AI in hiring and staff evaluation: what HR must watch

Suppose a Thai retailer opens several hundred shop-floor vacancies at once and receives thousands of applications. HR buys an AI tool that reads CVs and scores them. Anyone below the cut-off gets an automatic rejection email, and nobody opens those applications again.

Tools like this genuinely save time, but this is exactly the case the PDPC's AI guideline singles out as high-risk. The trouble is not the AI itself. It is that nobody knows why the system rejected anyone, nobody is responsible for checking, and the candidates do not even know an AI was involved.

This article sets three sources side by side: the Personal Data Protection Act B.E. 2562 (2019), which binds every company in Thailand; the Personal Data Protection Committee's guideline on AI, which is guidance rather than law; and the EU AI Act, which applies to Thai companies only when they fall within its scope.

What does the PDPC AI guideline say about HR?

It says plainly that using AI to screen job applicants or evaluate employee performance is a high-risk case that should go through a data protection impact assessment. The guideline, version 1.0, was prepared by the Office of the Personal Data Protection Committee (PDPC Office) together with ETDA and has been published in Thai only, so we quote the Thai original and explain it in English.

In substance: processing personal data with a high-risk AI system calls for a DPIA, and the guideline's examples of high-risk automated decision-making with legal or similarly significant effects include credit approval, screening for employment and evaluating employee performance. A box for executives at the end of the same section adds that high-risk AI projects such as staff screening should not be approved until a DPIA has been done.

The guideline uses 'should', so this is not a statutory duty in itself. In our view, though, if a complaint ever arises, ignoring advice the regulator spelled out this clearly will be hard to explain. For the mechanics, see when and how to run a DPIA.

The guideline's own example

The example describes a large company that uses AI to shortlist applicants for interview. If the system learned from historical data skewed by gender, for instance only men hired as engineers, it may automatically reject fully qualified women. The guideline then recommends checks for algorithmic bias, measures for fairness, a way to verify and correct personal data, and channels for people to exercise their rights. The accuracy point is tied directly to the Act.

A score built on wrong or stale data — a misread degree, an appraisal from years ago — can give a misleading picture of the person. HR should let candidates and employees ask for corrections, and keep a record of what was changed and when.

Does a person clicking 'approve' count as human review?

No, not if the person simply confirms what the system proposes. The PDPC guideline calls this rubber-stamping and says the decision then remains automated in fact.

The guideline sets three conditions for meaningful review: the reviewer (1) considers the system's output together with other information and factors after the output is produced, (2) has the authority and competence to actually overturn or correct it, and (3) has been trained to recognise automation bias. In HR terms, the reviewer reads the actual application rather than the score, can bring back a rejected candidate without layers of sign-off, and knows that people tend to trust machine numbers too much.

Section 5.4 also recommends telling people in advance when a system has a decisive influence on a decision about them, and explaining the steps and logic actually used so they understand which of their data mattered. There is no need to reveal algorithms or source code, but trade secrecy cannot justify refusing any explanation at all. There should also be a way to ask for human review, contest the outcome and add facts.

What must candidates be told, and which data is off-limits?

Candidates must be informed before or at collection, and sensitive data cannot be collected without a Section 26 basis. Both rules bind every company in Thailand today, whether or not AI is involved.

Section 23 does not mention AI. Appendix B of the PDPC AI guideline, however, recommends updating privacy notices to cover AI use on the principles of Section 23 and stating that AI is used. A job advertisement or application form should therefore say that applications are screened automatically, what data is used, whether a person reviews the result and how to ask for a review. For wording, see what a privacy notice must contain.

Video-interview tools need the most care. Section 26 paragraph two defines biometric data as data from technology that uses physical or behavioural characteristics to identify a person, such as facial recognition data. If a tool generates that kind of data, it is sensitive data at once.

Sensitive data also slips in through CVs themselves: many applicants volunteer their religion, a chronic illness or a disability without being asked. The safe course is to configure the tool so those fields never feed the score, and to strip them before upload where you can. Criminal record checks have their own PDPC notification; see how far employers can check criminal records, and for Section 26 generally, handling sensitive personal data.

What else applies if the results reach Europe?

The EU AI Act. It does not generally bind companies in Thailand, but it applies when a company falls within Article 2: selling a screening tool to EU customers, for example, or scoring candidates with AI and sending the results to a company in the EU. How to test scope is covered in when the EU AI Act applies to a Thai company.

Those two points cover almost the whole HR cycle: targeted job ads, filtering applications, scoring candidates, promotion, termination, task allocation by behaviour, and performance monitoring. Because such systems profile individuals, the last subparagraph of Article 6(3) makes them high-risk in every case; the 'preparatory task' derogation is not available.

For deployers, the core duties sit in Article 26: use the system according to the provider's instructions, give oversight to people with the necessary competence, training and authority, keep input data relevant and sufficiently representative, and retain automatically generated logs for at least six months. One duty is addressed to employers by name.

Article 26 duties for Annex III systems apply from 2 December 2027 under amended Article 113. The Article 5 prohibitions, however, have applied since 2 February 2025, and one of them matches certain people-assessment tools on the market.

A tool that claims to read employees' stress, engagement or satisfaction from their faces or voices at work therefore falls squarely within this ban for a company in scope. Whether interviewing a candidate counts as the 'workplace' is a question for EU counsel. Companies outside the Act's scope are not bound by it, but such a tool should still go through a DPIA under the PDPC guideline and be checked for biometric data under PDPA Section 26.

What should HR do, step by step?

The sequence follows the life of the system, from before purchase to after a hiring round closes. The right-hand column shows the source for each step: steps based on the PDPC guideline are recommended practice, while steps based on PDPA sections are legal duties.

1. Before buying or renting
   Ask the vendor what data drives the score, how bias was tested, and whether our applications will train its own models; write the prohibition into the data processing agreementPDPC guideline, Appendix B items 1–2
2. Before go-live
   Run a DPIA, choose the legal basis, exclude sensitive fields from scoring and name a reviewer with power to overturnPDPC guideline 6.2 · PDPA Section 26
3. When advertising the job
   State in the privacy notice that screening is automated, what data is used, how long it is kept and how to request human reviewPDPA Section 23
4. Every time the system rejects people
   Have the reviewer read actual applications among those rejected, at least on a sample basis, and record how many were overturnedPDPC guideline 5.4
5. When a candidate objects
   Log the request, have a person review it, explain the system's role and the data used, correct errors, and reply within the time limits set by law and the relevant notificationsPDPA Section 35 · Chapter 3
6. After the round closes
   Compare outcomes across groups for unusual rejection rates, and delete candidate data no longer needed under the stated retention periodPDPC guideline 6.1 · PDPA Section 37(3)

In AIPDPA, a screening tool can be entered in the AI registry and linked to the RoPA, assessed in the DPIA workspace, and supported by the data subject request portal, which takes candidates' review requests and runs a deadline clock. The PDPC AI-guideline checklist is there to work through item by item. You can see it in the demo account.

Common HR mistakes

Who stands behind this guide?

Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel

Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)