How Far Can You Check a Job Applicant's Criminal Record? Thailand's 2023 Rules and the PDPC's Answer to the Thai Bankers' Association

Picture this: you run HR for a retail chain hiring 40 new staff. The old application form has a line that reads "attach your criminal record check", and it applies to every role, from cashier to shelf stacker. The results get stapled into personnel files and stay there for as long as the employee does.

That form carries at least three risks since the PDPC's Notification on Criteria concerning Protective Measures for the Collection of Personal Data relating to Criminal Records not Carried Out under the Control of a Competent Authority, B.E. 2566 (2023), came into force in April 2024: it asks every applicant without checking whether there is a basis, it does not announce the need at the advertisement stage, and it keeps the results indefinitely.

The good news is that the rules are less murky than many assume. The Thai Bankers' Association put detailed questions on exactly this point, and the answers are published in the compilation of Expert Committee orders and consultation summaries issued by the Office of the Personal Data Protection Committee. This article lays the statute, the Notification and the consultation answers side by side, then turns them into a decision table an HR team can actually use.

Is a criminal record sensitive data under Thailand's PDPA?

Yes. Section 26 paragraph one of the Personal Data Protection Act B.E. 2562 (2019) lists criminal records among the categories that may not be collected without explicit consent unless an exception in (1) to (5) applies. Criminal records then get an extra layer that other sensitive categories do not.

Section 26 paragraph three splits criminal record collection into two worlds. In the first, collection happens under the control of an authority empowered by law. The second is everything else, which needs protective measures under rules the Committee issues. A private employer running its own applicant checks usually lives in the second world, which makes the 2023 Notification, issued under this paragraph, the main rulebook for HR.

What counts as criminal record data, and does a "no record found" certificate count?

Only data that is official or certified by a state agency counts, but the case does not need to be final. Clause 3 of the 2023 Notification defines it as

The question HR faces every day is whether a certificate reading "no criminal record found" counts. The Thai Bankers' Association asked exactly that in issue 1.1(a), and the subcommittee answered:

In plain English: keeping an original or copy of a certificate from the Royal Thai Police Criminal Records Division, or another competent authority, that says "no criminal record found" is not collecting criminal record data under the Notification, as long as it is not and cannot be linked to other personal data about an investigation, prosecution or criminal penalty.

Flip the wording and the answer flips too. Where a document records that a complaint was withdrawn, that the prosecutor decided not to prosecute, that a sentence was suspended, or that an appeal is pending, the subcommittee said in issue 1.1(b) that this is part of an investigation, prosecution or criminal penalty, and therefore criminal record data. The same logic applies to status fields in an HR system, per issue 1.2.

Beyond hiring: police letters and account freeze orders

In a separate consultation, the Thai Bankers' Association asked whether data banks receive while complying with the Emergency Decree on Measures for the Prevention and Suppression of Technology Crimes B.E. 2566 (2023) counts as criminal record data. The subcommittee said that information from letters of the Economic Crime Suppression Division or the Anti Online Scam Operation Center (AOC), and data in freeze orders and orders to examine data, is criminal record data under Clause 3. Data exchanged through the Central Fraud Registry depends on the facts of each case. If a bank uses such data for its own internal measures, it must follow Clauses 6, 7 and 8 of the Notification. The takeaway for HR: case data that reaches you from a state agency without your asking, such as an order concerning an employee, does not escape the rules simply because you did not request it.

When may an employer collect an applicant's criminal record?

When a law requires the check, or when the applicant gives explicit consent. There is no third route. Clause 5 paragraph one of the 2023 Notification reads

The word "only" closes the shortcuts many HR teams used to take. In issue 4.1 the Thai Bankers' Association tried three alternatives to consent, and the answers are worth remembering in any industry.

• "Our business matters to the economy" is not enough. The substantial public interest exception in Section 26(5)(e) requires a law that imposes a duty to check criminal records. The importance of the business alone does not qualify (issue 4.1(a)).
• Roles where a law sets criminal disqualifications can be checked without consent. The subcommittee's examples were directors of public limited companies under Section 68(3) of the Public Limited Companies Act B.E. 2535 (1992), and directors, managers, persons with management authority or advisers of financial institutions under the Financial Institutions Businesses Act B.E. 2551 (2008) together with a Bank of Thailand notification (issue 4.1(b)).
• Criteria the company sets for itself are not an "assessment of the working capacity of the employee" under Section 26(5)(a), because that exception also needs a legal provision behind it (issue 4.1(c)).

In English: collecting criminal record data to verify the qualifications, disqualifications or suitability of a person for a position that carries such statutory conditions is necessary for compliance with the law to achieve a substantial public interest under Section 26(5)(e), so explicit consent is not required.

In English: if a bank sets its own requirement that staff in a role must never have been imprisoned by final judgment for property, gambling or drug offences, but no legal provision prescribes that assessment of working capacity, Section 26(5)(a) does not apply and criminal record data cannot be collected without explicit consent. Put in HR terms: if you can point to the section of a law that sets criminal disqualifications for the role, you can rely on the law. If you cannot, however sound the business reason, you need explicit consent and must follow Clauses 5, 6 and 9 of the Notification.

Can consent be made a condition of being hired?

Yes, if the check is genuinely necessary for or related to the job. This matters because Section 19 paragraph four of the PDPA forbids tying unnecessary consent to a contract.

In issue 4.2(a) the Thai Bankers' Association asked whether refusing to hire a selected candidate who withholds consent would offend the spirit of Section 19. The subcommittee answered that if the controller considers consent sufficiently necessary for, or related to, the hiring decision, it may make consent part of the contract terms under Section 19 paragraph four. The candidate can still complain under Section 73 if they believe the organisation is in breach. Employers should therefore write down the necessity reasoning for each role when they design the job advertisement.

The same principle appears in the Expressway Authority of Thailand consultation on face and fingerprint time clocks, which also involve sensitive biometric data under Section 26. There, one employee out of more than three thousand refused. The subcommittee set out four elements for relying on the labour-protection exception in Section 26(5)(c) instead of consent: the collection must be necessary to comply with a law, it must serve labour protection, it must be necessary for the rights or duties of employer or employee, and suitable safeguards must be in place. Preventing staff from clocking in for each other could be a supporting fact. If that problem is not established, or a non-biometric method could work, the exception does not apply, and where consent is not necessary for the employment contract the employer must offer an alternative.

In English: the Authority must provide another way of recording working time, and handling related matters, for employees who do not give, or withdraw, consent to the collection, use or disclosure of their biometric data.

When must you tell applicants, and what belongs in the job advert?

From the moment you advertise or publicise the vacancy, not when the form is submitted or at interview. Clause 5 paragraph two of the 2023 Notification says so, and Clause 6 adds a duty whenever you rely on consent.

Combining the Notification with the consultation answers, the job advert and consent form for any role that requires a check should cover the following.

1. In the job advert: state that the role requires a criminal record check, and why the role needs it (Clause 5 paragraph two).
2. The basis: if a law requires the check, name the law and section. If you rely on consent, say plainly that it is explicit consent under Section 26.
3. What you collect and from where: for example, a result from the Royal Thai Police Criminal Records Division, the source named in the consultation.
4. The effect of refusing or withdrawing consent: for example, that the organisation may be unable to consider the applicant for this role (Clause 6).
5. Retention: results will be erased, destroyed or anonymised within 6 months of the selection process ending for that applicant, unless a specific law or a PDPA necessity applies (Clause 9).
6. A separate consent box if you want to keep results for longer than 6 months, never bundled with consent to the check itself (consultation issue 4.2(c) and Section 19 paragraph three).
7. Who has access: only the people who need it for the decision, under the organisational and technical measures in Clause 7 and the security measures in Clause 8.
8. Applicant rights: including the right to withdraw consent and to complain to the Expert Committee under Section 73.

In English: because these are two different consent requests, they must be clearly separated from each other and from any other text, as Section 19 paragraph three requires.

How long can you keep criminal record check results?

Absent a specific law and a necessity under the PDPA, no more than 6 months after selection ends for each applicant. After that, Clause 9 paragraph two requires the data to be erased, destroyed or anonymised.

The Notification leaves two routes to longer retention. The first is a separate explicit consent, which the subcommittee confirmed in issue 4.2(b) is possible, for instance for a bank that wants to keep results until an employee leaves plus ten years. The second is more interesting, because it needs no consent at all.

In English: keeping the data as evidence for limitation periods may count as necessary for establishing, complying with, exercising or defending legal claims under Section 26(4) of the PDPA. Note the word "may". The Section 26(4) necessity has to rest on facts, case by case. Stapling every employee's result into their file for their whole career, without any assessment, is unlikely to be what this observation was meant to support.

Three more timing answers are worth knowing. First, for results collected before the Notification took effect, the 6-month period runs from the Notification's effective date, because the rule must not apply retroactively to the controller's detriment (issue 2). Second, if you repurpose results for a new purpose that falls within Clause 5, the 6-month clock restarts when the new process ends (issue 3.2). Third, retention for purposes outside Clause 5, such as prosecuting employee fraud, is not capped by Clause 9, but it still needs a Section 26 basis and a Section 37(3) deletion system (issue 3.1).

The 6-month limit only happens if something counts it down; a sentence in a policy will not. AIPDPA gives you a consent register that separates each purpose, plus retention rules and disposal logs. See the demo account.

The HR decision table: which roles can be checked, and on what basis?

Mistakes HR teams make most often

Who stands behind this guide?

Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel

Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)