A disciplinary record is ordinary personal data, not sensitive data under Section 26 of Thailand's PDPA, according to the Personal Data Protection Committee's Opinion 2/2568. It is not a criminal record and its potential harm is not comparable. This article shows HR teams and managers what they still owe employees: a lawful basis, limited access, care with announcements and references, and a retention rule.
- Thailand's Personal Data Protection Committee holds that internal disciplinary data is not Section 26 data, so explicit consent is not required.
- Disciplinary data is not a criminal record: it is not official criminal-case data certified by a state agency (clause 3 of the 2023 notification).
- The Committee's two-part test: could the data seriously or excessively harm rights, and do Section 26's narrow exceptions suit that kind of data?
- Disciplinary files still need a Section 24 basis and restricted access, and publishing penalty orders to the world at large may be an undue privacy intrusion.
- Some papers inside the file, such as medical certificates or police and court documents, may be Section 26 data and should be assessed one by one.
Anyone who has faced a disciplinary inquiry tends to worry about the same thing: will it follow them to the next job? HR teams ask a different question. Must a disciplinary file be treated like health data or a criminal record, where almost every collection needs the employee's explicit consent?
Thailand's Personal Data Protection Committee has now answered. In the summary of Opinion 2/2568, a requester referred to as Mr Tho asked the Committee to interpret the Personal Data Protection Act B.E. 2562 (2019) (PDPA) under Section 16(10), which gives the Committee power to interpret and rule on issues arising from the Act's enforcement.
The background was a complaint. A former employee of the organisation complained against had sat on a disciplinary inquiry panel, and later put information about the inquiry into a work history published online. An order of the relevant Expert Committee followed. The summary does not say what that order decided.
The requester asked two things. First, what kind of data counts as "any data which may affect the data subject in the same manner" that the Committee may add to Section 26? Second, would the Committee add disciplinary data to that list, to stop others suffering the same harm?
Is a disciplinary record sensitive data under Section 26?
No. The Committee describes disciplinary data as information about a person's work performance or disciplinary misconduct inside an organisation, generally used only internally. It does not match any category in the first paragraph of Section 26.
Any collection of Personal Data pertaining to racial, ethnic origin, political opinions, cult, religious or philosophical beliefs, sexual behavior, criminal records, health data, disability, trade union information, genetic data, biometric data, or of any data which may affect the data subject in the same manner, as prescribed by the Committee, is prohibited, without the explicit consent from the data subject,
The Committee gave three layers of reasoning, starting with the one people most often get wrong.
- It is not a criminal record. It is not data about the investigation of a criminal offence, criminal proceedings or criminal punishment, and it is not official or certified by a state agency with criminal-justice powers.
- It is not any other Section 26 category: race, ethnic origin, political opinions, beliefs, sexual behaviour, health, disability, trade union, genetic or biometric data.
- When the opinion was given, the Committee had never prescribed any "other data" affecting data subjects in the same manner. The open-ended slot at the end of Section 26 was still empty.
Why a disciplinary penalty is not a criminal record
The Committee applied the definition in clause 3 of its 2023 Notification on protective measures for collecting criminal record data. The definition has two conditions, and both must be met.
"Personal data relating to criminal records" means personal data relating to the investigation and inquiry into the commission of a criminal offence, criminal proceedings, or the serving of a criminal punishment, being data that is official or certified by a State agency having powers and duties under the law in relation to such actions, irrespective of whether such actions have become final or not.
The content must concern a criminal case, and the data must be official or certified by the state agency responsible. A penalty order issued by a company or agency after its own disciplinary inquiry meets neither condition, even though both processes talk about "inquiries" and "penalties".
Employers that genuinely need criminal record checks on job applicants must follow that notification's own conditions. See How far can you check a job applicant's criminal record?
What test does the Committee use to add data to Section 26?
The Committee started from the purpose of Section 26: special protection for particularly sensitive data. If such data is collected, used or disclosed improperly, the person's rights and freedoms may be seriously harmed, for example through unfair discrimination based on race, religion, health or another listed category.
That is why the Act demands explicit consent unless an exception in Section 26(1) to (5), read with Section 27 paragraph one, applies. The Committee stressed that these exceptions are deliberately restricted and narrower than those in Section 24. Adding a new type of data to Section 26 therefore means answering two questions.
| Question | What the Committee said about disciplinary data |
|---|---|
| 1. Could the data affect a person's rights and freedoms seriously or excessively? | Not to a degree comparable with criminal records or other Section 26 data; the process is generally internal to the organisation. |
| 2. How well do Section 26's specially restricted exceptions suit that kind of data? | The summary does not address this point separately, but notes that organisations can set confidentiality levels and limits themselves, and that affected people already have routes to complain or claim. |
Our reading: the second question matters more than it looks. If disciplinary data fell under Section 26, an employer would be left with explicit consent and five narrow exceptions, without the contract or legitimate interest bases. Investigating an employee who refuses consent would stall immediately. This is our analysis, not the Committee's wording.
What would change for HR if data fell under Section 26
| Point | Ordinary personal data | Section 26 data |
|---|---|---|
| General rule for collection | Consent required (Section 24) | Explicit consent required (Section 26) |
| Exceptions that replace consent | Six in Section 24, including contract, legitimate interests and legal obligation | Five in Section 26(1) to (5); no contract or legitimate interest basis |
| Further use or disclosure | Allowed if collected under a Section 24 exemption (Section 27 para 1) | Allowed if collected under a Section 26 exemption (Section 27 para 1) |
| Section 39 record of processing | Small organisations may be exempt from some items under Committee rules, unless the conditions at the end of Section 39 apply | The small-organisation exemption is lost once Section 26 data is collected, used or disclosed |
The Section 26 exception closest to HR work is Section 26(5)(c) on employment protection, but it requires the processing to be necessary for compliance with a law. In our view, an inquiry under a company's internal work rules would not always fit. The Committee's answer lets HR keep relying on the ordinary Section 24 bases.
Why the Committee declined to add it
Beyond the question of seriousness, the Committee gave two supporting reasons that HR teams should remember. First, the organisation, as data controller, can already set confidentiality levels and appropriate limits on how disciplinary data is collected, used and disclosed.
Second, if disciplinary data is collected, used or disclosed improperly, the affected person can complain under the personal data protection law or claim liability under other laws. With remedies already available, the Committee saw no need to elevate this data for now.
If it is not sensitive, can HR use disciplinary files freely?
No. Disciplinary data is still personal data in every sense. Before Opinion 2/2568, the Committee had already told the Office of the National Anti-Corruption Commission (NACC) that disciplinary proceedings unconnected with a criminal offence are not covered by Section 4(5), the PDPA's exemption for the criminal justice process.
ส่วนกรณีการเก็บรวบรวม ใช้ หรือเปิดเผยข้อมูลเพื่อนำไปใช้ในกระบวนการที่นำไปสู่การลงโทษผู้กระทำความผิดซึ่งมีโทษทางวินัยที่ไม่เกี่ยวเนื่องกับการกระทำผิดทางอาญา ไม่ถือเป็นการดำเนินงานตามกระบวนการยุติธรรมทางอาญา จึงไม่ได้รับการยกเว้นตามมาตรา ๔ (๕) แห่งพระราชบัญญัติดังกล่าว โดยการเก็บรวบรวมข้อมูลส่วนบุคคลต้องปฏิบัติตามมาตรา ๒๔ และมาตรา ๒๖ แห่งพระราชบัญญัติดังกล่าวIn plain English: collecting, using or disclosing data for a process that leads to a disciplinary penalty unconnected with any criminal offence is not part of the criminal justice process. It is not exempt under Section 4(5), and collection must comply with Sections 24 and 26.
In practice, every stage of a disciplinary case, from receiving a complaint and calling witnesses to issuing a penalty order, needs a lawful basis. Collection must be limited to what is necessary under Section 22, and employees must be told under Section 23 why the data is collected, how long it is kept and to whom it may be disclosed.
Which lawful basis is likely to fit
Opinion 2/2568 does not name a basis, so this part is our reading. For public bodies, the Committee has set a pattern in another personnel matter: in its opinion for the Office of the Teacher Civil Service and Educational Personnel Commission on teacher evaluations, collection under statutory duties and powers could rely on Section 24(4) or 24(6). We think disciplinary inquiries carried out under statutory powers would follow the same logic.
For private employers, we see three workable bases: performance of the employment contract under Section 24(3), the employer's legitimate interest in maintaining discipline under Section 24(5), or legal obligation under Section 24(6) where a law imposes the duty. If you choose Section 24(5), run and record a balancing test. See the three-step legitimate interest test.
In our view consent is a poor fit for this work. An accused employee may refuse from the start, and if an employer relies on consent, the day the employee withdraws it the employer must find another basis to justify keeping the file.
Assess each document in the file separately
The Committee's answer concerns disciplinary data as such. Real disciplinary files usually contain other attachments, and some of them may be Section 26 data. The table below is our reading, meant as a starting point for sorting a file.
| Document in the file | Likely category | Short reason |
|---|---|---|
| Complaint letter, witness statements, inquiry report, penalty order | Ordinary personal data | Matches the Committee's answer in Opinion 2/2568 |
| Medical certificate the employee submits to explain an absence | Health data under Section 26 | Health data is already listed in Section 26 para 1 |
| Copy of a police summons or a criminal court judgment used in the inquiry | Possibly a criminal record | Criminal-case data from a state agency fits clause 3 of the 2023 notification |
| A note recording that the employee is a trade union member | Trade union data under Section 26 | Listed in Section 26 para 1 |
Criminal-case documents come with their own collection conditions under the 2023 notification. If they are not truly needed for the inquiry, do not request them for the file. For sensitive data hiding in other HR paperwork, see Sensitive data your company holds without knowing.
Who in the organisation should be able to open disciplinary files?
Only people who need the data to do their job. One reason the Committee gave for not treating disciplinary data as sensitive is that organisations can set confidentiality levels and limits themselves. Our reading: an organisation that has never done so is neglecting one of the reasons the Committee relied on.
(5) rights and methods for access to the Personal Data, including the conditions regarding the Person having the right to access the Personal Data and the conditions to access such Personal Data;
Section 37(1) also requires appropriate security measures against unauthorised or unlawful access and disclosure. The list below is our recommendation.
- Name the roles that may open disciplinary files, such as the HR officer responsible for discipline, panel members for their own case only, and the person who signs the order.
- Keep disciplinary files apart from general personnel files that line managers can browse.
- State in every panel appointment order that case information may not be used outside the inquiry, including in personal CVs or portfolios.
- Set a confidentiality level for each case file and log who opened it and when.
- When panel members leave the panel or the organisation, have them return documents and delete copies on personal devices or email accounts.
Can you announce a penalty to all staff or publish it online?
Be very careful. The PDPA has no section on announcing penalty orders, but the PDPC Office's book of advisory opinions contains a close parallel. The Federation of Accounting Professions asked whether it could publish ethics penalty orders against accountants on its website, so the public could take care before hiring them.
ดังนั้น การเปิดเผยข้อมูลรายละเอียดในคำสั่งลงโทษจรรยาบรรณของผู้ประกอบวิชาชีพบัญชีจากคณะกรรมการจรรยาบรรณไว้บนเว็บไซต์ของสภาวิชาชีพบัญชีเป็นการทั่วไปจึงอาจเป็นการละเมิดหรือรุกล้ำสิทธิส่วนบุคคลโดยไม่สมควรIn plain English: publishing the details of ethics penalty orders on the Federation's website for general viewing may be an undue intrusion into privacy. The ad hoc subcommittee said the Federation must weigh its statutory public-interest duty against the private interests involved and act only as far as necessary. People with a real need can still ask to inspect the information case by case under the Official Information Act of 1997.
Our reading: the Federation has a statutory duty to protect the public, and still heard that general publication may go too far. A private company that wants to circulate an employee's name and penalty to all staff needs an even stronger reason, and every disclosure needs a basis under Section 27 paragraph one.
The Data Controller shall not use or disclose Personal Data without the consent of the data subject, unless it is the Personal Data which is collected without requirement of consent under section 24 or section 26.
The scenarios below are hypothetical, except the last one, which is the complaint behind Opinion 2/2568. The risk ratings are our reading, not rulings of the Committee.
Everyone told has a reason to know. The manager must monitor compliance with the order; the complainant only learns that the organisation has dealt with the complaint, not the penalty.
In a small team, naming the department and the month may be enough to identify the person. Strip details until nobody can be singled out.
Most recipients have no reason to know. It is hard to show necessity under Section 22 or a passing balance under Section 24(5), unless a law that applies to the organisation requires publication.
The disclosure falls outside the purpose of the inquiry and beyond the limits the organisation should have set.
This is the real complaint behind Opinion 2/2568. The Committee only said affected people may complain under the PDPA or claim under other laws. We think organisations should forbid this in the panel appointment order from the outset.
A new employer asks about disciplinary history: how much can HR say?
Only what a lawful basis supports, and usually less than the caller would like. Opinion 2/2568 does not deal with references, so everything in this section is our recommendation, built on the general principles of the PDPA.
Telling another company about a penalty is a disclosure of personal data and needs a basis under Section 27 paragraph one. In our view the safest route is the former employee's consent, for example a signed authorisation from the applicant that the new employer forwards and the old employer checks before answering.
The company receiving the information may use it only for the purpose it stated when asking, under Section 27 paragraph two. The company answering must also make sure that what it says is accurate.
The Data Controller shall ensure that the Personal Data remains accurate, up-to-date, complete, and not misleading.
- Confirm only what appears in a final order. Do not pass on allegations, suspicions or hearsay.
- Let a small number of designated people answer in writing; do not let former line managers answer by phone.
- If there is no consent but the organisation believes another basis allows an answer, record the reasoning and log the disclosure in the Section 39 record, as Section 27 paragraph three requires.
- Describe the scope of references in the employee privacy notice, since Section 23(4) requires telling employees the categories of people or bodies their data may be disclosed to.
For references and employee data across the whole employment cycle, see Employee data from application to exit.
How long should a disciplinary file be kept?
The PDPA sets no number of years for disciplinary files. The organisation must set its own period, tell employees under Section 23(3), and have a system to delete files when the period ends. Other laws that apply to the organisation may set their own periods; this article has not reviewed them.
(3) put in place the examination system for erasure or destruction of the Personal Data when the retention period ends, or when the Personal Data is irrelevant or beyond the purpose necessary for which it has been collected,
The end of Section 37(3) allows longer retention in some cases, such as the establishment, exercise or defence of legal claims, or compliance with the law. In our view, a disciplinary file that could turn into a dispute has a reason to be kept while a claim is still possible, and should be deleted once that reason is gone.
Files from inquiries that found no misconduct should go first. For the reasoning and the guidance behind it, see Former employees' data: keep or erase? The sequence below is our recommendation for a single disciplinary case.
- Complaint receivedRecord only what is needed to open the case and keep it within the discipline team.Section 22
- Panel appointedPut the ban on using case data outside the inquiry into the appointment order and set the file's confidentiality level.Section 37(1) · 39(5)
- During the inquirySeparate any Section 26 documents, such as medical certificates, and protect them more tightly than the rest.Section 26
- Order issuedTell only the people who need to know, and log any consent-free disclosure in the record of processing.Section 27 · 39
- Retention period endsDelete or destroy the original, email copies and files held by panel members, and record the date of deletion.Section 37(3)
Frequently asked questions
Is a written warning the same kind of disciplinary data as a suspension or dismissal order?
Opinion 2/2568 speaks of disciplinary data in general and does not distinguish by severity, so we read it as the same rule: not Section 26 data. Heavier penalties usually affect the employee more, so access to them should be narrower.
If the misconduct is also a crime, does the data become a criminal record?
The organisation's own inquiry records still do not meet the clause 3 definition in the 2023 notification, because they are not official data from a state agency with criminal-justice powers. Documents from the police, public prosecutors or courts placed in the file may meet it. This distinction is our reading of that definition.
Do civil servants and private-sector employees follow the same rule?
On the Section 26 question, yes: the Committee spoke of internal disciplinary action in organisations generally. Public bodies must also consider the Official Information Act, as the ad hoc subcommittee told the Federation of Accounting Professions.
Did the opinion decide whether posting disciplinary details online was unlawful?
No. The summary only answers whether disciplinary data is Section 26 data and whether it should be added. The Committee said only that people affected by improper use may complain under the PDPA or claim liability under other laws.
Can an employee ask for their disciplinary record to be erased?
Yes, under Section 33, for example once the data is no longer needed for its purpose. But Section 33 paragraph two lets the organisation keep it where it is still needed to establish, exercise or defend legal claims, or to comply with the law.
Could disciplinary data become sensitive data one day?
Legally, yes. Section 26 lets the Committee prescribe other data, and the opinion says only that it is not yet appropriate. No such notification existed when the opinion was given, so organisations should keep watching the Committee's notifications.
You have read it. Now get it done
Open the demo account to see the real AIPDPA system with a sample company: RoPA, the 72-hour breach clock, data subject requests, cookie consent and ready-to-use documents, all in one place.
From 2,900 THB/year (11 modules) · all 24 modules from ENTERPRISE at 19,900 THB/year · demo account, no sign-up
Need a contract now? Generate it at OK Contracts →Thai and English contracts, ready as soon as you fill in the details
Law and sources
- Personal Data Protection Act B.E. 2562 (2019) — Section 4 (5) · 16 (10) · 22 · 23 · 24 · 26 · 27 · 33 · 35 · 37 (1) (3) · 39
- Notification of the Personal Data Protection Committee on Protective Measures for the Collection of Criminal Record Data not Carried Out under the Control of a Competent Authority B.E. 2566 (2023) — Clause 3
- Summaries of PDPC advisory opinions under the Personal Data Protection Act B.E. 2562 (Office of the Personal Data Protection Committee)
Text in the "The text" boxes is copied word for word from AIPDPA's legal knowledge base, transcribed from the Royal Gazette and official documents; every edit is checked by the system against that base, character by character. English wording is an unofficial translation; the Thai text prevails. This article is general information, not legal advice for a particular case.
Do it in the system
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)