CCTV in offices, shops and condos: what the PDPA expects

A coffee shop has two cameras over the counter. An office has cameras at the entrance and in the file room. A condominium records the lifts, the car park and every corridor. Most owners see these as security tools with nothing to do with data protection.

But footage clear enough to tell who someone is counts as personal data, and recording it is collection. That brings in the full set of duties under the Personal Data Protection Act B.E. 2562 (2019), or PDPA: notice, a lawful basis, a retention period and rules for handing footage to anyone else.

This article reads the PDPA alongside TDPG 4.0, which uses CCTV as an example in several chapters, and an advisory opinion from the Office of the Personal Data Protection Committee (PDPC Office) on condominium juristic persons. For the short version, start with our CCTV and PDPA guide.

What must a CCTV operator tell people, and when?

Notice is due before or at the time of collection under Section 23. For CCTV that moment comes before a person walks into the camera's view, so the sign has to be visible before they enter the area.

Section 23 lists six items. Printed in full, a sign becomes too big, or the type too small to read. TDPG 4.0 therefore suggests giving the information in layers.

TDPG 4.0 item E44 adds points worth covering for cameras, including recipients and any transfer abroad (relevant if footage sits on an overseas cloud) and the retention period. It suggests signs or stickers both at entrances and inside the covered area.

Do you need consent from people who walk past a camera?

No, and consent would be the wrong tool, because people entering a building cannot realistically refuse to be recorded. TDPG 4.0 item E44 points to legitimate interest under Section 24 (5) for security cameras and recommends a Legitimate Interest Assessment (LIA).

The same item warns against collecting more than necessary, for example in highly private areas, and says that audio recording or facial analysis raises the risk enough to warrant a DPIA. Face recognition used to identify people may also count as biometric data, which is sensitive data under Section 26.

Cameras aimed at how staff work, rather than at the door, raise a further issue. TDPG 4.0 item HR65 says employee consent to such monitoring may not be freely given, so the employer cannot rely on it and must balance its interest instead. Our article on when consent is the wrong basis explains why.

How long should footage be kept?

The PDPA sets no fixed number of days for CCTV. Keep footage only as long as the purpose needs, and state the period in the Section 23 (3) notice. TDPG 4.0 shows why different businesses reach different answers.

The example gives a method any business can use: ask how long after an incident you normally discover that you need to look back. A restaurant hears about a fight the same night; a bank may only learn of a suspicious withdrawal when the customer reads a statement.

The G7 example goes on to say that once an incident has been reported to police, the footage must be kept until police collect it as evidence. A system that overwrites automatically needs a way to pull relevant clips out first. The 15–30 days in item E44 is a reasonable starting point, but write down your own reasons too.

Who should be allowed to view footage?

As few people as the job requires, with a record of who looked and when. TDPG 4.0 item HR70 tells employers to keep access to monitoring data to the smallest possible group, and item E44 recommends an access log, defined roles for camera operators, and encrypted or locked files.

• Name the roles that may review recorded footage, such as the head of security and the building manager, separately from staff who watch live screens.
• Reviews need a reason and an entry in a log or system: who, which time range, and why.
• Copying or exporting clips should need approval, with copies kept somewhere lockable.
• Installers and security firms acting on the owner's instructions are data processors and need a data processing agreement (TDPG 4.0 item HR75 and the security company example in Chapter B).

At work, TDPG 4.0 item HR74 also asks employers to tell staff, by a clear sign or notice, where cameras are, how the system works, how to contact the system provider and why the cameras are used. TDPG is explicit about places where cameras do not belong.

Covert cameras, under TDPG 4.0 item HR76, belong to unusual cases with reasonable grounds, such as a suspected crime or misconduct that must be investigated quickly. The employer should look only at relevant data, delete what is irrelevant and stop when the investigation ends.

Police ask for footage. Do you have to hand it over?

You may, where the requester has legal authority, and you should check that authority first. TDPG 4.0 item M2 states both sides: disclose when the state has power to ask; if it does not, the controller carries the liability.

TDPG 4.0 item M16 adds that Section 4 exempts only the state body's own activities. A private business that discloses to the state is not exempt and needs a basis under Section 24 or 26 read with Section 27, plus a record of the disclosure. TDPG cites the PDPC Office's answer to Hospital B, which treated an inquiry officer's request under the Criminal Procedure Code as part of the criminal justice process.

1. Receive
   Note the agency, officer, unit, date and the time range of footage requestedTDPG item M15
2. Check authority
   Look at what was provided: a warrant or court order, an official letter citing a specific law, or nothingTDPG item M15
3. Decide
   Act on a warrant or court order; if there is no document or it is doubtful, hold off until authority is shownTDPG item M15
4. Hand over
   Cut only the relevant segment, send it securely and keep a copy of what was sentSections 22 and 37 (1)
5. Record
   Log the disclosure in the Section 39 record and keep the request papers for the whole processSection 27 paragraph three · TDPG item M16

A customer or resident asks to see footage. What now?

First work out who is asking. A person who appears in the footage and wants their own images is exercising the right of access under Section 30. Someone who is not in the footage, such as a car owner who wants to see who scratched the car, is asking you to disclose other people's data, which needs a basis under Section 27.

Footage usually captures other people too, which is why Section 30 paragraph two matters. Blurring other faces before release is a common way to answer the request without harming others. If you refuse, Section 30 paragraph three requires the refusal and reasons to be recorded in the Section 39 record.

When an outsider wants to see footage of someone else, the safer route is to ask them to file a police report and then release the footage to the inquiry officer as above, rather than replaying it at the front desk. If you do show it on the basis of legitimate interest, weigh the interests and record the reasoning first.

What are condominium juristic persons exempt from?

Only part of the record-keeping duty, not notice or security. Answering a question from condominium juristic person O., the PDPC Office said a non-profit condominium juristic person qualifies for some record-keeping exemptions under the small-business notification, but closed with a clear caveat. The book has no official English text, so the Thai original is quoted below.

In plain English: the condominium still has to collect only what it needs under Section 22 and give a privacy notice under Section 23. The same opinion says the exemption does not cover processing that risks people's rights or that is not occasional. Round-the-clock CCTV likely falls there, so keeping a RoPA entry for cameras is the safer course, as TDPG 4.0's condominium example under item E45 also suggests.

On the basis, TDPG 4.0's condominium example under item E45 suggests legitimate interest for security, and consent before publishing images or personal data in public media, such as posting a photo of a resident who dumped rubbish into the building's LINE group.

Who stands behind this guide?

Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel

Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)