
Who should sign off the assessment?
Neither document names a signatory. The draft EIA asks you to identify the person with final decision-making authority over the AI system during scoping, and the PDPC guideline tells executives not to approve high-risk projects before a DPIA. In practice, the sign-off belongs with whoever approves the project.
Do off-the-shelf AI systems need assessing?
Yes, ideally. The draft EIA recommends assessment at the procurement stage, and Annex B of the PDPC guideline lists a DPIA in its checklist for procuring and using AI, particularly for automated decisions or sensitive data.
Must we use ETDA's own form?
No. The draft Playbook is guidance to adapt. An organisation can design its own form as long as it covers the key questions; the combined worksheet in this article is one example compiled from both documents.
Law and sources
- Draft Ethical Impact Assessment (EIA) Playbook — AIGPC, ETDA (draft guidance, not law) — 1.5 · 1.6 · 1.7 · 2.2 · 10.6
- PDPC Guideline on Personal Data Protection in the Development and Use of AI, version 1.0 (guidance, not law; Thai only) — 2.4 · 5.4 · 6.1 · 6.2 · Annex B–
Text in the "The text" boxes is copied word for word from AIPDPA's legal knowledge base, transcribed from the Royal Gazette and official documents; every edit is checked by the system against that base, character by character. English wording is an unofficial translation; the Thai text prevails. This article is general information, not legal advice for a particular case.
Do it in the system
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)